sys/netinet/sctp_asconf.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #include <netinet/sctp_pcb.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctputil.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_asconf.h>
  46 #include <netinet/sctp_timer.h>
  47
  48 /*
  49  * debug flags:
  50  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  51  * SCTP_DEBUG_ASCONF2: detailed info
  52  */
  53
  54
  55 /*
  56  * RFC 5061
  57  *
  58  * An ASCONF parameter queue exists per asoc which holds the pending address
  59  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  60  *
  61  * A restricted_addrs list exists per assoc to hold local addresses that are
  62  * not (yet) usable by the assoc as a source address.  These addresses are
  63  * either pending an ASCONF operation (and exist on the ASCONF parameter
  64  * queue), or they are permanently restricted (the peer has returned an
  65  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  66  *
  67  * Deleted addresses are always immediately removed from the lists as they will
  68  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  69  * only if allowed.
  70  */
  71
  72 /*
  73  * ASCONF parameter processing.
  74  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  75  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  76  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  77  */
  78 static struct mbuf *
  79 sctp_asconf_success_response(uint32_t id)
  80 {
  81         struct mbuf *m_reply = NULL;
  82         struct sctp_asconf_paramhdr *aph;
  83
  84         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  85             0, M_NOWAIT, 1, MT_DATA);
  86         if (m_reply == NULL) {
  87                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  88                     "asconf_success_response: couldn't get mbuf!\n");
  89                 return (NULL);
  90         }
  91         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  92         aph->correlation_id = id;
  93         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  94         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  95         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  96         aph->ph.param_length = htons(aph->ph.param_length);
  97
  98         return (m_reply);
  99 }
 100
 101 static struct mbuf *
 102 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 103     uint16_t tlv_length)
 104 {
 105         struct mbuf *m_reply = NULL;
 106         struct sctp_asconf_paramhdr *aph;
 107         struct sctp_error_cause *error;
 108         uint8_t *tlv;
 109
 110         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 111             tlv_length +
 112             sizeof(struct sctp_error_cause)),
 113             0, M_NOWAIT, 1, MT_DATA);
 114         if (m_reply == NULL) {
 115                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 116                     "asconf_error_response: couldn't get mbuf!\n");
 117                 return (NULL);
 118         }
 119         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 120         error = (struct sctp_error_cause *)(aph + 1);
 121
 122         aph->correlation_id = id;
 123         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 124         error->code = htons(cause);
 125         error->length = tlv_length + sizeof(struct sctp_error_cause);
 126         aph->ph.param_length = error->length +
 127             sizeof(struct sctp_asconf_paramhdr);
 128
 129         if (aph->ph.param_length > MLEN) {
 130                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 131                     "asconf_error_response: tlv_length (%xh) too big\n",
 132                     tlv_length);
 133                 sctp_m_freem(m_reply);  /* discard */
 134                 return (NULL);
 135         }
 136         if (error_tlv != NULL) {
 137                 tlv = (uint8_t *)(error + 1);
 138                 memcpy(tlv, error_tlv, tlv_length);
 139         }
 140         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 141         error->length = htons(error->length);
 142         aph->ph.param_length = htons(aph->ph.param_length);
 143
 144         return (m_reply);
 145 }
 146
 147 static struct mbuf *
 148 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 149     struct sctp_tcb *stcb, int send_hb, int response_required)
 150 {
 151         struct sctp_nets *net;
 152         struct mbuf *m_reply = NULL;
 153         union sctp_sockstore store;
 154         struct sctp_paramhdr *ph;
 155         uint16_t param_type, aparam_length;
 156 #if defined(INET) || defined(INET6)
 157         uint16_t param_length;
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162 #ifdef INET
 163         struct sockaddr_in *sin;
 164         struct sctp_ipv4addr_param *v4addr;
 165 #endif
 166 #ifdef INET6
 167         struct sockaddr_in6 *sin6;
 168         struct sctp_ipv6addr_param *v6addr;
 169 #endif
 170
 171         aparam_length = ntohs(aph->ph.param_length);
 172         ph = (struct sctp_paramhdr *)(aph + 1);
 173         param_type = ntohs(ph->param_type);
 174 #if defined(INET) || defined(INET6)
 175         param_length = ntohs(ph->param_length);
 176 #endif
 177         sa = &store.sa;
 178         switch (param_type) {
 179 #ifdef INET
 180         case SCTP_IPV4_ADDRESS:
 181                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 182                         /* invalid param size */
 183                         return (NULL);
 184                 }
 185                 v4addr = (struct sctp_ipv4addr_param *)ph;
 186                 sin = &store.sin;
 187                 memset(sin, 0, sizeof(*sin));
 188                 sin->sin_family = AF_INET;
 189                 sin->sin_len = sizeof(struct sockaddr_in);
 190                 sin->sin_port = stcb->rport;
 191                 sin->sin_addr.s_addr = v4addr->addr;
 192                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 193                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 194                         bad_address = 1;
 195                 }
 196                 if (sin->sin_addr.s_addr == INADDR_ANY)
 197                         zero_address = 1;
 198                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 199                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 200                 break;
 201 #endif
 202 #ifdef INET6
 203         case SCTP_IPV6_ADDRESS:
 204                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 205                         /* invalid param size */
 206                         return (NULL);
 207                 }
 208                 v6addr = (struct sctp_ipv6addr_param *)ph;
 209                 sin6 = &store.sin6;
 210                 memset(sin6, 0, sizeof(*sin6));
 211                 sin6->sin6_family = AF_INET6;
 212                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 213                 sin6->sin6_port = stcb->rport;
 214                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 215                     sizeof(struct in6_addr));
 216                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 217                         bad_address = 1;
 218                 }
 219                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 220                         zero_address = 1;
 221                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 222                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 223                 break;
 224 #endif
 225         default:
 226                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 227                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 228                     aparam_length);
 229                 return (m_reply);
 230         }                       /* end switch */
 231
 232         /* if 0.0.0.0/::0, add the source address instead */
 233         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 234                 sa = src;
 235                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 236                     "process_asconf_add_ip: using source addr ");
 237                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 238         }
 239         /* add the address */
 240         if (bad_address) {
 241                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 242                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 243                     aparam_length);
 244         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 245                     SCTP_DONOT_SETSCOPE,
 246             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 247                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 248                     "process_asconf_add_ip: error adding address\n");
 249                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 250                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 251                     aparam_length);
 252         } else {
 253                 /* notify upper layer */
 254                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 255                 if (response_required) {
 256                         m_reply =
 257                             sctp_asconf_success_response(aph->correlation_id);
 258                 }
 259                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 260                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 261                     stcb, net);
 262                 if (send_hb) {
 263                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 264                 }
 265         }
 266         return (m_reply);
 267 }
 268
 269 static int
 270 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 271 {
 272         struct sctp_nets *src_net, *net;
 273
 274         /* make sure the source address exists as a destination net */
 275         src_net = sctp_findnet(stcb, src);
 276         if (src_net == NULL) {
 277                 /* not found */
 278                 return (-1);
 279         }
 280
 281         /* delete all destination addresses except the source */
 282         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 283                 if (net != src_net) {
 284                         /* delete this address */
 285                         sctp_remove_net(stcb, net);
 286                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 287                             "asconf_del_remote_addrs_except: deleting ");
 288                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 289                             (struct sockaddr *)&net->ro._l_addr);
 290                         /* notify upper layer */
 291                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 292                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 293                 }
 294         }
 295         return (0);
 296 }
 297
 298 static struct mbuf *
 299 sctp_process_asconf_delete_ip(struct sockaddr *src,
 300     struct sctp_asconf_paramhdr *aph,
 301     struct sctp_tcb *stcb, int response_required)
 302 {
 303         struct mbuf *m_reply = NULL;
 304         union sctp_sockstore store;
 305         struct sctp_paramhdr *ph;
 306         uint16_t param_type, aparam_length;
 307 #if defined(INET) || defined(INET6)
 308         uint16_t param_length;
 309 #endif
 310         struct sockaddr *sa;
 311         int zero_address = 0;
 312         int result;
 313 #ifdef INET
 314         struct sockaddr_in *sin;
 315         struct sctp_ipv4addr_param *v4addr;
 316 #endif
 317 #ifdef INET6
 318         struct sockaddr_in6 *sin6;
 319         struct sctp_ipv6addr_param *v6addr;
 320 #endif
 321
 322         aparam_length = ntohs(aph->ph.param_length);
 323         ph = (struct sctp_paramhdr *)(aph + 1);
 324         param_type = ntohs(ph->param_type);
 325 #if defined(INET) || defined(INET6)
 326         param_length = ntohs(ph->param_length);
 327 #endif
 328         sa = &store.sa;
 329         switch (param_type) {
 330 #ifdef INET
 331         case SCTP_IPV4_ADDRESS:
