sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_asconf.c,v 1.24 2005/03/06 16:04:16 itojun Exp $  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35 #include <netinet/sctp_os.h>
  36 #include <netinet/sctp_var.h>
  37 #include <netinet/sctp_sysctl.h>
  38 #include <netinet/sctp_pcb.h>
  39 #include <netinet/sctp_header.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_output.h>
  42 #include <netinet/sctp_asconf.h>
  43 #include <netinet/sctp_timer.h>
  44
  45 /*
  46  * debug flags:
  47  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  48  * SCTP_DEBUG_ASCONF2: detailed info
  49  */
  50 #ifdef SCTP_DEBUG
  51 #endif                          /* SCTP_DEBUG */
  52
  53
  54 static void
  55 sctp_asconf_get_source_ip(struct mbuf *m, struct sockaddr *sa)
  56 {
  57         struct ip *iph;
  58         struct sockaddr_in *sin;
  59
  60 #ifdef INET6
  61         struct sockaddr_in6 *sin6;
  62
  63 #endif
  64
  65         iph = mtod(m, struct ip *);
  66         if (iph->ip_v == IPVERSION) {
  67                 /* IPv4 source */
  68                 sin = (struct sockaddr_in *)sa;
  69                 bzero(sin, sizeof(*sin));
  70                 sin->sin_family = AF_INET;
  71                 sin->sin_len = sizeof(struct sockaddr_in);
  72                 sin->sin_port = 0;
  73                 sin->sin_addr.s_addr = iph->ip_src.s_addr;
  74                 return;
  75         }
  76 #ifdef INET6
  77         else if (iph->ip_v == (IPV6_VERSION >> 4)) {
  78                 /* IPv6 source */
  79                 struct ip6_hdr *ip6;
  80
  81                 sin6 = (struct sockaddr_in6 *)sa;
  82                 bzero(sin6, sizeof(*sin6));
  83                 sin6->sin6_family = AF_INET6;
  84                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  85                 sin6->sin6_port = 0;
  86                 ip6 = mtod(m, struct ip6_hdr *);
  87                 sin6->sin6_addr = ip6->ip6_src;
  88                 return;
  89         }
  90 #endif                          /* INET6 */
  91         else
  92                 return;
  93 }
  94
  95 /*
  96  * draft-ietf-tsvwg-addip-sctp
  97  *
  98  * An ASCONF parameter queue exists per asoc which holds the pending address
  99  * operations.  Lists are updated upon receipt of ASCONF-ACK.
 100  *
 101  * A restricted_addrs list exists per assoc to hold local addresses that are
 102  * not (yet) usable by the assoc as a source address.  These addresses are
 103  * either pending an ASCONF operation (and exist on the ASCONF parameter
 104  * queue), or they are permanently restricted (the peer has returned an
 105  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
 106  *
 107  * Deleted addresses are always immediately removed from the lists as they will
 108  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
 109  * only if allowed.
 110  */
 111
 112 /*
 113  * ASCONF parameter processing.
 114  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
 115  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
 116  * FIX: allocating this many mbufs on the fly is pretty inefficient...
 117  */
 118 static struct mbuf *
 119 sctp_asconf_success_response(uint32_t id)
 120 {
 121         struct mbuf *m_reply = NULL;
 122         struct sctp_asconf_paramhdr *aph;
 123
 124         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
 125             0, M_DONTWAIT, 1, MT_DATA);
 126         if (m_reply == NULL) {
 127                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 128                     "asconf_success_response: couldn't get mbuf!\n");
 129                 return NULL;
 130         }
 131         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 132         aph->correlation_id = id;
 133         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
 134         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
 135         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 136         aph->ph.param_length = htons(aph->ph.param_length);
 137
 138         return m_reply;
 139 }
 140
 141 static struct mbuf *
 142 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 143     uint16_t tlv_length)
 144 {
 145         struct mbuf *m_reply = NULL;
 146         struct sctp_asconf_paramhdr *aph;
 147         struct sctp_error_cause *error;
 148         uint8_t *tlv;
 149
 150         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 151             tlv_length +
 152             sizeof(struct sctp_error_cause)),
 153             0, M_DONTWAIT, 1, MT_DATA);
 154         if (m_reply == NULL) {
 155                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 156                     "asconf_error_response: couldn't get mbuf!\n");
 157                 return NULL;
 158         }
 159         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 160         error = (struct sctp_error_cause *)(aph + 1);
 161
 162         aph->correlation_id = id;
 163         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 164         error->code = htons(cause);
 165         error->length = tlv_length + sizeof(struct sctp_error_cause);
 166         aph->ph.param_length = error->length +
 167             sizeof(struct sctp_asconf_paramhdr);
 168
 169         if (aph->ph.param_length > MLEN) {
 170                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 171                     "asconf_error_response: tlv_length (%xh) too big\n",
 172                     tlv_length);
 173                 sctp_m_freem(m_reply);  /* discard */
 174                 return NULL;
 175         }
 176         if (error_tlv != NULL) {
 177                 tlv = (uint8_t *) (error + 1);
 178                 memcpy(tlv, error_tlv, tlv_length);
 179         }
 180         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 181         error->length = htons(error->length);
 182         aph->ph.param_length = htons(aph->ph.param_length);
 183
 184         return m_reply;
 185 }
 186
 187 static struct mbuf *
 188 sctp_process_asconf_add_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 189     struct sctp_tcb *stcb, int response_required)
 190 {
 191         struct mbuf *m_reply = NULL;
 192         struct sockaddr_storage sa_source, sa_store;
 193         struct sctp_ipv4addr_param *v4addr;
 194         uint16_t param_type, param_length, aparam_length;
 195         struct sockaddr *sa;
 196         struct sockaddr_in *sin;
 197         int zero_address = 0;
 198
 199 #ifdef INET6
 200         struct sockaddr_in6 *sin6;
 201         struct sctp_ipv6addr_param *v6addr;
 202
 203 #endif                          /* INET6 */
 204
 205         aparam_length = ntohs(aph->ph.param_length);
 206         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 207 #ifdef INET6
 208         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 209 #endif                          /* INET6 */
 210         param_type = ntohs(v4addr->ph.param_type);
 211         param_length = ntohs(v4addr->ph.param_length);
 212
 213         sa = (struct sockaddr *)&sa_store;
 214         switch (param_type) {
 215         case SCTP_IPV4_ADDRESS:
 216                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 217                         /* invalid param size */
 218                         return NULL;
 219                 }
 220                 sin = (struct sockaddr_in *)&sa_store;
 221                 bzero(sin, sizeof(*sin));
 222                 sin->sin_family = AF_INET;
 223                 sin->sin_len = sizeof(struct sockaddr_in);
 224                 sin->sin_port = stcb->rport;
 225                 sin->sin_addr.s_addr = v4addr->addr;
 226                 if (sin->sin_addr.s_addr == INADDR_ANY)
 227                         zero_address = 1;
 228                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 229                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 230                 break;
 231         case SCTP_IPV6_ADDRESS:
 232 #ifdef INET6
 233                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 234                         /* invalid param size */
 235                         return NULL;
 236                 }
 237                 sin6 = (struct sockaddr_in6 *)&sa_store;
 238                 bzero(sin6, sizeof(*sin6));
 239                 sin6->sin6_family = AF_INET6;
 240                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 241                 sin6->sin6_port = stcb->rport;
 242                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 243                     sizeof(struct in6_addr));
 244                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 245                         zero_address = 1;
 246                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 247                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 248 #else
 249                 /* IPv6 not enabled! */
 250                 /* FIX ME: currently sends back an invalid param error */
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph, aparam_length);
 253                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 254                     "process_asconf_add_ip: v6 disabled- skipping ");
 255                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 256                 return m_reply;
 257 #endif
 258                 break;
 259         default:
 260                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 261                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 262                     aparam_length);
 263                 return m_reply;
 264         }                       /* end switch */
 265
 266         /* if 0.0.0.0/::0, add the source address instead */
 267         if (zero_address && sctp_nat_friendly) {
 268                 sa = (struct sockaddr *)&sa_source;
 269                 sctp_asconf_get_source_ip(m, sa);
 270                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 271                     "process_asconf_add_ip: using source addr ");
 272                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 273         }
 274         /* add the address */
 275         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE,
 276             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 277                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 278                     "process_asconf_add_ip: error adding address\n");
 279                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 280                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 281                     aparam_length);
 282         } else {
 283                 /* notify upper layer */
 284                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 285                 if (response_required) {
 286                         m_reply =
 287                             sctp_asconf_success_response(aph->correlation_id);
 288                 }
 289                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
 290                     NULL, SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 291                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 292                     stcb, NULL);
 293         }
 294
 295         return m_reply;
 296 }
 297
 298 static int
 299 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 300 {
 301         struct sctp_nets *src_net, *net;
 302
 303         /* make sure the source address exists as a destination net */
 304         src_net = sctp_findnet(stcb, src);
 305         if (src_net == NULL) {
 306                 /* not found */
 307                 return -1;
 308         }
 309         /* delete all destination addresses except the source */
 310         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 311                 if (net != src_net) {
 312                         /* delete this address */
 313                         sctp_remove_net(stcb, net);
 314                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 315                             "asconf_del_remote_addrs_except: deleting ");
 316                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 317                             (struct sockaddr *)&net->ro._l_addr);
 318                         /* notify upper layer */
 319                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 320                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 321                 }
 322         }
 323         return 0;
 324 }
 325
 326 static struct mbuf *
 327 sctp_process_asconf_delete_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 328     struct sctp_tcb *stcb, int response_required)
 329 {
 330         struct mbuf *m_reply = NULL;
 331         struct sockaddr_storage sa_source, sa_store;
 332         struct sctp_ipv4addr_param *v4addr;
 333         uint16_t param_type, param_length, aparam_length;
 334         struct sockaddr *sa;
 335         struct sockaddr_in *sin;
 336         int zero_address = 0;
 337         int result;
 338
 339 #ifdef INET6
 340         struct sockaddr_in6 *sin6;
 341         struct sctp_ipv6addr_param *v6addr;
 342
 343 #endif                          /* INET6 */
 344
 345         /* get the source IP address for src and 0.0.0.0/::0 delete checks */
 346         sctp_asconf_get_source_ip(m, (struct sockaddr *)&sa_source);
 347
 348         aparam_length = ntohs(aph->ph.param_length);
 349         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 350 #ifdef INET6
 351         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 352 #endif                          /* INET6 */
 353         param_type = ntohs(v4addr->ph.param_type);
 354         param_length = ntohs(v4addr->ph.param_length);
 355
 356         sa = (struct sockaddr *)&sa_store;
 357         switch (param_type) {
 358         case SCTP_IPV4_ADDRESS:
 359                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 360                         /* invalid param size */
 361                         return NULL;
 362                 }
 363                 sin = (struct sockaddr_in *)&sa_store;
 364                 bzero(sin, sizeof(*sin));
 365                 sin->sin_family = AF_INET;
 366                 sin->sin_len = sizeof(struct sockaddr_in);
 367                 sin->sin_port = stcb->rport;
 368                 sin->sin_addr.s_addr = v4addr->addr;
 369                 if (sin->sin_addr.s_addr == INADDR_ANY)
 370                         zero_address = 1;
 371                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 372                     "process_asconf_delete_ip: deleting ");
 373                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 374                 break;
 375         case SCTP_IPV6_ADDRESS:
 376                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 377                         /* invalid param size */
 378                         return NULL;
 379                 }
 380 #ifdef INET6
 381                 sin6 = (struct sockaddr_in6 *)&sa_store;
 382                 bzero(sin6, sizeof(*sin6));
 383                 sin6->sin6_family = AF_INET6;
 384                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 385                 sin6->sin6_port = stcb->rport;
 386                 memcpy(&sin6->sin6_addr, v6addr->addr,
 387                     sizeof(struct in6_addr));
 388                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 389                         zero_address = 1;
 390                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 391                     "process_asconf_delete_ip: deleting ");
 392                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 393 #else
 394                 /* IPv6 not enabled!  No "action" needed; just ack it */
 395                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 396                     "process_asconf_delete_ip: v6 disabled- ignoring: ");
 397                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 398                 /* just respond with a "success" ASCONF-ACK */
 399                 return NULL;
 400 #endif
 401                 break;
 402         default:
 403                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 404                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 405                     aparam_length);
 406                 return m_reply;
 407         }
 408
 409         /* make sure the source address is not being deleted */
 410         if (sctp_cmpaddr(sa, (struct sockaddr *)&sa_source)) {
 411                 /* trying to delete the source address! */
 412                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 413                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 414                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 415                     aparam_length);
 416                 return m_reply;
 417         }
 418         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 419         if (zero_address && sctp_nat_friendly) {
 420                 result = sctp_asconf_del_remote_addrs_except(stcb,
 421                     (struct sockaddr *)&sa_source);
 422
 423                 if (result) {
 424                         /* src address did not exist? */
 425                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 426                         /* what error to reply with?? */