 332                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 333                         /* invalid param size */
 334                         return (NULL);
 335                 }
 336                 v4addr = (struct sctp_ipv4addr_param *)ph;
 337                 sin = &store.sin;
 338                 memset(sin, 0, sizeof(*sin));
 339                 sin->sin_family = AF_INET;
 340                 sin->sin_len = sizeof(struct sockaddr_in);
 341                 sin->sin_port = stcb->rport;
 342                 sin->sin_addr.s_addr = v4addr->addr;
 343                 if (sin->sin_addr.s_addr == INADDR_ANY)
 344                         zero_address = 1;
 345                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 346                     "process_asconf_delete_ip: deleting ");
 347                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 348                 break;
 349 #endif
 350 #ifdef INET6
 351         case SCTP_IPV6_ADDRESS:
 352                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 353                         /* invalid param size */
 354                         return (NULL);
 355                 }
 356                 v6addr = (struct sctp_ipv6addr_param *)ph;
 357                 sin6 = &store.sin6;
 358                 memset(sin6, 0, sizeof(*sin6));
 359                 sin6->sin6_family = AF_INET6;
 360                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 361                 sin6->sin6_port = stcb->rport;
 362                 memcpy(&sin6->sin6_addr, v6addr->addr,
 363                     sizeof(struct in6_addr));
 364                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 365                         zero_address = 1;
 366                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 367                     "process_asconf_delete_ip: deleting ");
 368                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 369                 break;
 370 #endif
 371         default:
 372                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 373                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 374                     aparam_length);
 375                 return (m_reply);
 376         }
 377
 378         /* make sure the source address is not being deleted */
 379         if (sctp_cmpaddr(sa, src)) {
 380                 /* trying to delete the source address! */
 381                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 382                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 383                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 384                     aparam_length);
 385                 return (m_reply);
 386         }
 387
 388         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 389         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 390                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 391
 392                 if (result) {
 393                         /* src address did not exist? */
 394                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 395                         /* what error to reply with?? */
 396                         m_reply =
 397                             sctp_asconf_error_response(aph->correlation_id,
 398                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 399                             aparam_length);
 400                 } else if (response_required) {
 401                         m_reply =
 402                             sctp_asconf_success_response(aph->correlation_id);
 403                 }
 404                 return (m_reply);
 405         }
 406
 407         /* delete the address */
 408         result = sctp_del_remote_addr(stcb, sa);
 409         /*
 410          * note if result == -2, the address doesn't exist in the asoc but
 411          * since it's being deleted anyways, we just ack the delete -- but
 412          * this probably means something has already gone awry
 413          */
 414         if (result == -1) {
 415                 /* only one address in the asoc */
 416                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 417                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 418                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 419                     aparam_length);
 420         } else {
 421                 if (response_required) {
 422                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 423                 }
 424                 /* notify upper layer */
 425                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 426         }
 427         return (m_reply);
 428 }
 429
 430 static struct mbuf *
 431 sctp_process_asconf_set_primary(struct sockaddr *src,
 432     struct sctp_asconf_paramhdr *aph,
 433     struct sctp_tcb *stcb, int response_required)
 434 {
 435         struct mbuf *m_reply = NULL;
 436         union sctp_sockstore store;
 437         struct sctp_paramhdr *ph;
 438         uint16_t param_type, aparam_length;
 439 #if defined(INET) || defined(INET6)
 440         uint16_t param_length;
 441 #endif
 442         struct sockaddr *sa;
 443         int zero_address = 0;
 444 #ifdef INET
 445         struct sockaddr_in *sin;
 446         struct sctp_ipv4addr_param *v4addr;
 447 #endif
 448 #ifdef INET6
 449         struct sockaddr_in6 *sin6;
 450         struct sctp_ipv6addr_param *v6addr;
 451 #endif
 452
 453         aparam_length = ntohs(aph->ph.param_length);
 454         ph = (struct sctp_paramhdr *)(aph + 1);
 455         param_type = ntohs(ph->param_type);
 456 #if defined(INET) || defined(INET6)
 457         param_length = ntohs(ph->param_length);
 458 #endif
 459         sa = &store.sa;
 460         switch (param_type) {
 461 #ifdef INET
 462         case SCTP_IPV4_ADDRESS:
 463                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 464                         /* invalid param size */
 465                         return (NULL);
 466                 }
 467                 v4addr = (struct sctp_ipv4addr_param *)ph;
 468                 sin = &store.sin;
 469                 memset(sin, 0, sizeof(*sin));
 470                 sin->sin_family = AF_INET;
 471                 sin->sin_len = sizeof(struct sockaddr_in);
 472                 sin->sin_addr.s_addr = v4addr->addr;
 473                 if (sin->sin_addr.s_addr == INADDR_ANY)
 474                         zero_address = 1;
 475                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 476                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 477                 break;
 478 #endif
 479 #ifdef INET6
 480         case SCTP_IPV6_ADDRESS:
 481                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 482                         /* invalid param size */
 483                         return (NULL);
 484                 }
 485                 v6addr = (struct sctp_ipv6addr_param *)ph;
 486                 sin6 = &store.sin6;
 487                 memset(sin6, 0, sizeof(*sin6));
 488                 sin6->sin6_family = AF_INET6;
 489                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 490                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 491                     sizeof(struct in6_addr));
 492                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 493                         zero_address = 1;
 494                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 495                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 496                 break;
 497 #endif
 498         default:
 499                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 500                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 501                     aparam_length);
 502                 return (m_reply);
 503         }
 504
 505         /* if 0.0.0.0/::0, use the source address instead */
 506         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 507                 sa = src;
 508                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 509                     "process_asconf_set_primary: using source addr ");
 510                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 511         }
 512         /* set the primary address */
 513         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 514                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 515                     "process_asconf_set_primary: primary address set\n");
 516                 /* notify upper layer */
 517                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 518                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 519                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 520                     (stcb->asoc.alternate)) {
 521                         sctp_free_remote_addr(stcb->asoc.alternate);
 522                         stcb->asoc.alternate = NULL;
 523                 }
 524                 if (response_required) {
 525                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 526                 }
 527                 /*
 528                  * Mobility adaptation. Ideally, when the reception of SET
 529                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 530                  * destination, unacknowledged DATA are retransmitted
 531                  * immediately to the new primary destination for seamless
 532                  * handover. If the destination is UNCONFIRMED and marked to
 533                  * REQ_PRIM, The retransmission occur when reception of the
 534                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 535                  * sctp_input.c) Also, when change of the primary
 536                  * destination, it is better that all subsequent new DATA
 537                  * containing already queued DATA are transmitted to the new
 538                  * primary destination. (by micchie)
 539                  */
 540                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 541                     SCTP_MOBILITY_BASE) ||
 542                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 543                     SCTP_MOBILITY_FASTHANDOFF)) &&
 544                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 545                     SCTP_MOBILITY_PRIM_DELETED) &&
 546                     (stcb->asoc.primary_destination->dest_state &
 547                     SCTP_ADDR_UNCONFIRMED) == 0) {
 548
 549                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 550                             stcb->sctp_ep, stcb, NULL,
 551                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 552                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 553                             SCTP_MOBILITY_FASTHANDOFF)) {
 554                                 sctp_assoc_immediate_retrans(stcb,
 555                                     stcb->asoc.primary_destination);
 556                         }
 557                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 558                             SCTP_MOBILITY_BASE)) {
 559                                 sctp_move_chunks_from_net(stcb,
 560                                     stcb->asoc.deleted_primary);
 561                         }
 562                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 563                             stcb->asoc.deleted_primary);
 564                 }
 565         } else {
 566                 /* couldn't set the requested primary address! */
 567                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 568                     "process_asconf_set_primary: set primary failed!\n");
 569                 /* must have been an invalid address, so report */
 570                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 571                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 572                     aparam_length);
 573         }
 574
 575         return (m_reply);
 576 }
 577
 578 /*
 579  * handles an ASCONF chunk.