 427                         m_reply =
 428                             sctp_asconf_error_response(aph->correlation_id,
 429                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 430                             aparam_length);
 431                 } else if (response_required) {
 432                         m_reply =
 433                             sctp_asconf_success_response(aph->correlation_id);
 434                 }
 435                 return m_reply;
 436         }
 437         /* delete the address */
 438         result = sctp_del_remote_addr(stcb, sa);
 439         /*
 440          * note if result == -2, the address doesn't exist in the asoc but
 441          * since it's being deleted anyways, we just ack the delete -- but
 442          * this probably means something has already gone awry
 443          */
 444         if (result == -1) {
 445                 /* only one address in the asoc */
 446                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 447                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 448                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 449                     aparam_length);
 450         } else {
 451                 if (response_required) {
 452                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 453                 }
 454                 /* notify upper layer */
 455                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 456         }
 457         return m_reply;
 458 }
 459
 460 static struct mbuf *
 461 sctp_process_asconf_set_primary(struct mbuf *m,
 462     struct sctp_asconf_paramhdr *aph,
 463     struct sctp_tcb *stcb, int response_required)
 464 {
 465         struct mbuf *m_reply = NULL;
 466         struct sockaddr_storage sa_source, sa_store;
 467         struct sctp_ipv4addr_param *v4addr;
 468         uint16_t param_type, param_length, aparam_length;
 469         struct sockaddr *sa;
 470         struct sockaddr_in *sin;
 471         int zero_address = 0;
 472
 473 #ifdef INET6
 474         struct sockaddr_in6 *sin6;
 475         struct sctp_ipv6addr_param *v6addr;
 476
 477 #endif                          /* INET6 */
 478
 479         aparam_length = ntohs(aph->ph.param_length);
 480         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 481 #ifdef INET6
 482         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 483 #endif                          /* INET6 */
 484         param_type = ntohs(v4addr->ph.param_type);
 485         param_length = ntohs(v4addr->ph.param_length);
 486
 487         sa = (struct sockaddr *)&sa_store;
 488         switch (param_type) {
 489         case SCTP_IPV4_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 491                         /* invalid param size */
 492                         return NULL;
 493                 }
 494                 sin = (struct sockaddr_in *)&sa_store;
 495                 bzero(sin, sizeof(*sin));
 496                 sin->sin_family = AF_INET;
 497                 sin->sin_len = sizeof(struct sockaddr_in);
 498                 sin->sin_addr.s_addr = v4addr->addr;
 499                 if (sin->sin_addr.s_addr == INADDR_ANY)
 500                         zero_address = 1;
 501                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 502                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 503                 break;
 504         case SCTP_IPV6_ADDRESS:
 505                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 506                         /* invalid param size */
 507                         return NULL;
 508                 }
 509 #ifdef INET6
 510                 sin6 = (struct sockaddr_in6 *)&sa_store;
 511                 bzero(sin6, sizeof(*sin6));
 512                 sin6->sin6_family = AF_INET6;
 513                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 514                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 515                     sizeof(struct in6_addr));
 516                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 517                         zero_address = 1;
 518                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 520 #else
 521                 /* IPv6 not enabled!  No "action" needed; just ack it */
 522                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 523                     "process_asconf_set_primary: v6 disabled- ignoring: ");
 524                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 525                 /* just respond with a "success" ASCONF-ACK */
 526                 return NULL;
 527 #endif
 528                 break;
 529         default:
 530                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 531                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 532                     aparam_length);
 533                 return m_reply;
 534         }
 535
 536         /* if 0.0.0.0/::0, use the source address instead */
 537         if (zero_address && sctp_nat_friendly) {
 538                 sa = (struct sockaddr *)&sa_source;
 539                 sctp_asconf_get_source_ip(m, sa);
 540                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 541                     "process_asconf_set_primary: using source addr ");
 542                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 543         }
 544         /* set the primary address */
 545         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 546                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 547                     "process_asconf_set_primary: primary address set\n");
 548                 /* notify upper layer */
 549                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 550
 551                 if (response_required) {
 552                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 553                 }
 554                 /*
 555                  * Mobility adaptation. Ideally, when the reception of SET
 556                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 557                  * destination, unacknowledged DATA are retransmitted
 558                  * immediately to the new primary destination for seamless
 559                  * handover.  If the destination is UNCONFIRMED and marked
 560                  * to REQ_PRIM, The retransmission occur when reception of
 561                  * the HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 562                  * sctp_input.c) Also, when change of the primary
 563                  * destination, it is better that all subsequent new DATA
 564                  * containing already queued DATA are transmitted to the new
 565                  * primary destination. (by micchie)
 566                  */
 567                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 568                     SCTP_MOBILITY_BASE) ||
 569                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 570                     SCTP_MOBILITY_FASTHANDOFF)) &&
 571                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 572                     SCTP_MOBILITY_PRIM_DELETED) &&
 573                     (stcb->asoc.primary_destination->dest_state &
 574                     SCTP_ADDR_UNCONFIRMED) == 0) {
 575
 576                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 577                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 578                             SCTP_MOBILITY_FASTHANDOFF)) {
 579                                 sctp_assoc_immediate_retrans(stcb,
 580                                     stcb->asoc.primary_destination);
 581                         }
 582                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 583                             SCTP_MOBILITY_BASE)) {
 584                                 sctp_move_chunks_from_deleted_prim(stcb,
 585                                     stcb->asoc.primary_destination);
 586                         }
 587                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 588                             stcb->asoc.deleted_primary);
 589                 }
 590         } else {
 591                 /* couldn't set the requested primary address! */
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "process_asconf_set_primary: set primary failed!\n");
 594                 /* must have been an invalid address, so report */
 595                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 596                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 597                     aparam_length);
 598         }
 599
 600         return m_reply;
 601 }
 602
 603 /*
 604  * handles an ASCONF chunk.
 605  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 606  */
 607 void
 608 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 609     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 610     int first)
 611 {
 612         struct sctp_association *asoc;
 613         uint32_t serial_num;
 614         struct mbuf *n, *m_ack, *m_result, *m_tail;
 615         struct sctp_asconf_ack_chunk *ack_cp;
 616         struct sctp_asconf_paramhdr *aph, *ack_aph;
 617         struct sctp_ipv6addr_param *p_addr;
 618         unsigned int asconf_limit;
 619         int error = 0;          /* did an error occur? */
 620
 621         /* asconf param buffer */
 622         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 623         struct sctp_asconf_ack *ack, *ack_next;
 624
 625         /* verify minimum length */
 626         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 627                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 628                     "handle_asconf: chunk too small = %xh\n",
 629                     ntohs(cp->ch.chunk_length));
 630                 return;
 631         }
 632         asoc = &stcb->asoc;
 633         serial_num = ntohl(cp->serial_number);
 634
 635         if (compare_with_wrap(asoc->asconf_seq_in, serial_num, MAX_SEQ) ||
 636             serial_num == asoc->asconf_seq_in) {
 637                 /* got a duplicate ASCONF */
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: got duplicate serial number = %xh\n",
 640                     serial_num);
 641                 return;
 642         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 643                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 644                     serial_num, asoc->asconf_seq_in + 1);
 645                 return;
 646         }
 647         /* it's the expected "next" sequence number, so process it */
 648         asoc->asconf_seq_in = serial_num;       /* update sequence */
 649         /* get length of all the param's in the ASCONF */
 650         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 651         SCTPDBG(SCTP_DEBUG_ASCONF1,
 652             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 653             asconf_limit, serial_num);
 654
 655         if (first) {
 656                 /* delete old cache */
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing firstASCONF. Try to delte old cache\n");
 658
 659                 ack = TAILQ_FIRST(&stcb->asoc.asconf_ack_sent);
 660                 while (ack != NULL) {
 661                         ack_next = TAILQ_NEXT(ack, next);
 662                         if (ack->serial_number == serial_num)
 663                                 break;
 664                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 665                             ack->serial_number, serial_num);
 666                         TAILQ_REMOVE(&stcb->asoc.asconf_ack_sent, ack, next);
 667                         if (ack->data != NULL) {
 668                                 sctp_m_freem(ack->data);
 669                         }
 670                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asconf_ack, ack);
 671                         ack = ack_next;
 672                 }
 673         }
 674         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 675             M_DONTWAIT, 1, MT_DATA);
 676         if (m_ack == NULL) {
 677                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 678                     "handle_asconf: couldn't get mbuf!\n");
 679                 return;
 680         }
 681         m_tail = m_ack;         /* current reply chain's tail */
 682
 683         /* fill in ASCONF-ACK header */
 684         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 685         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 686         ack_cp->ch.chunk_flags = 0;
 687         ack_cp->serial_number = htonl(serial_num);
 688         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 689         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 690         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 691
 692         /* skip the lookup address parameter */
 693         offset += sizeof(struct sctp_asconf_chunk);
 694         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 695         if (p_addr == NULL) {
 696                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 697                     "handle_asconf: couldn't get lookup addr!\n");
 698                 /* respond with a missing/invalid mandatory parameter error */
 699                 return;
 700         }
 701         /* param_length is already validated in process_control... */
 702         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 703
 704         /* get pointer to first asconf param in ASCONF-ACK */
 705         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 706         if (ack_aph == NULL) {
 707                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 708                 return;
 709         }
 710         /* get pointer to first asconf param in ASCONF */
 711         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 712         if (aph == NULL) {
 713                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 714                 goto send_reply;
 715         }
 716         /* process through all parameters */
 717         while (aph != NULL) {
 718                 unsigned int param_length, param_type;
 719
 720                 param_type = ntohs(aph->ph.param_type);
 721                 param_length = ntohs(aph->ph.param_length);
 722                 if (offset + param_length > asconf_limit) {
 723                         /* parameter goes beyond end of chunk! */
 724                         sctp_m_freem(m_ack);
 725                         return;
 726                 }
 727                 m_result = NULL;
 728
 729                 if (param_length > sizeof(aparam_buf)) {
 730                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 731                         sctp_m_freem(m_ack);
 732                         return;
 733                 }
 734                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 735                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 736                         sctp_m_freem(m_ack);
 737                 }
 738                 /* get the entire parameter */
 739                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 740                 if (aph == NULL) {
 741                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 742                         sctp_m_freem(m_ack);
 743                         return;
 744                 }
 745                 switch (param_type) {
 746                 case SCTP_ADD_IP_ADDRESS:
 747                         asoc->peer_supports_asconf = 1;
 748                         m_result = sctp_process_asconf_add_ip(m, aph, stcb,
 749                             error);
 750                         break;
 751                 case SCTP_DEL_IP_ADDRESS:
 752                         asoc->peer_supports_asconf = 1;
 753                         m_result = sctp_process_asconf_delete_ip(m, aph, stcb,
 754                             error);
 755                         break;
 756                 case SCTP_ERROR_CAUSE_IND:
 757                         /* not valid in an ASCONF chunk */
 758                         break;
 759                 case SCTP_SET_PRIM_ADDR:
 760                         asoc->peer_supports_asconf = 1;
 761                         m_result = sctp_process_asconf_set_primary(m, aph,
 762                             stcb, error);
 763                         break;
 764                 case SCTP_SUCCESS_REPORT:
 765                         /* not valid in an ASCONF chunk */
 766                         break;
 767                 case SCTP_ULP_ADAPTATION:
 768                         /* FIX */
 769                         break;
 770                 default:
 771                         if ((param_type & 0x8000) == 0) {
 772                                 /* Been told to STOP at this param */
 773                                 asconf_limit = offset;
 774                                 /*
 775                                  * FIX FIX - We need to call
 776                                  * sctp_arethere_unrecognized_parameters()
 777                                  * to get a operr and send it for any
 778                                  * param's with the 0x4000 bit set OR do it
 779                                  * here ourselves... note we still must STOP
 780                                  * if the 0x8000 bit is clear.
 781                                  */
 782                         }
 783                         /* unknown/invalid param type */
 784                         break;
 785                 }               /* switch */
 786
 787                 /* add any (error) result to the reply mbuf chain */
 788                 if (m_result != NULL) {
 789                         SCTP_BUF_NEXT(m_tail) = m_result;
 790                         m_tail = m_result;
 791                         /* update lengths, make sure it's aligned too */
 792                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 793                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 794                         /* set flag to force success reports */
 795                         error = 1;
 796                 }
 797                 offset += SCTP_SIZE32(param_length);
 798                 /* update remaining ASCONF message length to process */
 799                 if (offset >= asconf_limit) {
 800                         /* no more data in the mbuf chain */
 801                         break;
 802                 }
 803                 /* get pointer to next asconf param */
 804                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 805                     sizeof(struct sctp_asconf_paramhdr),
 806                     (uint8_t *) & aparam_buf);
 807                 if (aph == NULL) {
 808                         /* can't get an asconf paramhdr */
 809                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 810                         /* FIX ME - add error here... */
 811                 }
 812         }
 813
 814 send_reply:
 815         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 816         /* save the ASCONF-ACK reply */
 817         ack = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asconf_ack,
 818             struct sctp_asconf_ack);
 819         if (ack == NULL) {
 820                 sctp_m_freem(m_ack);
 821                 return;
 822         }
 823         ack->serial_number = serial_num;
 824         ack->last_sent_to = NULL;
 825         ack->data = m_ack;
 826         n = m_ack;
 827         while (n) {
 828                 ack->len += SCTP_BUF_LEN(n);
 829                 n = SCTP_BUF_NEXT(n);
 830         }
 831         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 832
 833         /* see if last_control_chunk_from is set properly (use IP src addr) */
 834         if (stcb->asoc.last_control_chunk_from == NULL) {
 835                 /*
 836                  * this could happen if the source address was just newly
 837                  * added
 838                  */
 839                 struct ip *iph;
 840                 struct sctphdr *sh;
 841                 struct sockaddr_storage from_store;
 842                 struct sockaddr *from = (struct sockaddr *)&from_store;
 843
 844                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 845                 /* pullup already done, IP options already stripped */
 846                 iph = mtod(m, struct ip *);
 847                 sh = (struct sctphdr *)((caddr_t)iph + sizeof(*iph));
 848                 switch (iph->ip_v) {
 849                 case IPVERSION:
 850                         {
 851                                 struct sockaddr_in *from4;
 852
 853                                 from4 = (struct sockaddr_in *)&from_store;
 854                                 bzero(from4, sizeof(*from4));
 855                                 from4->sin_family = AF_INET;
 856                                 from4->sin_len = sizeof(struct sockaddr_in);
 857                                 from4->sin_addr.s_addr = iph->ip_src.s_addr;
 858                                 from4->sin_port = sh->src_port;
 859                                 break;
 860                         }
 861 #ifdef INET6
 862                 case IPV6_VERSION >> 4:
 863                         {
 864                                 struct ip6_hdr *ip6;
 865                                 struct sockaddr_in6 *from6;
 866
 867                                 ip6 = mtod(m, struct ip6_hdr *);
 868                                 from6 = (struct sockaddr_in6 *)&from_store;
 869                                 bzero(from6, sizeof(*from6));
 870                                 from6->sin6_family = AF_INET6;
 871                                 from6->sin6_len = sizeof(struct sockaddr_in6);
 872                                 from6->sin6_addr = ip6->ip6_src;
 873                                 from6->sin6_port = sh->src_port;
 874                                 /*
 875                                  * Get the scopes in properly to the sin6
 876                                  * addr's
 877                                  */
 878                                 /* we probably don't need these operations */
 879                                 (void)sa6_recoverscope(from6);
 880                                 sa6_embedscope(from6, ip6_use_defzone);
 881                                 break;
 882                         }
 883 #endif
 884                 default:
 885                         /* unknown address type */
 886                         from = NULL;
 887                 }
 888                 if (from != NULL) {
 889                         SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 890                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, from);
 891                         /* look up the from address */
 892                         stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, from);
 893 #ifdef SCTP_DEBUG
 894                         if (stcb->asoc.last_control_chunk_from == NULL)
 895                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 896 #endif
 897                 }
 898         }
 899 }
 900
 901 /*
 902  * does the address match? returns 0 if not, 1 if so
 903  */
 904 static uint32_t
 905 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 906 {
 907 #ifdef INET6
 908         if (sa->sa_family == AF_INET6) {
 909                 /* IPv6 sa address */
 910                 /* XXX scopeid */
 911                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 912
 913                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 914                     (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 915                     sizeof(struct in6_addr)) == 0)) {
 916                         return (1);
 917                 }
 918         } else
 919 #endif                          /* INET6 */
 920         if (sa->sa_family == AF_INET) {
 921                 /* IPv4 sa address */
 922                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 923
 924                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 925                     (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 926                     sizeof(struct in_addr)) == 0)) {
 927                         return (1);
 928                 }
 929         }
 930         return (0);
 931 }
 932
 933 /*
 934  * Cleanup for non-responded/OP ERR'd ASCONF
 935  */
 936 void
 937 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 938 {
 939         /* mark peer as ASCONF incapable */
 940         stcb->asoc.peer_supports_asconf = 0;
 941         /*
 942          * clear out any existing asconfs going out
 943          */
 944         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 945             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 946         stcb->asoc.asconf_seq_out++;
 947         /* remove the old ASCONF on our outbound queue */
 948         sctp_toss_old_asconf(stcb);
 949 }
 950
 951 /*
 952  * cleanup any cached source addresses that may be topologically
 953  * incorrect after a new address has been added to this interface.
 954  */
 955 static void
 956 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 957 {
 958         struct sctp_nets *net;
 959
 960         /*
 961          * Ideally, we want to only clear cached routes and source addresses
 962          * that are topologically incorrect.  But since there is no easy way
 963          * to know whether the newly added address on the ifn would cause a
 964          * routing change (i.e. a new egress interface would be chosen)
 965          * without doing a new routing lookup and source address selection,
 966          * we will (for now) just flush any cached route using a different
 967          * ifn (and cached source addrs) and let output re-choose them
 968          * during the next send on that net.
 969          */
 970         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 971                 /*
 972                  * clear any cached route (and cached source address) if the
 973                  * route's interface is NOT the same as the address change.
 974                  * If it's the same interface, just clear the cached source
 975                  * address.
 976                  */
 977                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 978                     SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index) {
 979                         /* clear any cached route */
 980                         RTFREE(net->ro.ro_rt);
 981                         net->ro.ro_rt = NULL;
 982                 }
 983                 /* clear any cached source address */
 984                 if (net->src_addr_selected) {
 985                         sctp_free_ifa(net->ro._s_addr);
 986                         net->ro._s_addr = NULL;
 987                         net->src_addr_selected = 0;
 988                 }
 989         }
 990 }
 991
 992 void
 993 sctp_move_chunks_from_deleted_prim(struct sctp_tcb *stcb, struct sctp_nets *dst)
 994 {
 995         struct sctp_association *asoc;
 996         struct sctp_stream_out *outs;
 997         struct sctp_tmit_chunk *chk;
 998         struct sctp_stream_queue_pending *sp;
 999
1000         if (dst->dest_state & SCTP_ADDR_UNCONFIRMED) {
1001                 return;
1002         }
1003         if (stcb->asoc.deleted_primary == NULL) {
1004                 return;
1005         }
1006         asoc = &stcb->asoc;
1007
1008         /*
1009          * now through all the streams checking for chunks sent to our bad
1010          * network.
1011          */
1012         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
1013                 /* now clean up any chunks here */
1014                 TAILQ_FOREACH(sp, &outs->outqueue, next) {
1015                         if (sp->net == asoc->deleted_primary) {
1016                                 sctp_free_remote_addr(sp->net);
1017                                 sp->net = dst;
1018                                 atomic_add_int(&dst->ref_count, 1);
1019                         }
1020                 }
1021         }
1022         /* Now check the pending queue */
1023         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
1024                 if (chk->whoTo == asoc->deleted_primary) {
1025                         sctp_free_remote_addr(chk->whoTo);
1026                         chk->whoTo = dst;
1027                         atomic_add_int(&dst->ref_count, 1);
1028                 }
1029         }
1030
1031 }
1032
1033
1034 void
1035 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
1036 {
1037         int error;
1038
1039         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1040                 return;
1041         }
1042         if (stcb->asoc.deleted_primary == NULL) {
1043                 return;
1044         }
1045         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1046                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1047                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1048                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1049                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1050                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1051                     stcb->asoc.deleted_primary,
1052                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1053                 stcb->asoc.num_send_timers_up--;
1054                 if (stcb->asoc.num_send_timers_up < 0) {
1055                         stcb->asoc.num_send_timers_up = 0;
1056                 }
1057                 SCTP_TCB_LOCK_ASSERT(stcb);
1058                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1059                     stcb->asoc.deleted_primary);
1060                 if (error) {
1061                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1062                         return;
1063                 }
1064                 SCTP_TCB_LOCK_ASSERT(stcb);
1065 #ifdef SCTP_AUDITING_ENABLED
1066                 sctp_auditing(4, stcb->sctp_ep, stcb->asoc.deleted_primary);
1067 #endif
1068                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1069                 if ((stcb->asoc.num_send_timers_up == 0) &&
1070                     (stcb->asoc.sent_queue_cnt > 0)) {
1071                         struct sctp_tmit_chunk *chk;
1072
1073                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1074                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1075                             stcb, chk->whoTo);
1076                 }
1077         }
1078         return;
1079 }
1080
1081 static int
1082     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1083
1084 void
1085 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1086 {
1087         struct sctp_tmit_chunk *chk;
1088
1089         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1090         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1091             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1092         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1093         net->error_count = 0;
1094         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1095                 if (chk->whoTo == net) {
1096                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1097                                 chk->sent = SCTP_DATAGRAM_RESEND;
1098                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1099                                 sctp_flight_size_decrease(chk);
1100                                 sctp_total_flight_decrease(stcb, chk);
1101                                 net->marked_retrans++;
1102                                 stcb->asoc.marked_retrans++;
1103                         }
1104                 }
1105         }
1106         if (net->marked_retrans) {
1107                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1108         }
1109 }
1110
1111 static void
1112 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1113 {
1114         struct sctp_nets *net;
1115         int addrnum, changed;
1116
1117         /*
1118          * If number of local valid addresses is 1, the valid address is
1119          * probably newly added address.  Several valid addresses in this
1120          * association.  A source address may not be changed.  Additionally,
1121          * they can be configured on a same interface as "alias" addresses.
1122          * (by micchie)
1123          */
1124         addrnum = sctp_local_addr_count(stcb);
1125         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1126             addrnum);
1127         if (addrnum == 1) {
1128                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1129                         /* clear any cached route and source address */
1130                         if (net->ro.ro_rt) {
1131                                 RTFREE(net->ro.ro_rt);
1132                                 net->ro.ro_rt = NULL;
1133                         }
1134                         if (net->src_addr_selected) {
1135                                 sctp_free_ifa(net->ro._s_addr);
1136                                 net->ro._s_addr = NULL;
1137                                 net->src_addr_selected = 0;
1138                         }
1139                         /* Retransmit unacknowledged DATA chunks immediately */
1140                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1141                             SCTP_MOBILITY_FASTHANDOFF)) {
1142                                 sctp_net_immediate_retrans(stcb, net);
1143                         }
1144                         /* also, SET PRIMARY is maybe already sent */
1145                 }
1146                 return;
1147         }
1148         /* Multiple local addresses exsist in the association.  */
1149         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1150                 /* clear any cached route and source address */
1151                 if (net->ro.ro_rt) {
1152                         RTFREE(net->ro.ro_rt);
1153                         net->ro.ro_rt = NULL;
1154                 }
1155                 if (net->src_addr_selected) {
1156                         sctp_free_ifa(net->ro._s_addr);
1157                         net->ro._s_addr = NULL;
1158                         net->src_addr_selected = 0;
1159                 }
1160                 /*
1161                  * Check if the nexthop is corresponding to the new address.