 580  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 581  */
 582 void
 583 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 584     struct sockaddr *src,
 585     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 586     int first)
 587 {
 588         struct sctp_association *asoc;
 589         uint32_t serial_num;
 590         struct mbuf *n, *m_ack, *m_result, *m_tail;
 591         struct sctp_asconf_ack_chunk *ack_cp;
 592         struct sctp_asconf_paramhdr *aph;
 593         struct sctp_ipv6addr_param *p_addr;
 594         unsigned int asconf_limit, cnt;
 595         int error = 0;          /* did an error occur? */
 596
 597         /* asconf param buffer */
 598         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 599         struct sctp_asconf_ack *ack, *ack_next;
 600
 601         /* verify minimum length */
 602         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 603                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 604                     "handle_asconf: chunk too small = %xh\n",
 605                     ntohs(cp->ch.chunk_length));
 606                 return;
 607         }
 608         asoc = &stcb->asoc;
 609         serial_num = ntohl(cp->serial_number);
 610
 611         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 612                 /* got a duplicate ASCONF */
 613                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 614                     "handle_asconf: got duplicate serial number = %xh\n",
 615                     serial_num);
 616                 return;
 617         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 618                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 619                     serial_num, asoc->asconf_seq_in + 1);
 620                 return;
 621         }
 622
 623         /* it's the expected "next" sequence number, so process it */
 624         asoc->asconf_seq_in = serial_num;       /* update sequence */
 625         /* get length of all the param's in the ASCONF */
 626         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 627         SCTPDBG(SCTP_DEBUG_ASCONF1,
 628             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 629             asconf_limit, serial_num);
 630
 631         if (first) {
 632                 /* delete old cache */
 633                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 634
 635                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 636                         if (ack->serial_number == serial_num)
 637                                 break;
 638                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 639                             ack->serial_number, serial_num);
 640                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 641                         if (ack->data != NULL) {
 642                                 sctp_m_freem(ack->data);
 643                         }
 644                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 645                 }
 646         }
 647
 648         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 649             M_NOWAIT, 1, MT_DATA);
 650         if (m_ack == NULL) {
 651                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 652                     "handle_asconf: couldn't get mbuf!\n");
 653                 return;
 654         }
 655         m_tail = m_ack;         /* current reply chain's tail */
 656
 657         /* fill in ASCONF-ACK header */
 658         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 659         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 660         ack_cp->ch.chunk_flags = 0;
 661         ack_cp->serial_number = htonl(serial_num);
 662         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 663         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 664         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 665
 666         /* skip the lookup address parameter */
 667         offset += sizeof(struct sctp_asconf_chunk);
 668         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 669         if (p_addr == NULL) {
 670                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 671                     "handle_asconf: couldn't get lookup addr!\n");
 672                 /* respond with a missing/invalid mandatory parameter error */
 673                 return;
 674         }
 675         /* param_length is already validated in process_control... */
 676         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 677         /* get pointer to first asconf param in ASCONF */
 678         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 679         if (aph == NULL) {
 680                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 681                 goto send_reply;
 682         }
 683         /* process through all parameters */
 684         cnt = 0;
 685         while (aph != NULL) {
 686                 unsigned int param_length, param_type;
 687
 688                 param_type = ntohs(aph->ph.param_type);
 689                 param_length = ntohs(aph->ph.param_length);
 690                 if (offset + param_length > asconf_limit) {
 691                         /* parameter goes beyond end of chunk! */
 692                         sctp_m_freem(m_ack);
 693                         return;
 694                 }
 695                 m_result = NULL;
 696
 697                 if (param_length > sizeof(aparam_buf)) {
 698                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 699                         sctp_m_freem(m_ack);
 700                         return;
 701                 }
 702                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 703                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 704                         sctp_m_freem(m_ack);
 705                 }
 706                 /* get the entire parameter */
 707                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 708                 if (aph == NULL) {
 709                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 710                         sctp_m_freem(m_ack);
 711                         return;
 712                 }
 713                 switch (param_type) {
 714                 case SCTP_ADD_IP_ADDRESS:
 715                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 716                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 717                         cnt++;
 718                         break;
 719                 case SCTP_DEL_IP_ADDRESS:
 720                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 721                             error);
 722                         break;
 723                 case SCTP_ERROR_CAUSE_IND:
 724                         /* not valid in an ASCONF chunk */
 725                         break;
 726                 case SCTP_SET_PRIM_ADDR:
 727                         m_result = sctp_process_asconf_set_primary(src, aph,
 728                             stcb, error);
 729                         break;
 730                 case SCTP_NAT_VTAGS:
 731                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 732                         break;
 733                 case SCTP_SUCCESS_REPORT:
 734                         /* not valid in an ASCONF chunk */
 735                         break;
 736                 case SCTP_ULP_ADAPTATION:
 737                         /* FIX */
 738                         break;
 739                 default:
 740                         if ((param_type & 0x8000) == 0) {
 741                                 /* Been told to STOP at this param */
 742                                 asconf_limit = offset;
 743                                 /*
 744                                  * FIX FIX - We need to call
 745                                  * sctp_arethere_unrecognized_parameters()
 746                                  * to get a operr and send it for any
 747                                  * param's with the 0x4000 bit set OR do it
 748                                  * here ourselves... note we still must STOP
 749                                  * if the 0x8000 bit is clear.