1162                  * If the new address is corresponding to the current
1163                  * nexthop, the path will be changed.  If the new address is
1164                  * NOT corresponding to the current nexthop, the path will
1165                  * not be changed.
1166                  */
1167                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1168                     stcb->sctp_ep->def_vrf_id);
1169                 if (net->ro.ro_rt == NULL)
1170                         continue;
1171
1172                 changed = 0;
1173                 if (net->ro._l_addr.sa.sa_family == AF_INET) {
1174                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro))
1175                                 changed = 1;
1176                 }
1177 #ifdef INET6
1178                 if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1179                         if (sctp_v6src_match_nexthop(
1180                             &newifa->address.sin6, (sctp_route_t *) & net->ro))
1181                                 changed = 1;
1182                 }
1183 #endif
1184                 /*
1185                  * if the newly added address does not relate routing
1186                  * information, we skip.
1187                  */
1188                 if (changed == 0)
1189                         continue;
1190                 /* Retransmit unacknowledged DATA chunks immediately */
1191                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1192                     SCTP_MOBILITY_FASTHANDOFF)) {
1193                         sctp_net_immediate_retrans(stcb, net);
1194                 }
1195                 /* Send SET PRIMARY for this new address */
1196                 if (net == stcb->asoc.primary_destination) {
1197                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1198                             SCTP_SET_PRIM_ADDR);
1199                 }
1200         }
1201 }
1202
1203 /*
1204  * process an ADD/DELETE IP ack from peer.
1205  * addr: corresponding sctp_ifa to the address being added/deleted.
1206  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1207  * flag: 1=success, 0=failure.
1208  */
1209 static void
1210 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr,
1211     uint16_t type, uint32_t flag)
1212 {
1213         /*
1214          * do the necessary asoc list work- if we get a failure indication,
1215          * leave the address on the assoc's restricted list.  If we get a
1216          * success indication, remove the address from the restricted list.
1217          */
1218         /*
1219          * Note: this will only occur for ADD_IP_ADDRESS, since
1220          * DEL_IP_ADDRESS is never actually added to the list...
1221          */
1222         if (flag) {
1223                 /* success case, so remove from the restricted list */
1224                 sctp_del_local_addr_restricted(stcb, addr);
1225
1226                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1227                     SCTP_MOBILITY_BASE) ||
1228                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1229                     SCTP_MOBILITY_FASTHANDOFF)) {
1230                         sctp_path_check_and_react(stcb, addr);
1231                         return;
1232                 }
1233                 /* clear any cached/topologically incorrect source addresses */
1234                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1235         }
1236         /* else, leave it on the list */
1237 }
1238
1239 /*
1240  * add an asconf add/delete/set primary IP address parameter to the queue.
1241  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1242  * returns 0 if queued, -1 if not queued/removed.
1243  * NOTE: if adding, but a delete for the same address is already scheduled
1244  * (and not yet sent out), simply remove it from queue.  Same for deleting
1245  * an address already scheduled for add.  If a duplicate operation is found,
1246  * ignore the new one.
1247  */
1248 static int
1249 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1250     uint16_t type)
1251 {
1252         struct sctp_asconf_addr *aa, *aa_next;
1253         struct sockaddr *sa;
1254
1255         /* make sure the request isn't already in the queue */
1256         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1257             aa = aa_next) {
1258                 aa_next = TAILQ_NEXT(aa, next);
1259                 /* address match? */
1260                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1261                         continue;
1262                 /* is the request already in queue (sent or not) */
1263                 if (aa->ap.aph.ph.param_type == type) {
1264                         return (-1);
1265                 }
1266                 /* is the negative request already in queue, and not sent */
1267                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1268                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1269                         /* add requested, delete already queued */
1270                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1271                         /* remove the ifa from the restricted list */
1272                         sctp_del_local_addr_restricted(stcb, ifa);
1273                         /* free the asconf param */
1274                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1275                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1276                         return (-1);
1277                 }
1278                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1279                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1280                         /* delete requested, add already queued */
1281                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1282                         /* remove the aa->ifa from the restricted list */
1283                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1284                         /* free the asconf param */
1285                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1286                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1287                         return (-1);
1288                 }
1289         }                       /* for each aa */
1290
1291         /* adding new request to the queue */
1292         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1293             SCTP_M_ASC_ADDR);
1294         if (aa == NULL) {
1295                 /* didn't get memory */
1296                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1297                 return (-1);
1298         }
1299         /* fill in asconf address parameter fields */
1300         /* top level elements are "networked" during send */
1301         aa->ap.aph.ph.param_type = type;
1302         aa->ifa = ifa;
1303         atomic_add_int(&ifa->refcount, 1);
1304         /* correlation_id filled in during send routine later... */
1305         if (ifa->address.sa.sa_family == AF_INET6) {
1306                 /* IPv6 address */
1307                 struct sockaddr_in6 *sin6;
1308
1309                 sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1310                 sa = (struct sockaddr *)sin6;
1311                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1312                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1313                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1314                     sizeof(struct sctp_ipv6addr_param);
1315                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1316                     sizeof(struct in6_addr));
1317         } else if (ifa->address.sa.sa_family == AF_INET) {
1318                 /* IPv4 address */
1319                 struct sockaddr_in *sin;
1320
1321                 sin = (struct sockaddr_in *)&ifa->address.sa;
1322                 sa = (struct sockaddr *)sin;
1323                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1324                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1325                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1326                     sizeof(struct sctp_ipv4addr_param);
1327                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1328                     sizeof(struct in_addr));
1329         } else {
1330                 /* invalid family! */
1331                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1332                 sctp_free_ifa(ifa);
1333                 return (-1);
1334         }
1335         aa->sent = 0;           /* clear sent flag */
1336
1337         /*
1338          * if we are deleting an address it should go out last otherwise,
1339          * add it to front of the pending queue
1340          */
1341         if (type == SCTP_ADD_IP_ADDRESS) {
1342                 /* add goes to the front of the queue */
1343                 TAILQ_INSERT_HEAD(&stcb->asoc.asconf_queue, aa, next);
1344                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1345                     "asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1346                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1347         } else {
1348                 /* delete and set primary goes to the back of the queue */
1349                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1350 #ifdef SCTP_DEBUG
1351                 if (sctp_debug_on && SCTP_DEBUG_ASCONF2) {
1352                         if (type == SCTP_DEL_IP_ADDRESS) {
1353                                 SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1354                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1355                         } else {
1356                                 SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1357                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1358                         }
1359                 }
1360 #endif
1361         }
1362
1363         return (0);
1364 }
1365
1366
1367 /*
1368  * add an asconf operation for the given ifa and type.
1369  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1370  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1371  * advisable.
1372  */
1373 static int
1374 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1375     uint16_t type)
1376 {
1377         uint32_t status;
1378         int pending_delete_queued = 0;
1379
1380         /* see if peer supports ASCONF */
1381         if (stcb->asoc.peer_supports_asconf == 0) {
1382                 return (-1);
1383         }
1384         /*
1385          * if this is deleting the last address from the assoc, mark it as
1386          * pending.
1387          */
1388         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1389             (sctp_local_addr_count(stcb) < 2)) {
1390                 /* set the pending delete info only */
1391                 stcb->asoc.asconf_del_pending = 1;
1392                 stcb->asoc.asconf_addr_del_pending = ifa;
1393                 atomic_add_int(&ifa->refcount, 1);
1394                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1395                     "asconf_queue_add: mark delete last address pending\n");
1396                 return (-1);
1397         }
1398         /*
1399          * if this is an add, and there is a delete also pending (i.e. the
1400          * last local address is being changed), queue the pending delete
1401          * too.
1402          */
1403         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending) {
1404                 /* queue in the pending delete */
1405                 if (sctp_asconf_queue_mgmt(stcb,
1406                     stcb->asoc.asconf_addr_del_pending,
1407                     SCTP_DEL_IP_ADDRESS) == 0) {
1408                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1409                         pending_delete_queued = 1;
1410                         /* clear out the pending delete info */
1411                         stcb->asoc.asconf_del_pending = 0;
1412                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1413                         stcb->asoc.asconf_addr_del_pending = NULL;
1414                 }
1415         }
1416         /* queue an asconf parameter */
1417         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1418
1419         if (pending_delete_queued && (status == 0)) {
1420                 struct sctp_nets *net;
1421
1422                 /*
1423                  * since we know that the only/last address is now being
1424                  * changed in this case, reset the cwnd/rto on all nets to
1425                  * start as a new address and path.  Also clear the error
1426                  * counts to give the assoc the best chance to complete the
1427                  * address change.
1428                  */
1429                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1430                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1431                             net);
1432                         net->RTO = 0;
1433                         net->error_count = 0;
1434                 }
1435                 stcb->asoc.overall_error_count = 0;
1436                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
1437                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1438                             stcb->asoc.overall_error_count,
1439                             0,
1440                             SCTP_FROM_SCTP_ASCONF,
1441                             __LINE__);
1442                 }
1443                 /* queue in an advisory set primary too */
1444                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1445                 /* let caller know we should send this out immediately */
1446                 status = 1;
1447         }
1448         return (status);
1449 }
1450
1451 /*-
1452  * add an asconf delete IP address parameter to the queue by sockaddr and
1453  * possibly with no sctp_ifa available.  This is only called by the routine
1454  * that checks the addresses in an INIT-ACK against the current address list.
1455  * returns 0 if completed, non-zero if not completed.
1456  * NOTE: if an add is already scheduled (and not yet sent out), simply
1457  * remove it from queue.  If a duplicate operation is found, ignore the
1458  * new one.
1459  */
1460 static int
1461 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1462 {
1463         struct sctp_ifa *ifa;
1464         struct sctp_asconf_addr *aa, *aa_next;
1465         uint32_t vrf_id;
1466
1467         if (stcb == NULL) {
1468                 return (-1);
1469         }
1470         /* see if peer supports ASCONF */
1471         if (stcb->asoc.peer_supports_asconf == 0) {
1472                 return (-1);
1473         }
1474         /* make sure the request isn't already in the queue */
1475         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1476             aa = aa_next) {
1477                 aa_next = TAILQ_NEXT(aa, next);
1478                 /* address match? */
1479                 if (sctp_asconf_addr_match(aa, sa) == 0)
1480                         continue;
1481                 /* is the request already in queue (sent or not) */
1482                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1483                         return (-1);
1484                 }
1485                 /* is the negative request already in queue, and not sent */
1486                 if (aa->sent == 1)
1487                         continue;
1488                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1489                         /* add already queued, so remove existing entry */
1490                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1491                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1492                         /* free the entry */
1493                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1494                         return (-1);
1495                 }
1496         }                       /* for each aa */
1497
1498         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1499         if (stcb) {
1500                 vrf_id = stcb->asoc.vrf_id;
1501         } else {
1502                 vrf_id = SCTP_DEFAULT_VRFID;
1503         }
1504         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1505
1506         /* adding new request to the queue */
1507         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1508             SCTP_M_ASC_ADDR);
1509         if (aa == NULL) {
1510                 /* didn't get memory */
1511                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1512                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1513                 return (-1);
1514         }
1515         /* fill in asconf address parameter fields */
1516         /* top level elements are "networked" during send */
1517         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1518         aa->ifa = ifa;
1519         if (ifa)
1520                 atomic_add_int(&ifa->refcount, 1);
1521         /* correlation_id filled in during send routine later... */
1522         if (sa->sa_family == AF_INET6) {
1523                 /* IPv6 address */
1524                 struct sockaddr_in6 *sin6;
1525
1526                 sin6 = (struct sockaddr_in6 *)sa;
1527                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1528                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1529                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1530                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1531                     sizeof(struct in6_addr));
1532         } else if (sa->sa_family == AF_INET) {
1533                 /* IPv4 address */
1534                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1535
1536                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1537                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1538                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1539                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1540                     sizeof(struct in_addr));
1541         } else {
1542                 /* invalid family! */
1543                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1544                 if (ifa)
1545                         sctp_free_ifa(ifa);
1546                 return (-1);
1547         }
1548         aa->sent = 0;           /* clear sent flag */
1549
1550         /* delete goes to the back of the queue */
1551         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1552
1553         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1554         return (0);
1555 }
1556
1557 /*
1558  * find a specific asconf param on our "sent" queue
1559  */
1560 static struct sctp_asconf_addr *
1561 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1562 {
1563         struct sctp_asconf_addr *aa;
1564
1565         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1566                 if (aa->ap.aph.correlation_id == correlation_id &&
1567                     aa->sent == 1) {
1568                         /* found it */
1569                         return (aa);
1570                 }
1571         }
1572         /* didn't find it */
1573         return (NULL);
1574 }
1575
1576 /*
1577  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1578  * notifications based on the error response
1579  */
1580 static void
1581 sctp_asconf_process_error(struct sctp_tcb *stcb,
1582     struct sctp_asconf_paramhdr *aph)
1583 {
1584         struct sctp_error_cause *eh;
1585         struct sctp_paramhdr *ph;
1586         uint16_t param_type;
1587         uint16_t error_code;
1588
1589         eh = (struct sctp_error_cause *)(aph + 1);
1590         ph = (struct sctp_paramhdr *)(eh + 1);
1591         /* validate lengths */
1592         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1593             htons(aph->ph.param_length)) {
1594                 /* invalid error cause length */
1595                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1596                     "asconf_process_error: cause element too long\n");
1597                 return;
1598         }
1599         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1600             htons(eh->length)) {
1601                 /* invalid included TLV length */
1602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1603                     "asconf_process_error: included TLV too long\n");
1604                 return;
1605         }
1606         /* which error code ? */
1607         error_code = ntohs(eh->code);
1608         param_type = ntohs(aph->ph.param_type);
1609         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1610         switch (error_code) {
1611         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1612                 /* we allow ourselves to "try again" for this error */
1613                 break;
1614         default:
1615                 /* peer can't handle it... */
1616                 switch (param_type) {
1617                 case SCTP_ADD_IP_ADDRESS:
1618                 case SCTP_DEL_IP_ADDRESS:
1619                         stcb->asoc.peer_supports_asconf = 0;
1620                         break;
1621                 case SCTP_SET_PRIM_ADDR:
1622                         stcb->asoc.peer_supports_asconf = 0;
1623                         break;
1624                 default:
1625                         break;
1626                 }
1627         }
1628 }
1629
1630 /*
1631  * process an asconf queue param.