 750                                  */
 751                         }
 752                         /* unknown/invalid param type */
 753                         break;
 754                 }               /* switch */
 755
 756                 /* add any (error) result to the reply mbuf chain */
 757                 if (m_result != NULL) {
 758                         SCTP_BUF_NEXT(m_tail) = m_result;
 759                         m_tail = m_result;
 760                         /* update lengths, make sure it's aligned too */
 761                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 762                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 763                         /* set flag to force success reports */
 764                         error = 1;
 765                 }
 766                 offset += SCTP_SIZE32(param_length);
 767                 /* update remaining ASCONF message length to process */
 768                 if (offset >= asconf_limit) {
 769                         /* no more data in the mbuf chain */
 770                         break;
 771                 }
 772                 /* get pointer to next asconf param */
 773                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 774                     sizeof(struct sctp_asconf_paramhdr),
 775                     (uint8_t *)&aparam_buf);
 776                 if (aph == NULL) {
 777                         /* can't get an asconf paramhdr */
 778                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 779                         /* FIX ME - add error here... */
 780                 }
 781         }
 782
 783 send_reply:
 784         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 785         /* save the ASCONF-ACK reply */
 786         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 787             struct sctp_asconf_ack);
 788         if (ack == NULL) {
 789                 sctp_m_freem(m_ack);
 790                 return;
 791         }
 792         ack->serial_number = serial_num;
 793         ack->last_sent_to = NULL;
 794         ack->data = m_ack;
 795         ack->len = 0;
 796         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 797                 ack->len += SCTP_BUF_LEN(n);
 798         }
 799         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 800
 801         /* see if last_control_chunk_from is set properly (use IP src addr) */
 802         if (stcb->asoc.last_control_chunk_from == NULL) {
 803                 /*
 804                  * this could happen if the source address was just newly
 805                  * added
 806                  */
 807                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 808                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 809                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 810                 /* look up the from address */
 811                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 812 #ifdef SCTP_DEBUG
 813                 if (stcb->asoc.last_control_chunk_from == NULL) {
 814                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 815                 }
 816 #endif
 817         }
 818 }
 819
 820 /*
 821  * does the address match? returns 0 if not, 1 if so
 822  */
 823 static uint32_t
 824 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 825 {
 826         switch (sa->sa_family) {
 827 #ifdef INET6
 828         case AF_INET6:
 829                 {
 830                         /* XXX scopeid */
 831                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 832
 833                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 834                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 835                             sizeof(struct in6_addr)) == 0)) {
 836                                 return (1);
 837                         }
 838                         break;
 839                 }
 840 #endif
 841 #ifdef INET
 842         case AF_INET:
 843                 {
 844                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 845
 846                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 847                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 848                             sizeof(struct in_addr)) == 0)) {
 849                                 return (1);
 850                         }
 851                         break;
 852                 }
 853 #endif
 854         default:
 855                 break;
 856         }
 857         return (0);
 858 }
 859
 860 /*
 861  * does the address match? returns 0 if not, 1 if so
 862  */
 863 static uint32_t
 864 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 865 {
 866 #if defined(INET) || defined(INET6)
 867         uint16_t param_type, param_length;
 868
 869         param_type = ntohs(ph->param_type);
 870         param_length = ntohs(ph->param_length);
 871 #endif
 872         switch (sa->sa_family) {
 873 #ifdef INET6
 874         case AF_INET6:
 875                 {
 876                         /* XXX scopeid */
 877                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 878                         struct sctp_ipv6addr_param *v6addr;
 879
 880                         v6addr = (struct sctp_ipv6addr_param *)ph;
 881                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 882                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 883                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 884                             sizeof(struct in6_addr)) == 0)) {
 885                                 return (1);
 886                         }
 887                         break;
 888                 }
 889 #endif
 890 #ifdef INET
 891         case AF_INET:
 892                 {
 893                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 894                         struct sctp_ipv4addr_param *v4addr;
 895
 896                         v4addr = (struct sctp_ipv4addr_param *)ph;
 897                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 898                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 899                             (memcmp(&v4addr->addr, &sin->sin_addr,
 900                             sizeof(struct in_addr)) == 0)) {
 901                                 return (1);
 902                         }
 903                         break;
 904                 }
 905 #endif
 906         default:
 907                 break;
 908         }
 909         return (0);
 910 }
 911
 912 /*
 913  * Cleanup for non-responded/OP ERR'd ASCONF
 914  */
 915 void
 916 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 917 {
 918         /*
 919          * clear out any existing asconfs going out
 920          */
 921         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 922             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 923         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 924         /* remove the old ASCONF on our outbound queue */
 925         sctp_toss_old_asconf(stcb);
 926 }
 927
 928 /*
 929  * cleanup any cached source addresses that may be topologically
 930  * incorrect after a new address has been added to this interface.
 931  */
 932 static void
 933 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 934 {
 935         struct sctp_nets *net;
 936
 937         /*
 938          * Ideally, we want to only clear cached routes and source addresses
 939          * that are topologically incorrect.  But since there is no easy way
 940          * to know whether the newly added address on the ifn would cause a
 941          * routing change (i.e. a new egress interface would be chosen)
 942          * without doing a new routing lookup and source address selection,
 943          * we will (for now) just flush any cached route using a different
 944          * ifn (and cached source addrs) and let output re-choose them
 945          * during the next send on that net.
 946          */
 947         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 948                 /*
 949                  * clear any cached route (and cached source address) if the
 950                  * route's interface is NOT the same as the address change.
 951                  * If it's the same interface, just clear the cached source
 952                  * address.
 953                  */
 954                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 955                     ((ifn == NULL) ||
 956                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 957                         /* clear any cached route */
 958                         RTFREE(net->ro.ro_rt);
 959                         net->ro.ro_rt = NULL;
 960                 }
 961                 /* clear any cached source address */
 962                 if (net->src_addr_selected) {
 963                         sctp_free_ifa(net->ro._s_addr);
 964                         net->ro._s_addr = NULL;
 965                         net->src_addr_selected = 0;
 966                 }
 967         }
 968 }
 969
 970
 971 void
 972 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 973 {
 974         int error;
 975
 976         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 977                 return;
 978         }
 979         if (stcb->asoc.deleted_primary == NULL) {
 980                 return;
 981         }
 982
 983         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 984                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 985                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 986                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 987                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 988                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 989                     stcb->asoc.deleted_primary,
 990                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
 991                 stcb->asoc.num_send_timers_up--;
 992                 if (stcb->asoc.num_send_timers_up < 0) {
 993                         stcb->asoc.num_send_timers_up = 0;
 994                 }
 995                 SCTP_TCB_LOCK_ASSERT(stcb);
 996                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 997                     stcb->asoc.deleted_primary);
 998                 if (error) {
 999                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1000                         return;
1001                 }
1002                 SCTP_TCB_LOCK_ASSERT(stcb);
1003 #ifdef SCTP_AUDITING_ENABLED
1004                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1005 #endif
1006                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1007                 if ((stcb->asoc.num_send_timers_up == 0) &&
1008                     (stcb->asoc.sent_queue_cnt > 0)) {
1009                         struct sctp_tmit_chunk *chk;
1010
1011                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1012                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1013                             stcb, chk->whoTo);
1014                 }
1015         }
1016         return;
1017 }
1018
1019 static int
1020     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1021
1022 void
1023 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1024 {
1025         struct sctp_tmit_chunk *chk;
1026
1027         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1028         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1029             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1030         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1031         net->error_count = 0;
1032         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1033                 if (chk->whoTo == net) {
1034                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1035                                 chk->sent = SCTP_DATAGRAM_RESEND;
1036                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1037                                 sctp_flight_size_decrease(chk);
1038                                 sctp_total_flight_decrease(stcb, chk);
1039                                 net->marked_retrans++;
1040                                 stcb->asoc.marked_retrans++;
1041                         }
1042                 }
1043         }
1044         if (net->marked_retrans) {
1045                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1046         }
1047 }
1048
1049 static void
1050 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1051 {
1052         struct sctp_nets *net;
1053         int addrnum, changed;
1054
1055         /*
1056          * If number of local valid addresses is 1, the valid address is
1057          * probably newly added address. Several valid addresses in this
1058          * association.  A source address may not be changed.  Additionally,
1059          * they can be configured on a same interface as "alias" addresses.
1060          * (by micchie)
1061          */
1062         addrnum = sctp_local_addr_count(stcb);
1063         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1064             addrnum);
1065         if (addrnum == 1) {
1066                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1067                         /* clear any cached route and source address */
1068                         if (net->ro.ro_rt) {
1069                                 RTFREE(net->ro.ro_rt);
1070                                 net->ro.ro_rt = NULL;
1071                         }
1072                         if (net->src_addr_selected) {
1073                                 sctp_free_ifa(net->ro._s_addr);
1074                                 net->ro._s_addr = NULL;
1075                                 net->src_addr_selected = 0;
1076                         }
1077                         /* Retransmit unacknowledged DATA chunks immediately */
1078                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1079                             SCTP_MOBILITY_FASTHANDOFF)) {
1080                                 sctp_net_immediate_retrans(stcb, net);
1081                         }
1082                         /* also, SET PRIMARY is maybe already sent */
1083                 }
1084                 return;
1085         }
1086
1087         /* Multiple local addresses exsist in the association.  */
1088         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1089                 /* clear any cached route and source address */
1090                 if (net->ro.ro_rt) {
1091                         RTFREE(net->ro.ro_rt);
1092                         net->ro.ro_rt = NULL;
1093                 }
1094                 if (net->src_addr_selected) {
1095                         sctp_free_ifa(net->ro._s_addr);
1096                         net->ro._s_addr = NULL;
1097                         net->src_addr_selected = 0;
1098                 }
1099                 /*
1100                  * Check if the nexthop is corresponding to the new address.
1101                  * If the new address is corresponding to the current
1102                  * nexthop, the path will be changed. If the new address is
1103                  * NOT corresponding to the current nexthop, the path will
1104                  * not be changed.