1632  * aparam: parameter to process, will be removed from the queue.
1633  * flag: 1=success case, 0=failure case
1634  */
1635 static void
1636 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1637     struct sctp_asconf_addr *aparam, uint32_t flag)
1638 {
1639         uint16_t param_type;
1640
1641         /* process this param */
1642         param_type = aparam->ap.aph.ph.param_type;
1643         switch (param_type) {
1644         case SCTP_ADD_IP_ADDRESS:
1645                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1646                     "process_param_ack: added IP address\n");
1647                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, param_type, flag);
1648                 break;
1649         case SCTP_DEL_IP_ADDRESS:
1650                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1651                     "process_param_ack: deleted IP address\n");
1652                 /* nothing really to do... lists already updated */
1653                 break;
1654         case SCTP_SET_PRIM_ADDR:
1655                 /* nothing to do... peer may start using this addr */
1656                 if (flag == 0)
1657                         stcb->asoc.peer_supports_asconf = 0;
1658                 break;
1659         default:
1660                 /* should NEVER happen */
1661                 break;
1662         }
1663
1664         /* remove the param and free it */
1665         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1666         if (aparam->ifa)
1667                 sctp_free_ifa(aparam->ifa);
1668         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1669 }
1670
1671 /*
1672  * cleanup from a bad asconf ack parameter
1673  */
1674 static void
1675 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1676 {
1677         /* assume peer doesn't really know how to do asconfs */
1678         stcb->asoc.peer_supports_asconf = 0;
1679         /* XXX we could free the pending queue here */
1680 }
1681
1682 void
1683 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1684     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1685     struct sctp_nets *net, int *abort_no_unlock)
1686 {
1687         struct sctp_association *asoc;
1688         uint32_t serial_num;
1689         uint16_t ack_length;
1690         struct sctp_asconf_paramhdr *aph;
1691         struct sctp_asconf_addr *aa, *aa_next;
1692         uint32_t last_error_id = 0;     /* last error correlation id */
1693         uint32_t id;
1694         struct sctp_asconf_addr *ap;
1695
1696         /* asconf param buffer */
1697         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1698
1699         /* verify minimum length */
1700         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1701                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1702                     "handle_asconf_ack: chunk too small = %xh\n",
1703                     ntohs(cp->ch.chunk_length));
1704                 return;
1705         }
1706         asoc = &stcb->asoc;
1707         serial_num = ntohl(cp->serial_number);
1708
1709         /*
1710          * NOTE: we may want to handle this differently- currently, we will
1711          * abort when we get an ack for the expected serial number + 1 (eg.
1712          * we didn't send it), process an ack normally if it is the expected
1713          * serial number, and re-send the previous ack for *ALL* other
1714          * serial numbers
1715          */
1716
1717         /*
1718          * if the serial number is the next expected, but I didn't send it,
1719          * abort the asoc, since someone probably just hijacked us...
1720          */
1721         if (serial_num == (asoc->asconf_seq_out + 1)) {
1722                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1723                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1724                     SCTP_CAUSE_ILLEGAL_ASCONF_ACK, NULL, SCTP_SO_NOT_LOCKED);
1725                 *abort_no_unlock = 1;
1726                 return;
1727         }
1728         if (serial_num != asoc->asconf_seq_out) {
1729                 /* got a duplicate/unexpected ASCONF-ACK */
1730                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1731                     serial_num, asoc->asconf_seq_out);
1732                 return;
1733         }
1734         if (stcb->asoc.asconf_sent == 0) {
1735                 /* got a unexpected ASCONF-ACK for serial not in flight */
1736                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got serial number = %xh but not in flight\n",
1737                     serial_num);
1738                 /* nothing to do... duplicate ACK received */
1739                 return;
1740         }
1741         /* stop our timer */
1742         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1743             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1744
1745         /* process the ASCONF-ACK contents */
1746         ack_length = ntohs(cp->ch.chunk_length) -
1747             sizeof(struct sctp_asconf_ack_chunk);
1748         offset += sizeof(struct sctp_asconf_ack_chunk);
1749         /* process through all parameters */
1750         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1751                 unsigned int param_length, param_type;
1752
1753                 /* get pointer to next asconf parameter */
1754                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1755                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1756                 if (aph == NULL) {
1757                         /* can't get an asconf paramhdr */
1758                         sctp_asconf_ack_clear(stcb);
1759                         return;
1760                 }
1761                 param_type = ntohs(aph->ph.param_type);
1762                 param_length = ntohs(aph->ph.param_length);
1763                 if (param_length > ack_length) {
1764                         sctp_asconf_ack_clear(stcb);
1765                         return;
1766                 }
1767                 if (param_length < sizeof(struct sctp_paramhdr)) {
1768                         sctp_asconf_ack_clear(stcb);
1769                         return;
1770                 }
1771                 /* get the complete parameter... */
1772                 if (param_length > sizeof(aparam_buf)) {
1773                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1774                             "param length (%u) larger than buffer size!\n", param_length);
1775                         sctp_asconf_ack_clear(stcb);
1776                         return;
1777                 }
1778                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1779                 if (aph == NULL) {
1780                         sctp_asconf_ack_clear(stcb);
1781                         return;
1782                 }
1783                 /* correlation_id is transparent to peer, no ntohl needed */
1784                 id = aph->correlation_id;
1785
1786                 switch (param_type) {
1787                 case SCTP_ERROR_CAUSE_IND:
1788                         last_error_id = id;
1789                         /* find the corresponding asconf param in our queue */
1790                         ap = sctp_asconf_find_param(stcb, id);
1791                         if (ap == NULL) {
1792                                 /* hmm... can't find this in our queue! */
1793                                 break;
1794                         }
1795                         /* process the parameter, failed flag */
1796                         sctp_asconf_process_param_ack(stcb, ap, 0);
1797                         /* process the error response */
1798                         sctp_asconf_process_error(stcb, aph);
1799                         break;
1800                 case SCTP_SUCCESS_REPORT:
1801                         /* find the corresponding asconf param in our queue */
1802                         ap = sctp_asconf_find_param(stcb, id);
1803                         if (ap == NULL) {
1804                                 /* hmm... can't find this in our queue! */
1805                                 break;
1806                         }
1807                         /* process the parameter, success flag */
1808                         sctp_asconf_process_param_ack(stcb, ap, 1);
1809                         break;
1810                 default:
1811                         break;
1812                 }               /* switch */
1813
1814                 /* update remaining ASCONF-ACK message length to process */
1815                 ack_length -= SCTP_SIZE32(param_length);
1816                 if (ack_length <= 0) {
1817                         /* no more data in the mbuf chain */
1818                         break;
1819                 }
1820                 offset += SCTP_SIZE32(param_length);
1821         }                       /* while */
1822
1823         /*
1824          * if there are any "sent" params still on the queue, these are
1825          * implicitly "success", or "failed" (if we got an error back) ...
1826          * so process these appropriately
1827          *
1828          * we assume that the correlation_id's are monotonically increasing
1829          * beginning from 1 and that we don't have *that* many outstanding
1830          * at any given time
1831          */
1832         if (last_error_id == 0)
1833                 last_error_id--;/* set to "max" value */
1834         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1835             aa = aa_next) {
1836                 aa_next = TAILQ_NEXT(aa, next);
1837                 if (aa->sent == 1) {
1838                         /*
1839                          * implicitly successful or failed if correlation_id
1840                          * < last_error_id, then success else, failure
1841                          */
1842                         if (aa->ap.aph.correlation_id < last_error_id)
1843                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1844                         else
1845                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1846                 } else {
1847                         /*
1848                          * since we always process in order (FIFO queue) if
1849                          * we reach one that hasn't been sent, the rest
1850                          * should not have been sent either. so, we're
1851                          * done...
1852                          */
1853                         break;
1854                 }
1855         }
1856
1857         /* update the next sequence number to use */
1858         asoc->asconf_seq_out++;
1859         /* remove the old ASCONF on our outbound queue */
1860         sctp_toss_old_asconf(stcb);
1861         /* clear the sent flag to allow new ASCONFs */
1862         asoc->asconf_sent = 0;
1863         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1864 #ifdef SCTP_TIMER_BASED_ASCONF
1865                 /* we have more params, so restart our timer */
1866                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1867                     stcb, net);
1868 #else
1869                 /* we have more params, so send out more */
1870                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1871 #endif
1872         }
1873 }
1874
1875 #ifdef INET6
1876 static uint32_t
1877 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1878 {
1879         struct sockaddr_in6 *sin6, *net6;
1880         struct sctp_nets *net;
1881
1882         if (sa->sa_family != AF_INET6) {
1883                 /* wrong family */
1884                 return (0);
1885         }
1886         sin6 = (struct sockaddr_in6 *)sa;
1887         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1888                 /* not link local address */
1889                 return (0);
1890         }
1891         /* hunt through our destination nets list for this scope_id */
1892         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1893                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1894                     AF_INET6)
1895                         continue;
1896                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1897                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1898                         continue;
1899                 if (sctp_is_same_scope(sin6, net6)) {
1900                         /* found one */
1901                         return (1);
1902                 }
1903         }
1904         /* didn't find one */
1905         return (0);
1906 }
1907
1908 #endif
1909
1910 /*
1911  * address management functions
1912  */
1913 static void
1914 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1915     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1916 {
1917         int status;
1918
1919
1920         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 &&
1921             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1922                 /* subset bound, no ASCONF allowed case, so ignore */
1923                 return;
1924         }
1925         /*
1926          * note: we know this is not the subset bound, no ASCONF case eg.