1105                  */
1106                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1107                     stcb->sctp_ep->def_vrf_id,
1108                     stcb->sctp_ep->fibnum);
1109                 if (net->ro.ro_rt == NULL)
1110                         continue;
1111
1112                 changed = 0;
1113                 switch (net->ro._l_addr.sa.sa_family) {
1114 #ifdef INET
1115                 case AF_INET:
1116                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1117                                 changed = 1;
1118                         }
1119                         break;
1120 #endif
1121 #ifdef INET6
1122                 case AF_INET6:
1123                         if (sctp_v6src_match_nexthop(
1124                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1125                                 changed = 1;
1126                         }
1127                         break;
1128 #endif
1129                 default:
1130                         break;
1131                 }
1132                 /*
1133                  * if the newly added address does not relate routing
1134                  * information, we skip.
1135                  */
1136                 if (changed == 0)
1137                         continue;
1138                 /* Retransmit unacknowledged DATA chunks immediately */
1139                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1140                     SCTP_MOBILITY_FASTHANDOFF)) {
1141                         sctp_net_immediate_retrans(stcb, net);
1142                 }
1143                 /* Send SET PRIMARY for this new address */
1144                 if (net == stcb->asoc.primary_destination) {
1145                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1146                             SCTP_SET_PRIM_ADDR);
1147                 }
1148         }
1149 }
1150
1151 /*
1152  * process an ADD/DELETE IP ack from peer.
1153  * addr: corresponding sctp_ifa to the address being added/deleted.
1154  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1155  * flag: 1=success, 0=failure.
1156  */
1157 static void
1158 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1159 {
1160         /*
1161          * do the necessary asoc list work- if we get a failure indication,
1162          * leave the address on the assoc's restricted list.  If we get a
1163          * success indication, remove the address from the restricted list.
1164          */
1165         /*
1166          * Note: this will only occur for ADD_IP_ADDRESS, since
1167          * DEL_IP_ADDRESS is never actually added to the list...
1168          */
1169         if (flag) {
1170                 /* success case, so remove from the restricted list */
1171                 sctp_del_local_addr_restricted(stcb, addr);
1172
1173                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1174                     SCTP_MOBILITY_BASE) ||
1175                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1176                     SCTP_MOBILITY_FASTHANDOFF)) {
1177                         sctp_path_check_and_react(stcb, addr);
1178                         return;
1179                 }
1180                 /* clear any cached/topologically incorrect source addresses */
1181                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1182         }
1183         /* else, leave it on the list */
1184 }
1185
1186 /*
1187  * add an asconf add/delete/set primary IP address parameter to the queue.
1188  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1189  * returns 0 if queued, -1 if not queued/removed.
1190  * NOTE: if adding, but a delete for the same address is already scheduled
1191  * (and not yet sent out), simply remove it from queue.  Same for deleting
1192  * an address already scheduled for add.  If a duplicate operation is found,
1193  * ignore the new one.
1194  */
1195 static int
1196 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1197     uint16_t type)
1198 {
1199         struct sctp_asconf_addr *aa, *aa_next;
1200
1201         /* make sure the request isn't already in the queue */
1202         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1203                 /* address match? */
1204                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1205                         continue;
1206                 /*
1207                  * is the request already in queue but not sent? pass the
1208                  * request already sent in order to resolve the following
1209                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1210                  * can't remove the ADD request already sent 3. arrival of
1211                  * ADD
1212                  */
1213                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1214                         return (-1);
1215                 }
1216                 /* is the negative request already in queue, and not sent */
1217                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1218                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1219                         /* add requested, delete already queued */
1220                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1221                         /* remove the ifa from the restricted list */
1222                         sctp_del_local_addr_restricted(stcb, ifa);
1223                         /* free the asconf param */
1224                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1225                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1226                         return (-1);
1227                 }
1228                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1229                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1230                         /* delete requested, add already queued */
1231                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1232                         /* remove the aa->ifa from the restricted list */
1233                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1234                         /* free the asconf param */
1235                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1236                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1237                         return (-1);
1238                 }
1239         }                       /* for each aa */
1240
1241         /* adding new request to the queue */
1242         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1243             SCTP_M_ASC_ADDR);
1244         if (aa == NULL) {
1245                 /* didn't get memory */
1246                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1247                 return (-1);
1248         }
1249         aa->special_del = 0;
1250         /* fill in asconf address parameter fields */
1251         /* top level elements are "networked" during send */
1252         aa->ap.aph.ph.param_type = type;
1253         aa->ifa = ifa;
1254         atomic_add_int(&ifa->refcount, 1);
1255         /* correlation_id filled in during send routine later... */
1256         switch (ifa->address.sa.sa_family) {
1257 #ifdef INET6
1258         case AF_INET6:
1259                 {
1260                         struct sockaddr_in6 *sin6;
1261
1262                         sin6 = &ifa->address.sin6;
1263                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1264                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1265                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1266                             sizeof(struct sctp_ipv6addr_param);
1267                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1268                             sizeof(struct in6_addr));
1269                         break;
1270                 }
1271 #endif
1272 #ifdef INET
1273         case AF_INET:
1274                 {
1275                         struct sockaddr_in *sin;
1276
1277                         sin = &ifa->address.sin;
1278                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1279                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1280                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1281                             sizeof(struct sctp_ipv4addr_param);
1282                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1283                             sizeof(struct in_addr));
1284                         break;
1285                 }
1286 #endif
1287         default:
1288                 /* invalid family! */
1289                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1290                 sctp_free_ifa(ifa);
1291                 return (-1);
1292         }
1293         aa->sent = 0;           /* clear sent flag */
1294
1295         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1296 #ifdef SCTP_DEBUG
1297         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1298                 if (type == SCTP_ADD_IP_ADDRESS) {
1299                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1300                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1301                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1302                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1303                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1304                 } else {
1305                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1306                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1307                 }
1308         }
1309 #endif
1310
1311         return (0);
1312 }
1313
1314
1315 /*
1316  * add an asconf operation for the given ifa and type.
1317  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1318  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1319  * advisable.
1320  */
1321 static int
1322 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1323     uint16_t type)
1324 {
1325         uint32_t status;
1326         int pending_delete_queued = 0;
1327         int last;
1328
1329         /* see if peer supports ASCONF */
1330         if (stcb->asoc.asconf_supported == 0) {
1331                 return (-1);
1332         }
1333
1334         /*
1335          * if this is deleting the last address from the assoc, mark it as
1336          * pending.
1337          */
1338         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1339                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1340                         last = (sctp_local_addr_count(stcb) == 0);
1341                 } else {
1342                         last = (sctp_local_addr_count(stcb) == 1);
1343                 }
1344                 if (last) {
1345                         /* set the pending delete info only */
1346                         stcb->asoc.asconf_del_pending = 1;
1347                         stcb->asoc.asconf_addr_del_pending = ifa;
1348                         atomic_add_int(&ifa->refcount, 1);
1349                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1350                             "asconf_queue_add: mark delete last address pending\n");
1351                         return (-1);
1352                 }
1353         }
1354
1355         /* queue an asconf parameter */
1356         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1357
1358         /*
1359          * if this is an add, and there is a delete also pending (i.e. the
1360          * last local address is being changed), queue the pending delete
1361          * too.
1362          */
1363         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1364                 /* queue in the pending delete */
1365                 if (sctp_asconf_queue_mgmt(stcb,
1366                     stcb->asoc.asconf_addr_del_pending,
1367                     SCTP_DEL_IP_ADDRESS) == 0) {
1368                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1369                         pending_delete_queued = 1;
1370                         /* clear out the pending delete info */
1371                         stcb->asoc.asconf_del_pending = 0;
1372                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1373                         stcb->asoc.asconf_addr_del_pending = NULL;
1374                 }
1375         }
1376
1377         if (pending_delete_queued) {
1378                 struct sctp_nets *net;
1379
1380                 /*
1381                  * since we know that the only/last address is now being
1382                  * changed in this case, reset the cwnd/rto on all nets to
1383                  * start as a new address and path.  Also clear the error
1384                  * counts to give the assoc the best chance to complete the
1385                  * address change.