1927          * this is boundall or subset bound w/ASCONF allowed
1928          */
1929
1930         /* first, make sure it's a good address family */
1931         if (ifa->address.sa.sa_family != AF_INET6 &&
1932             ifa->address.sa.sa_family != AF_INET) {
1933                 return;
1934         }
1935         /* make sure we're "allowed" to add this type of addr */
1936         if (ifa->address.sa.sa_family == AF_INET6) {
1937                 /* invalid if we're not a v6 endpoint */
1938                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1939                         return;
1940                 /* is the v6 addr really valid ? */
1941                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1942                         return;
1943                 }
1944         }
1945         /* put this address on the "pending/do not use yet" list */
1946         sctp_add_local_addr_restricted(stcb, ifa);
1947         /*
1948          * check address scope if address is out of scope, don't queue
1949          * anything... note: this would leave the address on both inp and
1950          * asoc lists
1951          */
1952         switch (ifa->address.sa.sa_family) {
1953 #ifdef INET6
1954         case AF_INET6:
1955                 {
1956                         struct sockaddr_in6 *sin6;
1957
1958                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1959                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1960                                 /* we skip unspecifed addresses */
1961                                 return;
1962                         }
1963                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1964                                 if (stcb->asoc.local_scope == 0) {
1965                                         return;
1966                                 }
1967                                 /* is it the right link local scope? */
1968                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1969                                         return;
1970                                 }
1971                         }
1972                         if (stcb->asoc.site_scope == 0 &&
1973                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1974                                 return;
1975                         }
1976                         break;
1977                 }
1978 #endif
1979         case AF_INET:
1980                 {
1981                         struct sockaddr_in *sin;
1982                         struct in6pcb *inp6;
1983
1984                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1985                         /* invalid if we are a v6 only endpoint */
1986                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1987                             SCTP_IPV6_V6ONLY(inp6))
1988                                 return;
1989
1990                         sin = (struct sockaddr_in *)&ifa->address.sa;
1991                         if (sin->sin_addr.s_addr == 0) {
1992                                 /* we skip unspecifed addresses */
1993                                 return;
1994                         }
1995                         if (stcb->asoc.ipv4_local_scope == 0 &&
1996                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1997                                 return;
1998                         }
1999                         break;
2000                 }
2001         default:
2002                 /* else, not AF_INET or AF_INET6, so skip */
2003                 return;
2004         }
2005
2006         /* queue an asconf for this address add/delete */
2007         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
2008                 /* does the peer do asconf? */
2009                 if (stcb->asoc.peer_supports_asconf) {
2010                         /* queue an asconf for this addr */
2011                         status = sctp_asconf_queue_add(stcb, ifa, type);
2012
2013                         /*
2014                          * if queued ok, and in the open state, send out the
2015                          * ASCONF.  If in the non-open state, these will be
2016                          * sent when the state goes open.
2017                          */
2018                         if (status == 0 &&
2019                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2020 #ifdef SCTP_TIMER_BASED_ASCONF
2021                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2022                                     stcb, stcb->asoc.primary_destination);
2023 #else
2024                                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2025                                     addr_locked);
2026 #endif
2027                         }
2028                 }
2029         }
2030 }
2031
2032
2033 int
2034 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2035 {
2036         struct sctp_asconf_iterator *asc;
2037         struct sctp_ifa *ifa;
2038         struct sctp_laddr *l;
2039         int type;
2040         int cnt_invalid = 0;
2041
2042         asc = (struct sctp_asconf_iterator *)ptr;
2043         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2044                 ifa = l->ifa;
2045                 type = l->action;
2046                 if (ifa->address.sa.sa_family == AF_INET6) {
2047                         /* invalid if we're not a v6 endpoint */
2048                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2049                                 cnt_invalid++;
2050                                 if (asc->cnt == cnt_invalid)
2051                                         return (1);
2052                                 else
2053                                         continue;
2054                         }
2055                 } else if (ifa->address.sa.sa_family == AF_INET) {
2056                         /* invalid if we are a v6 only endpoint */
2057                         struct in6pcb *inp6;
2058
2059                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2060                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2061                             SCTP_IPV6_V6ONLY(inp6)) {
2062                                 cnt_invalid++;
2063                                 if (asc->cnt == cnt_invalid)
2064                                         return (1);
2065                                 else
2066                                         continue;
2067                         }
2068                 } else {
2069                         /* invalid address family */
2070                         cnt_invalid++;
2071                         if (asc->cnt == cnt_invalid)
2072                                 return (1);
2073                         else
2074                                 continue;
2075                 }
2076         }
2077         return (0);
2078 }
2079
2080 static int
2081 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2082 {
2083         struct sctp_ifa *ifa;
2084         struct sctp_asconf_iterator *asc;
2085         struct sctp_laddr *laddr, *nladdr, *l;
2086
2087         /* Only for specific case not bound all */
2088         asc = (struct sctp_asconf_iterator *)ptr;
2089         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2090                 ifa = l->ifa;
2091                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2092                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2093                             sctp_nxt_addr) {
2094                                 if (laddr->ifa == ifa) {
2095                                         laddr->action = 0;
2096                                         break;
2097                                 }
2098                         }
2099                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2100                         laddr = LIST_FIRST(&inp->sctp_addr_list);
2101                         while (laddr) {
2102                                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2103                                 /* remove only after all guys are done */
2104                                 if (laddr->ifa == ifa) {
2105                                         sctp_del_local_addr_ep(inp, ifa);
2106                                 }
2107                                 laddr = nladdr;
2108                         }
2109                 }
2110         }
2111         return (0);
2112 }
2113
2114 void
2115 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2116     void *ptr, uint32_t val)
2117 {
2118         struct sctp_asconf_iterator *asc;
2119         struct sctp_ifa *ifa;
2120         struct sctp_laddr *l;
2121         int cnt_invalid = 0;
2122         int type, status;
2123         int num_queued = 0;
2124
2125         asc = (struct sctp_asconf_iterator *)ptr;
2126         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2127                 ifa = l->ifa;
2128                 type = l->action;
2129
2130                 /* address's vrf_id must be the vrf_id of the assoc */
2131                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2132                         continue;
2133                 }
2134                 /* Same checks again for assoc */
2135                 switch (ifa->address.sa.sa_family) {
2136 #ifdef INET6
2137                 case AF_INET6:
2138                         {
2139                                 /* invalid if we're not a v6 endpoint */
2140                                 struct sockaddr_in6 *sin6;
2141
2142                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2143                                         cnt_invalid++;
2144                                         if (asc->cnt == cnt_invalid)
2145                                                 return;
2146                                         else
2147                                                 continue;
2148                                 }
2149                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2150                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2151                                         /* we skip unspecifed addresses */
2152                                         continue;
2153                                 }
2154                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2155                                         if (stcb->asoc.local_scope == 0) {
2156                                                 continue;
2157                                         }
2158                                         /* is it the right link local scope? */
2159                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2160                                                 continue;
2161                                         }
2162                                 }
2163                                 break;
2164                         }
2165 #endif
2166                 case AF_INET:
2167                         {
2168                                 /* invalid if we are a v6 only endpoint */
2169                                 struct in6pcb *inp6;
2170                                 struct sockaddr_in *sin;
2171
2172                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2173                                 /* invalid if we are a v6 only endpoint */
2174                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2175                                     SCTP_IPV6_V6ONLY(inp6))
2176                                         continue;
2177
2178                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2179                                 if (sin->sin_addr.s_addr == 0) {
2180                                         /* we skip unspecifed addresses */
2181                                         continue;
2182                                 }
2183                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2184                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2185                                         continue;;
2186                                 }
2187                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2188                                     SCTP_IPV6_V6ONLY(inp6)) {
2189                                         cnt_invalid++;
2190                                         if (asc->cnt == cnt_invalid)
2191                                                 return;
2192                                         else
2193                                                 continue;
2194                                 }
2195                                 break;
2196                         }
2197                 default:
2198                         /* invalid address family */
2199                         cnt_invalid++;
2200                         if (asc->cnt == cnt_invalid)
2201                                 return;
2202                         else
2203                                 continue;
2204                         break;
2205                 }
2206
2207                 if (type == SCTP_ADD_IP_ADDRESS) {
2208                         /* prevent this address from being used as a source */
2209                         sctp_add_local_addr_restricted(stcb, ifa);
2210                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2211                         struct sctp_nets *net;
2212
2213                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2214                                 sctp_rtentry_t *rt;
2215
2216                                 /* delete this address if cached */
2217                                 if (net->ro._s_addr == ifa) {
2218                                         sctp_free_ifa(net->ro._s_addr);
2219                                         net->ro._s_addr = NULL;
2220                                         net->src_addr_selected = 0;
2221                                         rt = net->ro.ro_rt;
2222                                         if (rt) {
2223                                                 RTFREE(rt);
2224                                                 net->ro.ro_rt = NULL;
2225                                         }
2226                                         /*
2227                                          * Now we deleted our src address,
2228                                          * should we not also now reset the
2229                                          * cwnd/rto to start as if its a new
2230                                          * address?
2231                                          */
2232                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2233                                         net->RTO = 0;
2234
2235                                 }
2236                         }
2237                 } else if (type == SCTP_SET_PRIM_ADDR) {
2238                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2239                                 /* must validate the ifa is in the ep */
2240                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2241                                         continue;
2242                                 }
2243                         } else {
2244                                 /* Need to check scopes for this guy */
2245                                 if (sctp_is_address_in_scope(ifa,
2246                                     stcb->asoc.ipv4_addr_legal,
2247                                     stcb->asoc.ipv6_addr_legal,
2248                                     stcb->asoc.loopback_scope,
2249                                     stcb->asoc.ipv4_local_scope,
2250                                     stcb->asoc.local_scope,
2251                                     stcb->asoc.site_scope, 0) == 0) {
2252                                         continue;
2253                                 }
2254                         }
2255                 }
2256                 /* queue an asconf for this address add/delete */
2257                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2258                     stcb->asoc.peer_supports_asconf) {
2259                         /* queue an asconf for this addr */
2260                         status = sctp_asconf_queue_add(stcb, ifa, type);
2261                         /*
2262                          * if queued ok, and in the open state, update the
2263                          * count of queued params.  If in the non-open
2264                          * state, these get sent when the assoc goes open.
2265                          */
2266                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2267                                 if (status >= 0) {
2268                                         num_queued++;
2269                                 }
2270                         }
2271                 }
2272         }
2273         /*
2274          * If we have queued params in the open state, send out an ASCONF.
2275          */
2276         if (num_queued > 0) {
2277                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2278                     SCTP_ADDR_NOT_LOCKED);
2279         }
2280 }
2281
2282 void
2283 sctp_asconf_iterator_end(void *ptr, uint32_t val)
2284 {
2285         struct sctp_asconf_iterator *asc;
2286         struct sctp_ifa *ifa;
2287         struct sctp_laddr *l, *l_next;
2288
2289         asc = (struct sctp_asconf_iterator *)ptr;
2290         l = LIST_FIRST(&asc->list_of_work);
2291         while (l != NULL) {
2292                 l_next = LIST_NEXT(l, sctp_nxt_addr);
2293                 ifa = l->ifa;
2294                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2295                         /* Clear the defer use flag */
2296                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2297                 }
2298                 sctp_free_ifa(ifa);
2299                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, l);
2300                 SCTP_DECR_LADDR_COUNT();
2301                 l = l_next;
2302         }
2303         SCTP_FREE(asc, SCTP_M_ASC_IT);
2304 }
2305
2306 /*
2307  * sa is the sockaddr to ask the peer to set primary to.