1386                  */
1387                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1388                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1389                             net);
1390                         net->RTO = 0;
1391                         net->error_count = 0;
1392                 }
1393                 stcb->asoc.overall_error_count = 0;
1394                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1395                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1396                             stcb->asoc.overall_error_count,
1397                             0,
1398                             SCTP_FROM_SCTP_ASCONF,
1399                             __LINE__);
1400                 }
1401
1402                 /* queue in an advisory set primary too */
1403                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1404                 /* let caller know we should send this out immediately */
1405                 status = 1;
1406         }
1407         return (status);
1408 }
1409
1410 /*-
1411  * add an asconf delete IP address parameter to the queue by sockaddr and
1412  * possibly with no sctp_ifa available.  This is only called by the routine
1413  * that checks the addresses in an INIT-ACK against the current address list.
1414  * returns 0 if completed, non-zero if not completed.
1415  * NOTE: if an add is already scheduled (and not yet sent out), simply
1416  * remove it from queue.  If a duplicate operation is found, ignore the
1417  * new one.
1418  */
1419 static int
1420 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1421 {
1422         struct sctp_ifa *ifa;
1423         struct sctp_asconf_addr *aa, *aa_next;
1424
1425         if (stcb == NULL) {
1426                 return (-1);
1427         }
1428         /* see if peer supports ASCONF */
1429         if (stcb->asoc.asconf_supported == 0) {
1430                 return (-1);
1431         }
1432         /* make sure the request isn't already in the queue */
1433         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1434                 /* address match? */
1435                 if (sctp_asconf_addr_match(aa, sa) == 0)
1436                         continue;
1437                 /* is the request already in queue (sent or not) */
1438                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1439                         return (-1);
1440                 }
1441                 /* is the negative request already in queue, and not sent */
1442                 if (aa->sent == 1)
1443                         continue;
1444                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1445                         /* add already queued, so remove existing entry */
1446                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1447                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1448                         /* free the entry */
1449                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1450                         return (-1);
1451                 }
1452         }                       /* for each aa */
1453
1454         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1455         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1456
1457         /* adding new request to the queue */
1458         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1459             SCTP_M_ASC_ADDR);
1460         if (aa == NULL) {
1461                 /* didn't get memory */
1462                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1463                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1464                 return (-1);
1465         }
1466         aa->special_del = 0;
1467         /* fill in asconf address parameter fields */
1468         /* top level elements are "networked" during send */
1469         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1470         aa->ifa = ifa;
1471         if (ifa)
1472                 atomic_add_int(&ifa->refcount, 1);
1473         /* correlation_id filled in during send routine later... */
1474         switch (sa->sa_family) {
1475 #ifdef INET6
1476         case AF_INET6:
1477                 {
1478                         /* IPv6 address */
1479                         struct sockaddr_in6 *sin6;
1480
1481                         sin6 = (struct sockaddr_in6 *)sa;
1482                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1483                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1484                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1485                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1486                             sizeof(struct in6_addr));
1487                         break;
1488                 }
1489 #endif
1490 #ifdef INET
1491         case AF_INET:
1492                 {
1493                         /* IPv4 address */
1494                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1495
1496                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1497                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1498                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1499                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1500                             sizeof(struct in_addr));
1501                         break;
1502                 }
1503 #endif
1504         default:
1505                 /* invalid family! */
1506                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1507                 if (ifa)
1508                         sctp_free_ifa(ifa);
1509                 return (-1);
1510         }
1511         aa->sent = 0;           /* clear sent flag */
1512
1513         /* delete goes to the back of the queue */
1514         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1515
1516         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1517         return (0);
1518 }
1519
1520 /*
1521  * find a specific asconf param on our "sent" queue
1522  */
1523 static struct sctp_asconf_addr *
1524 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1525 {
1526         struct sctp_asconf_addr *aa;
1527
1528         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1529                 if (aa->ap.aph.correlation_id == correlation_id &&
1530                     aa->sent == 1) {
1531                         /* found it */
1532                         return (aa);
1533                 }
1534         }
1535         /* didn't find it */
1536         return (NULL);
1537 }
1538
1539 /*
1540  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1541  * notifications based on the error response
1542  */
1543 static void
1544 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1545     struct sctp_asconf_paramhdr *aph)
1546 {
1547         struct sctp_error_cause *eh;
1548         struct sctp_paramhdr *ph;
1549         uint16_t param_type;
1550         uint16_t error_code;
1551
1552         eh = (struct sctp_error_cause *)(aph + 1);
1553         ph = (struct sctp_paramhdr *)(eh + 1);
1554         /* validate lengths */
1555         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1556             htons(aph->ph.param_length)) {
1557                 /* invalid error cause length */
1558                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1559                     "asconf_process_error: cause element too long\n");
1560                 return;
1561         }
1562         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1563             htons(eh->length)) {
1564                 /* invalid included TLV length */
1565                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1566                     "asconf_process_error: included TLV too long\n");
1567                 return;
1568         }
1569         /* which error code ? */
1570         error_code = ntohs(eh->code);
1571         param_type = ntohs(aph->ph.param_type);
1572         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1573         switch (error_code) {
1574         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1575                 /* we allow ourselves to "try again" for this error */
1576                 break;
1577         default:
1578                 /* peer can't handle it... */
1579                 switch (param_type) {
1580                 case SCTP_ADD_IP_ADDRESS:
1581                 case SCTP_DEL_IP_ADDRESS:
1582                 case SCTP_SET_PRIM_ADDR:
1583                         break;
1584                 default:
1585                         break;
1586                 }
1587         }
1588 }
1589
1590 /*
1591  * process an asconf queue param.
1592  * aparam: parameter to process, will be removed from the queue.
1593  * flag: 1=success case, 0=failure case
1594  */
1595 static void
1596 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1597     struct sctp_asconf_addr *aparam, uint32_t flag)
1598 {
1599         uint16_t param_type;
1600
1601         /* process this param */
1602         param_type = aparam->ap.aph.ph.param_type;
1603         switch (param_type) {
1604         case SCTP_ADD_IP_ADDRESS:
1605                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1606                     "process_param_ack: added IP address\n");
1607                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1608                 break;
1609         case SCTP_DEL_IP_ADDRESS:
1610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1611                     "process_param_ack: deleted IP address\n");
1612                 /* nothing really to do... lists already updated */
1613                 break;
1614         case SCTP_SET_PRIM_ADDR:
1615                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1616                     "process_param_ack: set primary IP address\n");
1617                 /* nothing to do... peer may start using this addr */
1618                 break;
1619         default:
1620                 /* should NEVER happen */
1621                 break;
1622         }
1623
1624         /* remove the param and free it */
1625         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1626         if (aparam->ifa)
1627                 sctp_free_ifa(aparam->ifa);
1628         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1629 }
1630
1631 /*
1632  * cleanup from a bad asconf ack parameter
1633  */
1634 static void
1635 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1636 {
1637         /* assume peer doesn't really know how to do asconfs */
1638         /* XXX we could free the pending queue here */
1639
1640 }
1641
1642 void
1643 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1644     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1645     struct sctp_nets *net, int *abort_no_unlock)
1646 {
1647         struct sctp_association *asoc;
1648         uint32_t serial_num;
1649         uint16_t ack_length;
1650         struct sctp_asconf_paramhdr *aph;
1651         struct sctp_asconf_addr *aa, *aa_next;
1652         uint32_t last_error_id = 0;     /* last error correlation id */
1653         uint32_t id;
1654         struct sctp_asconf_addr *ap;
1655
1656         /* asconf param buffer */
1657         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1658
1659         /* verify minimum length */
1660         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1661                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1662                     "handle_asconf_ack: chunk too small = %xh\n",
1663                     ntohs(cp->ch.chunk_length));
1664                 return;
1665         }
1666         asoc = &stcb->asoc;
1667         serial_num = ntohl(cp->serial_number);
1668
1669         /*
1670          * NOTE: we may want to handle this differently- currently, we will
1671          * abort when we get an ack for the expected serial number + 1 (eg.
1672          * we didn't send it), process an ack normally if it is the expected
1673          * serial number, and re-send the previous ack for *ALL* other
1674          * serial numbers
1675          */
1676
1677         /*
1678          * if the serial number is the next expected, but I didn't send it,
1679          * abort the asoc, since someone probably just hijacked us...
1680          */
1681         if (serial_num == (asoc->asconf_seq_out + 1)) {
1682                 struct mbuf *op_err;
1683                 char msg[SCTP_DIAG_INFO_LEN];
1684
1685                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1686                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1687                     serial_num);
1688                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1689                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1690                 *abort_no_unlock = 1;
1691                 return;
1692         }
1693         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1694                 /* got a duplicate/unexpected ASCONF-ACK */
1695                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1696                     serial_num, asoc->asconf_seq_out_acked + 1);
1697                 return;
1698         }
1699
1700         if (serial_num == asoc->asconf_seq_out - 1) {
1701                 /* stop our timer */
1702                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1703                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1704         }
1705
1706         /* process the ASCONF-ACK contents */
1707         ack_length = ntohs(cp->ch.chunk_length) -
1708             sizeof(struct sctp_asconf_ack_chunk);
1709         offset += sizeof(struct sctp_asconf_ack_chunk);
1710         /* process through all parameters */
1711         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1712                 unsigned int param_length, param_type;
1713
1714                 /* get pointer to next asconf parameter */
1715                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1716                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1717                 if (aph == NULL) {
1718                         /* can't get an asconf paramhdr */
1719                         sctp_asconf_ack_clear(stcb);
1720                         return;
1721                 }
1722                 param_type = ntohs(aph->ph.param_type);
1723                 param_length = ntohs(aph->ph.param_length);
1724                 if (param_length > ack_length) {
1725                         sctp_asconf_ack_clear(stcb);
1726                         return;
1727                 }
1728                 if (param_length < sizeof(struct sctp_paramhdr)) {
1729                         sctp_asconf_ack_clear(stcb);
1730                         return;
1731                 }
1732                 /* get the complete parameter... */
1733                 if (param_length > sizeof(aparam_buf)) {
1734                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1735                             "param length (%u) larger than buffer size!\n", param_length);
1736                         sctp_asconf_ack_clear(stcb);
1737                         return;
1738                 }
1739                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1740                 if (aph == NULL) {
1741                         sctp_asconf_ack_clear(stcb);
1742                         return;
1743                 }
1744                 /* correlation_id is transparent to peer, no ntohl needed */
1745                 id = aph->correlation_id;
1746
1747                 switch (param_type) {
1748                 case SCTP_ERROR_CAUSE_IND:
1749                         last_error_id = id;
1750                         /* find the corresponding asconf param in our queue */
1751                         ap = sctp_asconf_find_param(stcb, id);
1752                         if (ap == NULL) {
1753                                 /* hmm... can't find this in our queue! */
1754                                 break;
1755                         }
1756                         /* process the parameter, failed flag */
1757                         sctp_asconf_process_param_ack(stcb, ap, 0);
1758                         /* process the error response */
1759                         sctp_asconf_process_error(stcb, aph);
1760                         break;
1761                 case SCTP_SUCCESS_REPORT:
1762                         /* find the corresponding asconf param in our queue */
1763                         ap = sctp_asconf_find_param(stcb, id);
1764                         if (ap == NULL) {
1765                                 /* hmm... can't find this in our queue! */
1766                                 break;
1767                         }
1768                         /* process the parameter, success flag */
1769                         sctp_asconf_process_param_ack(stcb, ap, 1);
1770                         break;
1771                 default:
1772                         break;
1773                 }               /* switch */
1774
1775                 /* update remaining ASCONF-ACK message length to process */
1776                 ack_length -= SCTP_SIZE32(param_length);
1777                 if (ack_length <= 0) {
1778                         /* no more data in the mbuf chain */
1779                         break;
1780                 }
1781                 offset += SCTP_SIZE32(param_length);
1782         }                       /* while */
1783
1784         /*
1785          * if there are any "sent" params still on the queue, these are
1786          * implicitly "success", or "failed" (if we got an error back) ...
1787          * so process these appropriately
1788          *
1789          * we assume that the correlation_id's are monotonically increasing
1790          * beginning from 1 and that we don't have *that* many outstanding
1791          * at any given time
1792          */
1793         if (last_error_id == 0)
1794                 last_error_id--;        /* set to "max" value */
1795         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1796                 if (aa->sent == 1) {
1797                         /*
1798                          * implicitly successful or failed if correlation_id
1799                          * < last_error_id, then success else, failure
1800                          */
1801                         if (aa->ap.aph.correlation_id < last_error_id)
1802                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1803                         else
1804                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1805                 } else {
1806                         /*
1807                          * since we always process in order (FIFO queue) if
1808                          * we reach one that hasn't been sent, the rest
1809                          * should not have been sent either. so, we're
1810                          * done...
1811                          */
1812                         break;
1813                 }
1814         }
1815
1816         /* update the next sequence number to use */
1817         asoc->asconf_seq_out_acked++;
1818         /* remove the old ASCONF on our outbound queue */
1819         sctp_toss_old_asconf(stcb);
1820         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1821 #ifdef SCTP_TIMER_BASED_ASCONF
1822                 /* we have more params, so restart our timer */
1823                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1824                     stcb, net);
1825 #else
1826                 /* we have more params, so send out more */
1827                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1828 #endif
1829         }
1830 }
1831
1832 #ifdef INET6
1833 static uint32_t
1834 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1835 {
1836         struct sockaddr_in6 *sin6, *net6;
1837         struct sctp_nets *net;
1838
1839         if (sa->sa_family != AF_INET6) {
1840                 /* wrong family */
1841                 return (0);
1842         }
1843         sin6 = (struct sockaddr_in6 *)sa;
1844         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1845                 /* not link local address */
1846                 return (0);
1847         }
1848         /* hunt through our destination nets list for this scope_id */
1849         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1850                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1851                     AF_INET6)
1852                         continue;
1853                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1854                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1855                         continue;
1856                 if (sctp_is_same_scope(sin6, net6)) {
1857                         /* found one */
1858                         return (1);
1859                 }
1860         }
1861         /* didn't find one */
1862         return (0);
1863 }
1864 #endif
1865
1866 /*
1867  * address management functions
1868  */
1869 static void
1870 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1871     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1872 {
1873         int status;
1874
1875         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1876             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1877                 /* subset bound, no ASCONF allowed case, so ignore */
1878                 return;
1879         }
1880         /*
1881          * note: we know this is not the subset bound, no ASCONF case eg.