2308  * returns: 0 = completed, -1 = error
2309  */
2310 int32_t
2311 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2312 {
2313         uint32_t vrf_id;
2314         struct sctp_ifa *ifa;
2315
2316         /* find the ifa for the desired set primary */
2317         vrf_id = stcb->asoc.vrf_id;
2318         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2319         if (ifa == NULL) {
2320                 /* Invalid address */
2321                 return (-1);
2322         }
2323         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2324         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2325                 /* set primary queuing succeeded */
2326                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2327                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2328                     stcb);
2329                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2330                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2331 #ifdef SCTP_TIMER_BASED_ASCONF
2332                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2333                             stcb->sctp_ep, stcb,
2334                             stcb->asoc.primary_destination);
2335 #else
2336                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2337                             SCTP_ADDR_NOT_LOCKED);
2338 #endif
2339                 }
2340         } else {
2341                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2342                     stcb);
2343                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2344                 return (-1);
2345         }
2346         return (0);
2347 }
2348
2349 void
2350 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2351 {
2352         struct sctp_inpcb *inp;
2353
2354         /* go through all our PCB's */
2355         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
2356                 struct sctp_tcb *stcb;
2357
2358                 /* process for all associations for this endpoint */
2359                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2360                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2361                         if (!sctp_asconf_queue_add(stcb, ifa,
2362                             SCTP_SET_PRIM_ADDR)) {
2363                                 /* set primary queuing succeeded */
2364                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2365                                     stcb);
2366                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2367                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2368 #ifdef SCTP_TIMER_BASED_ASCONF
2369                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2370                                             stcb->sctp_ep, stcb,
2371                                             stcb->asoc.primary_destination);
2372 #else
2373                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2374                                             SCTP_ADDR_NOT_LOCKED);
2375 #endif
2376                                 }
2377                         }
2378                 }               /* for each stcb */
2379         }                       /* for each inp */
2380 }
2381
2382 static struct sockaddr *
2383 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2384 {
2385         struct sctp_vrf *vrf = NULL;
2386         struct sctp_ifn *sctp_ifn;
2387         struct sctp_ifa *sctp_ifa;
2388
2389         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2390                 SCTP_IPI_ADDR_RLOCK();
2391         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2392         if (vrf == NULL) {
2393                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2394                         SCTP_IPI_ADDR_RUNLOCK();
2395                 return (NULL);
2396         }
2397         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2398                 if (stcb->asoc.loopback_scope == 0 &&
2399                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2400                         /* Skip if loopback_scope not set */
2401                         continue;
2402                 }
2403                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2404                         if (sctp_ifa->address.sa.sa_family == AF_INET &&
2405                             stcb->asoc.ipv4_addr_legal) {
2406                                 struct sockaddr_in *sin;
2407
2408                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2409                                 if (sin->sin_addr.s_addr == 0) {
2410                                         /* skip unspecifed addresses */
2411                                         continue;
2412                                 }
2413                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2414                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2415                                         continue;
2416
2417                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
2418                                         continue;
2419                                 /* found a valid local v4 address to use */
2420                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2421                                         SCTP_IPI_ADDR_RUNLOCK();
2422                                 return (&sctp_ifa->address.sa);
2423                         } else if (sctp_ifa->address.sa.sa_family == AF_INET6 &&
2424                             stcb->asoc.ipv6_addr_legal) {
2425                                 struct sockaddr_in6 *sin6;
2426
2427                                 if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2428                                         continue;
2429                                 }
2430                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2431                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2432                                         /* we skip unspecifed addresses */
2433                                         continue;
2434                                 }
2435                                 if (stcb->asoc.local_scope == 0 &&
2436                                     IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2437                                         continue;
2438                                 if (stcb->asoc.site_scope == 0 &&
2439                                     IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2440                                         continue;
2441
2442                                 /* found a valid local v6 address to use */
2443                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2444                                         SCTP_IPI_ADDR_RUNLOCK();
2445                                 return (&sctp_ifa->address.sa);
2446                         }
2447                 }
2448         }
2449         /* no valid addresses found */
2450         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2451                 SCTP_IPI_ADDR_RUNLOCK();
2452         return (NULL);
2453 }
2454
2455 static struct sockaddr *
2456 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2457 {
2458         struct sctp_laddr *laddr;
2459
2460         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2461                 if (laddr->ifa == NULL) {
2462                         continue;
2463                 }
2464                 /* is the address restricted ? */
2465                 if (sctp_is_addr_restricted(stcb, laddr->ifa))
2466                         continue;
2467
2468                 /* found a valid local address to use */
2469                 return (&laddr->ifa->address.sa);
2470         }
2471         /* no valid addresses found */
2472         return (NULL);
2473 }
2474
2475 /*
2476  * builds an ASCONF chunk from queued ASCONF params.
2477  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2478  */
2479 struct mbuf *
2480 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2481 {
2482         struct mbuf *m_asconf, *m_asconf_chk;
2483         struct sctp_asconf_addr *aa;
2484         struct sctp_asconf_chunk *acp;
2485         struct sctp_asconf_paramhdr *aph;
2486         struct sctp_asconf_addr_param *aap;
2487         uint32_t p_length;
2488         uint32_t correlation_id = 1;    /* 0 is reserved... */
2489         caddr_t ptr, lookup_ptr;
2490         uint8_t lookup_used = 0;
2491
2492         /* are there any asconf params to send? */
2493         if (TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
2494                 return (NULL);
2495         }
2496         /* can't send a new one if there is one in flight already */
2497         if (stcb->asoc.asconf_sent > 0) {
2498                 return (NULL);
2499         }
2500         /*
2501          * get a chunk header mbuf and a cluster for the asconf params since
2502          * it's simpler to fill in the asconf chunk header lookup address on
2503          * the fly
2504          */
2505         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2506         if (m_asconf_chk == NULL) {
2507                 /* no mbuf's */
2508                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2509                     "compose_asconf: couldn't get chunk mbuf!\n");
2510                 return (NULL);
2511         }
2512         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2513         if (m_asconf == NULL) {
2514                 /* no mbuf's */
2515                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2516                     "compose_asconf: couldn't get mbuf!\n");
2517                 sctp_m_freem(m_asconf_chk);
2518                 return (NULL);
2519         }
2520         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2521         SCTP_BUF_LEN(m_asconf) = 0;
2522         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2523         bzero(acp, sizeof(struct sctp_asconf_chunk));
2524         /* save pointers to lookup address and asconf params */
2525         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2526         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2527
2528         /* fill in chunk header info */
2529         acp->ch.chunk_type = SCTP_ASCONF;
2530         acp->ch.chunk_flags = 0;
2531         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2532
2533         /* add parameters... up to smallest MTU allowed */
2534         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2535                 /* get the parameter length */
2536                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2537                 /* will it fit in current chunk? */
2538                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2539                         /* won't fit, so we're done with this chunk */
2540                         break;
2541                 }
2542                 /* assign (and store) a correlation id */
2543                 aa->ap.aph.correlation_id = correlation_id++;
2544
2545                 /*
2546                  * fill in address if we're doing a delete this is a simple
2547                  * way for us to fill in the correlation address, which
2548                  * should only be used by the peer if we're deleting our
2549                  * source address and adding a new address (e.g. renumbering
2550                  * case)
2551                  */
2552                 if (lookup_used == 0 &&
2553                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2554                         struct sctp_ipv6addr_param *lookup;
2555                         uint16_t p_size, addr_size;
2556
2557                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2558                         lookup->ph.param_type =
2559                             htons(aa->ap.addrp.ph.param_type);
2560                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2561                                 /* copy IPv6 address */
2562                                 p_size = sizeof(struct sctp_ipv6addr_param);
2563                                 addr_size = sizeof(struct in6_addr);
2564                         } else {
2565                                 /* copy IPv4 address */
2566                                 p_size = sizeof(struct sctp_ipv4addr_param);
2567                                 addr_size = sizeof(struct in_addr);
2568                         }
2569                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2570                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2571                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2572                         lookup_used = 1;
2573                 }
2574                 /* copy into current space */
2575                 memcpy(ptr, &aa->ap, p_length);
2576
2577                 /* network elements and update lengths */
2578                 aph = (struct sctp_asconf_paramhdr *)ptr;
2579                 aap = (struct sctp_asconf_addr_param *)ptr;
2580                 /* correlation_id is transparent to peer, no htonl needed */
2581                 aph->ph.param_type = htons(aph->ph.param_type);
2582                 aph->ph.param_length = htons(aph->ph.param_length);
2583                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2584                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2585
2586                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2587                 ptr += SCTP_SIZE32(p_length);
2588
2589                 /*
2590                  * these params are removed off the pending list upon
2591                  * getting an ASCONF-ACK back from the peer, just set flag
2592                  */
2593                 aa->sent = 1;
2594         }
2595         /* check to see if the lookup addr has been populated yet */
2596         if (lookup_used == 0) {
2597                 /* NOTE: if the address param is optional, can skip this... */
2598                 /* add any valid (existing) address... */
2599                 struct sctp_ipv6addr_param *lookup;
2600                 uint16_t p_size, addr_size;
2601                 struct sockaddr *found_addr;
2602                 caddr_t addr_ptr;
2603
2604                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2605                         found_addr = sctp_find_valid_localaddr(stcb,
2606                             addr_locked);
2607                 else
2608                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2609
2610                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2611                 if (found_addr != NULL) {
2612                         if (found_addr->sa_family == AF_INET6) {
2613                                 /* copy IPv6 address */
2614                                 lookup->ph.param_type =
2615                                     htons(SCTP_IPV6_ADDRESS);
2616                                 p_size = sizeof(struct sctp_ipv6addr_param);
2617                                 addr_size = sizeof(struct in6_addr);
2618                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2619                                     found_addr)->sin6_addr;
2620                         } else {
2621                                 /* copy IPv4 address */
2622                                 lookup->ph.param_type =
2623                                     htons(SCTP_IPV4_ADDRESS);
2624                                 p_size = sizeof(struct sctp_ipv4addr_param);
2625                                 addr_size = sizeof(struct in_addr);
2626                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2627                                     found_addr)->sin_addr;
2628                         }
2629                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2630                         memcpy(lookup->addr, addr_ptr, addr_size);
2631                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2632                         lookup_used = 1;
2633                 } else {
2634                         /* uh oh... don't have any address?? */
2635                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2636                             "compose_asconf: no lookup addr!\n");
2637                         /* for now, we send a IPv4 address of 0.0.0.0 */
2638                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2639                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2640                         bzero(lookup->addr, sizeof(struct in_addr));
2641                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2642                         lookup_used = 1;
2643                 }
2644         }
2645         /* chain it all together */
2646         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2647         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2648         acp->ch.chunk_length = ntohs(*retlen);
2649
2650         /* update "sent" flag */
2651         stcb->asoc.asconf_sent++;
2652
2653         return (m_asconf_chk);
2654 }
2655
2656 /*
2657  * section to handle address changes before an association is up eg. changes
2658  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2659  */
2660
2661 /*
2662  * processes the (local) addresses in the INIT-ACK chunk
2663  */
2664 static void
2665 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2666     unsigned int offset, unsigned int length)
2667 {
2668         struct sctp_paramhdr tmp_param, *ph;
2669         uint16_t plen, ptype;
2670         struct sctp_ifa *sctp_ifa;
2671         struct sctp_ipv6addr_param addr_store;
2672         struct sockaddr_in6 sin6;
2673         struct sockaddr_in sin;
2674         struct sockaddr *sa;
2675         uint32_t vrf_id;
2676
2677         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2678         if (stcb == NULL)       /* Un-needed check for SA */
2679                 return;
2680
2681         /* convert to upper bound */
2682         length += offset;
2683
2684         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2685                 return;
2686         }
2687         /* init the addresses */
2688         bzero(&sin6, sizeof(sin6));
2689         sin6.sin6_family = AF_INET6;
2690         sin6.sin6_len = sizeof(sin6);
2691         sin6.sin6_port = stcb->rport;
2692
2693         bzero(&sin, sizeof(sin));
2694         sin.sin_len = sizeof(sin);
2695         sin.sin_family = AF_INET;
2696         sin.sin_port = stcb->rport;
2697
2698         /* go through the addresses in the init-ack */
2699         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2700             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2701         while (ph != NULL) {
2702                 ptype = ntohs(ph->param_type);
2703                 plen = ntohs(ph->param_length);
2704                 if (ptype == SCTP_IPV6_ADDRESS) {
2705                         struct sctp_ipv6addr_param *a6p;
2706
2707                         /* get the entire IPv6 address param */
2708                         a6p = (struct sctp_ipv6addr_param *)
2709                             sctp_m_getptr(m, offset,
2710                             sizeof(struct sctp_ipv6addr_param),
2711                             (uint8_t *) & addr_store);
2712                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2713                             a6p == NULL) {
2714                                 return;
2715                         }
2716                         memcpy(&sin6.sin6_addr, a6p->addr,
2717                             sizeof(struct in6_addr));
2718                         sa = (struct sockaddr *)&sin6;
2719                 } else if (ptype == SCTP_IPV4_ADDRESS) {
2720                         struct sctp_ipv4addr_param *a4p;
2721
2722                         /* get the entire IPv4 address param */
2723                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2724                             sizeof(struct sctp_ipv4addr_param),
2725                             (uint8_t *) & addr_store);
2726                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2727                             a4p == NULL) {
2728                                 return;
2729                         }
2730                         sin.sin_addr.s_addr = a4p->addr;
2731                         sa = (struct sockaddr *)&sin;
2732                 } else {
2733                         goto next_addr;
2734                 }
2735
2736                 /* see if this address really (still) exists */
2737                 if (stcb) {
2738                         vrf_id = stcb->asoc.vrf_id;
2739                 } else {
2740                         vrf_id = SCTP_DEFAULT_VRFID;
2741                 }
2742                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2743                     SCTP_ADDR_NOT_LOCKED);
2744                 if (sctp_ifa == NULL) {
2745                         /* address doesn't exist anymore */
2746                         int status;
2747
2748                         /* are ASCONFs allowed ? */
2749                         if ((sctp_is_feature_on(stcb->sctp_ep,
2750                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2751                             stcb->asoc.peer_supports_asconf) {
2752                                 /* queue an ASCONF DEL_IP_ADDRESS */
2753                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2754                                 /*
2755                                  * if queued ok, and in correct state, send
2756                                  * out the ASCONF.
2757                                  */
2758                                 if (status == 0 &&
2759                                     SCTP_GET_STATE(&stcb->asoc) ==
2760                                     SCTP_STATE_OPEN) {
2761 #ifdef SCTP_TIMER_BASED_ASCONF
2762                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2763                                             stcb->sctp_ep, stcb,
2764                                             stcb->asoc.primary_destination);
2765 #else
2766                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2767                                             SCTP_ADDR_NOT_LOCKED);
2768 #endif
2769                                 }
2770                         }
2771                 }
2772 next_addr:
2773                 /*
2774                  * Sanity check:  Make sure the length isn't 0, otherwise
2775                  * we'll be stuck in this loop for a long time...
2776                  */
2777                 if (SCTP_SIZE32(plen) == 0) {
2778                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2779                             plen, ptype);
2780                         return;
2781                 }
2782                 /* get next parameter */
2783                 offset += SCTP_SIZE32(plen);
2784                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2785                         return;
2786                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2787                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2788         }                       /* while */
2789 }
2790
2791 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2792 /*
2793  * checks to see if a specific address is in the initack address list returns
2794  * 1 if found, 0 if not
2795  */
2796 static uint32_t
2797 sctp_addr_in_initack(struct sctp_tcb *stcb, struct mbuf *m, uint32_t offset,
2798     uint32_t length, struct sockaddr *sa)
2799 {
2800         struct sctp_paramhdr tmp_param, *ph;
2801         uint16_t plen, ptype;
2802         struct sctp_ipv6addr_param addr_store;
2803         struct sockaddr_in *sin;
2804         struct sctp_ipv4addr_param *a4p;
2805
2806 #ifdef INET6
2807         struct sockaddr_in6 *sin6;
2808         struct sctp_ipv6addr_param *a6p;
2809         struct sockaddr_in6 sin6_tmp;
2810
2811 #endif                          /* INET6 */
2812
2813         if (
2814 #ifdef INET6
2815             (sa->sa_family != AF_INET6) &&
2816 #endif                          /* INET6 */
2817             (sa->sa_family != AF_INET))
2818                 return (0);
2819
2820         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2821         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2822         /* convert to upper bound */
2823         length += offset;
2824
2825         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2826                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2827                     "find_initack_addr: invalid offset?\n");
2828                 return (0);
2829         }
2830         /* go through the addresses in the init-ack */
2831         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2832             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2833         while (ph != NULL) {
2834                 ptype = ntohs(ph->param_type);
2835                 plen = ntohs(ph->param_length);
2836 #ifdef INET6
2837                 if (ptype == SCTP_IPV6_ADDRESS && sa->sa_family == AF_INET6) {
2838                         /* get the entire IPv6 address param */
2839                         a6p = (struct sctp_ipv6addr_param *)
2840                             sctp_m_getptr(m, offset,
2841                             sizeof(struct sctp_ipv6addr_param),
2842                             (uint8_t *) & addr_store);
2843                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2844                             (ph == NULL) ||
2845                             (a6p == NULL)) {
2846                                 return (0);
2847                         }
2848                         sin6 = (struct sockaddr_in6 *)sa;
2849                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2850                                 /* create a copy and clear scope */
2851                                 memcpy(&sin6_tmp, sin6,
2852                                     sizeof(struct sockaddr_in6));
2853                                 sin6 = &sin6_tmp;
2854                                 in6_clearscope(&sin6->sin6_addr);
2855                         }
2856                         if (memcmp(&sin6->sin6_addr, a6p->addr,
2857                             sizeof(struct in6_addr)) == 0) {
2858                                 /* found it */
2859                                 return (1);
2860                         }
2861                 } else
2862 #endif                          /* INET6 */
2863
2864                         if (ptype == SCTP_IPV4_ADDRESS &&
2865                     sa->sa_family == AF_INET) {
2866                         /* get the entire IPv4 address param */
2867                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m,
2868                             offset, sizeof(struct sctp_ipv4addr_param),
2869                             (uint8_t *) & addr_store);
2870                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2871                             (ph == NULL) ||
2872                             (a4p == NULL)) {
2873                                 return (0);
2874                         }
2875                         sin = (struct sockaddr_in *)sa;
2876                         if (sin->sin_addr.s_addr == a4p->addr) {
2877                                 /* found it */
2878                                 return (1);
2879                         }
2880                 }
2881                 /* get next parameter */
2882                 offset += SCTP_SIZE32(plen);
2883                 if (offset + sizeof(struct sctp_paramhdr) > length)
2884                         return (0);
2885                 ph = (struct sctp_paramhdr *)
2886                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2887                     (uint8_t *) & tmp_param);
2888         }                       /* while */
2889         /* not found! */
2890         return (0);
2891 }
2892
2893 /*
2894  * makes sure that the current endpoint local addr list is consistent with
2895  * the new association (eg. subset bound, asconf allowed) adds addresses as
2896  * necessary
2897  */
2898 static void
2899 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2900     int length, struct sockaddr *init_addr)
2901 {
2902         struct sctp_laddr *laddr;
2903
2904         /* go through the endpoint list */
2905         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2906                 /* be paranoid and validate the laddr */
2907                 if (laddr->ifa == NULL) {
2908                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2909                             "check_addr_list_ep: laddr->ifa is NULL");
2910                         continue;
2911                 }
2912                 if (laddr->ifa == NULL) {
2913                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
2914                         continue;
2915                 }
2916                 /* do i have it implicitly? */
2917                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
2918                         continue;
2919                 }
2920                 /* check to see if in the init-ack */
2921                 if (!sctp_addr_in_initack(stcb, m, offset, length,
2922                     &laddr->ifa->address.sa)) {
2923                         /* try to add it */
2924                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
2925                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
2926                 }
2927         }
2928 }
2929
2930 /*
2931  * makes sure that the current kernel address list is consistent with the new
2932  * association (with all addrs bound) adds addresses as necessary
2933  */
2934 static void
2935 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2936     int length, struct sockaddr *init_addr,
2937     uint16_t local_scope, uint16_t site_scope,
2938     uint16_t ipv4_scope, uint16_t loopback_scope)
2939 {
2940         struct sctp_vrf *vrf = NULL;
2941         struct sctp_ifn *sctp_ifn;
2942         struct sctp_ifa *sctp_ifa;
2943         uint32_t vrf_id;
2944
2945         if (stcb) {
2946                 vrf_id = stcb->asoc.vrf_id;
2947         } else {
2948                 return;
2949         }
2950         SCTP_IPI_ADDR_RLOCK();
2951         vrf = sctp_find_vrf(vrf_id);
2952         if (vrf == NULL) {
2953                 SCTP_IPI_ADDR_RUNLOCK();
2954                 return;
2955         }
2956         /* go through all our known interfaces */
2957         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2958                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2959                         /* skip loopback interface */
2960                         continue;
2961                 }
2962                 /* go through each interface address */
2963                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2964                         /* do i have it implicitly? */
2965                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
2966                                 continue;
2967                         }
2968                         /* check to see if in the init-ack */
2969                         if (!sctp_addr_in_initack(stcb, m, offset, length,
2970                             &sctp_ifa->address.sa)) {
2971                                 /* try to add it */
2972                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
2973                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
2974                                     SCTP_ADDR_LOCKED);
2975                         }
2976                 }               /* end foreach ifa */
2977         }                       /* end foreach ifn */
2978         SCTP_IPI_ADDR_RUNLOCK();
2979 }
2980
2981 /*
2982  * validates an init-ack chunk (from a cookie-echo) with current addresses
2983  * adds addresses from the init-ack into our local address list, if needed
2984  * queues asconf adds/deletes addresses as needed and makes appropriate list
2985  * changes for source address selection m, offset: points to the start of the
2986  * address list in an init-ack chunk length: total length of the address
2987  * params only init_addr: address where my INIT-ACK was sent from
2988  */
2989 void
2990 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2991     int length, struct sockaddr *init_addr,
2992     uint16_t local_scope, uint16_t site_scope,
2993     uint16_t ipv4_scope, uint16_t loopback_scope)
2994 {
2995         /* process the local addresses in the initack */
2996         sctp_process_initack_addresses(stcb, m, offset, length);
2997
2998         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2999                 /* bound all case */
3000                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3001                     local_scope, site_scope, ipv4_scope, loopback_scope);
3002         } else {
3003                 /* subset bound case */
3004                 if (sctp_is_feature_on(stcb->sctp_ep,
3005                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3006                         /* asconf's allowed */
3007                         sctp_check_address_list_ep(stcb, m, offset, length,
3008                             init_addr);
3009                 }
3010                 /* else, no asconfs allowed, so what we sent is what we get */
3011         }
3012 }
3013
3014 /*
3015  * sctp_bindx() support
3016  */
3017 uint32_t
3018 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3019     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3020 {
3021         struct sctp_ifa *ifa;
3022
3023         if (sa->sa_len == 0) {
3024                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3025                 return (EINVAL);
3026         }
3027         if (sctp_ifap) {
3028                 ifa = sctp_ifap;
3029         } else if (type == SCTP_ADD_IP_ADDRESS) {
3030                 /* For an add the address MUST be on the system */
3031                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3032         } else if (type == SCTP_DEL_IP_ADDRESS) {
3033                 /* For a delete we need to find it in the inp */
3034                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3035         } else {
3036                 ifa = NULL;
3037         }
3038         if (ifa != NULL) {
3039                 /* add this address */
3040                 struct sctp_asconf_iterator *asc;
3041                 struct sctp_laddr *wi;
3042
3043                 SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3044                     sizeof(struct sctp_asconf_iterator),
3045                     SCTP_M_ASC_IT);
3046                 if (asc == NULL) {
3047                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3048                         return (ENOMEM);
3049                 }
3050                 wi = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr,
3051                     struct sctp_laddr);
3052                 if (wi == NULL) {
3053                         SCTP_FREE(asc, SCTP_M_ASC_IT);
3054                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3055                         return (ENOMEM);
3056                 }
3057                 if (type == SCTP_ADD_IP_ADDRESS) {
3058                         sctp_add_local_addr_ep(inp, ifa, type);
3059                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3060                         struct sctp_laddr *laddr;
3061
3062                         if (inp->laddr_count < 2) {
3063                                 /* can't delete the last local address */
3064                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3065                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
3066                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3067                                 return (EINVAL);
3068                         }
3069                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3070                             sctp_nxt_addr) {
3071                                 if (ifa == laddr->ifa) {
3072                                         /* Mark in the delete */
3073                                         laddr->action = type;
3074                                 }
3075                         }
3076                 }
3077                 LIST_INIT(&asc->list_of_work);
3078                 asc->cnt = 1;
3079                 SCTP_INCR_LADDR_COUNT();
3080                 wi->ifa = ifa;
3081                 wi->action = type;
3082                 atomic_add_int(&ifa->refcount, 1);
3083                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3084                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3085                     sctp_asconf_iterator_stcb,
3086                     sctp_asconf_iterator_ep_end,
3087                     SCTP_PCB_ANY_FLAGS,
3088                     SCTP_PCB_ANY_FEATURES,
3089                     SCTP_ASOC_ANY_STATE,
3090                     (void *)asc, 0,
3091                     sctp_asconf_iterator_end, inp, 0);
3092         } else {
3093                 /* invalid address! */
3094                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3095                 return (EADDRNOTAVAIL);
3096         }
3097         return (0);
3098 }