1882          * this is boundall or subset bound w/ASCONF allowed
1883          */
1884
1885         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1886         switch (ifa->address.sa.sa_family) {
1887 #ifdef INET6
1888         case AF_INET6:
1889                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1890                     &ifa->address.sin6.sin6_addr) != 0) {
1891                         return;
1892                 }
1893                 break;
1894 #endif
1895 #ifdef INET
1896         case AF_INET:
1897                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1898                     &ifa->address.sin.sin_addr) != 0) {
1899                         return;
1900                 }
1901                 break;
1902 #endif
1903         default:
1904                 return;
1905         }
1906 #ifdef INET6
1907         /* make sure we're "allowed" to add this type of addr */
1908         if (ifa->address.sa.sa_family == AF_INET6) {
1909                 /* invalid if we're not a v6 endpoint */
1910                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1911                         return;
1912                 /* is the v6 addr really valid ? */
1913                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1914                         return;
1915                 }
1916         }
1917 #endif
1918         /* put this address on the "pending/do not use yet" list */
1919         sctp_add_local_addr_restricted(stcb, ifa);
1920         /*
1921          * check address scope if address is out of scope, don't queue
1922          * anything... note: this would leave the address on both inp and
1923          * asoc lists
1924          */
1925         switch (ifa->address.sa.sa_family) {
1926 #ifdef INET6
1927         case AF_INET6:
1928                 {
1929                         struct sockaddr_in6 *sin6;
1930
1931                         sin6 = &ifa->address.sin6;
1932                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1933                                 /* we skip unspecifed addresses */
1934                                 return;
1935                         }
1936                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1937                                 if (stcb->asoc.scope.local_scope == 0) {
1938                                         return;
1939                                 }
1940                                 /* is it the right link local scope? */
1941                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1942                                         return;
1943                                 }
1944                         }
1945                         if (stcb->asoc.scope.site_scope == 0 &&
1946                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1947                                 return;
1948                         }
1949                         break;
1950                 }
1951 #endif
1952 #ifdef INET
1953         case AF_INET:
1954                 {
1955                         struct sockaddr_in *sin;
1956                         struct in6pcb *inp6;
1957
1958                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1959                         /* invalid if we are a v6 only endpoint */
1960                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1961                             SCTP_IPV6_V6ONLY(inp6))
1962                                 return;
1963
1964                         sin = &ifa->address.sin;
1965                         if (sin->sin_addr.s_addr == 0) {
1966                                 /* we skip unspecifed addresses */
1967                                 return;
1968                         }
1969                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1970                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1971                                 return;
1972                         }
1973                         break;
1974                 }
1975 #endif
1976         default:
1977                 /* else, not AF_INET or AF_INET6, so skip */
1978                 return;
1979         }
1980
1981         /* queue an asconf for this address add/delete */
1982         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1983                 /* does the peer do asconf? */
1984                 if (stcb->asoc.asconf_supported) {
1985                         /* queue an asconf for this addr */
1986                         status = sctp_asconf_queue_add(stcb, ifa, type);
1987
1988                         /*
1989                          * if queued ok, and in the open state, send out the
1990                          * ASCONF.  If in the non-open state, these will be
1991                          * sent when the state goes open.
1992                          */
1993                         if (status == 0 &&
1994                             ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
1995                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1996 #ifdef SCTP_TIMER_BASED_ASCONF
1997                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1998                                     stcb, stcb->asoc.primary_destination);
1999 #else
2000                                 sctp_send_asconf(stcb, NULL, addr_locked);
2001 #endif
2002                         }
2003                 }
2004         }
2005 }
2006
2007
2008 int
2009 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2010 {
2011         struct sctp_asconf_iterator *asc;
2012         struct sctp_ifa *ifa;
2013         struct sctp_laddr *l;
2014         int cnt_invalid = 0;
2015
2016         asc = (struct sctp_asconf_iterator *)ptr;
2017         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2018                 ifa = l->ifa;
2019                 switch (ifa->address.sa.sa_family) {
2020 #ifdef INET6
2021                 case AF_INET6:
2022                         /* invalid if we're not a v6 endpoint */
2023                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2024                                 cnt_invalid++;
2025                                 if (asc->cnt == cnt_invalid)
2026                                         return (1);
2027                         }
2028                         break;
2029 #endif
2030 #ifdef INET
2031                 case AF_INET:
2032                         {
2033                                 /* invalid if we are a v6 only endpoint */
2034                                 struct in6pcb *inp6;
2035
2036                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2037                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2038                                     SCTP_IPV6_V6ONLY(inp6)) {
2039                                         cnt_invalid++;
2040                                         if (asc->cnt == cnt_invalid)
2041                                                 return (1);
2042                                 }
2043                                 break;
2044                         }
2045 #endif
2046                 default:
2047                         /* invalid address family */
2048                         cnt_invalid++;
2049                         if (asc->cnt == cnt_invalid)
2050                                 return (1);
2051                 }
2052         }
2053         return (0);
2054 }
2055
2056 static int
2057 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2058 {
2059         struct sctp_ifa *ifa;
2060         struct sctp_asconf_iterator *asc;
2061         struct sctp_laddr *laddr, *nladdr, *l;
2062
2063         /* Only for specific case not bound all */
2064         asc = (struct sctp_asconf_iterator *)ptr;
2065         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2066                 ifa = l->ifa;
2067                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2068                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2069                             sctp_nxt_addr) {
2070                                 if (laddr->ifa == ifa) {
2071                                         laddr->action = 0;
2072                                         break;
2073                                 }
2074
2075                         }
2076                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2077                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2078                                 /* remove only after all guys are done */
2079                                 if (laddr->ifa == ifa) {
2080                                         sctp_del_local_addr_ep(inp, ifa);
2081                                 }
2082                         }
2083                 }
2084         }
2085         return (0);
2086 }
2087
2088 void
2089 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2090     void *ptr, uint32_t val SCTP_UNUSED)
2091 {
2092         struct sctp_asconf_iterator *asc;
2093         struct sctp_ifa *ifa;
2094         struct sctp_laddr *l;
2095         int cnt_invalid = 0;
2096         int type, status;
2097         int num_queued = 0;
2098
2099         asc = (struct sctp_asconf_iterator *)ptr;
2100         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2101                 ifa = l->ifa;
2102                 type = l->action;
2103
2104                 /* address's vrf_id must be the vrf_id of the assoc */
2105                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2106                         continue;
2107                 }
2108
2109                 /* Same checks again for assoc */
2110                 switch (ifa->address.sa.sa_family) {
2111 #ifdef INET6
2112                 case AF_INET6:
2113                         {
2114                                 /* invalid if we're not a v6 endpoint */
2115                                 struct sockaddr_in6 *sin6;
2116
2117                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2118                                         cnt_invalid++;
2119                                         if (asc->cnt == cnt_invalid)
2120                                                 return;
2121                                         else
2122                                                 continue;
2123                                 }
2124                                 sin6 = &ifa->address.sin6;
2125                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2126                                         /* we skip unspecifed addresses */
2127                                         continue;
2128                                 }
2129                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2130                                     &sin6->sin6_addr) != 0) {
2131                                         continue;
2132                                 }
2133                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2134                                         if (stcb->asoc.scope.local_scope == 0) {
2135                                                 continue;
2136                                         }
2137                                         /* is it the right link local scope? */
2138                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2139                                                 continue;
2140                                         }
2141                                 }
2142                                 break;
2143                         }
2144 #endif
2145 #ifdef INET
2146                 case AF_INET:
2147                         {
2148                                 /* invalid if we are a v6 only endpoint */
2149                                 struct in6pcb *inp6;
2150                                 struct sockaddr_in *sin;
2151
2152                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2153                                 /* invalid if we are a v6 only endpoint */
2154                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2155                                     SCTP_IPV6_V6ONLY(inp6))
2156                                         continue;
2157
2158                                 sin = &ifa->address.sin;
2159                                 if (sin->sin_addr.s_addr == 0) {
2160                                         /* we skip unspecifed addresses */
2161                                         continue;
2162                                 }
2163                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2164                                     &sin->sin_addr) != 0) {
2165                                         continue;
2166                                 }
2167                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2168                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2169                                         continue;
2170                                 }
2171                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2172                                     SCTP_IPV6_V6ONLY(inp6)) {
2173                                         cnt_invalid++;
2174                                         if (asc->cnt == cnt_invalid)
2175                                                 return;
2176                                         else
2177                                                 continue;
2178                                 }
2179                                 break;
2180                         }
2181 #endif
2182                 default:
2183                         /* invalid address family */
2184                         cnt_invalid++;
2185                         if (asc->cnt == cnt_invalid)
2186                                 return;
2187                         else
2188                                 continue;
2189                         break;
2190                 }
2191
2192                 if (type == SCTP_ADD_IP_ADDRESS) {
2193                         /* prevent this address from being used as a source */
2194                         sctp_add_local_addr_restricted(stcb, ifa);
2195                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2196                         struct sctp_nets *net;
2197
2198                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2199                                 sctp_rtentry_t *rt;
2200
2201                                 /* delete this address if cached */
2202                                 if (net->ro._s_addr == ifa) {
2203                                         sctp_free_ifa(net->ro._s_addr);
2204                                         net->ro._s_addr = NULL;
2205                                         net->src_addr_selected = 0;
2206                                         rt = net->ro.ro_rt;
2207                                         if (rt) {
2208                                                 RTFREE(rt);
2209                                                 net->ro.ro_rt = NULL;
2210                                         }
2211                                         /*
2212                                          * Now we deleted our src address,
2213                                          * should we not also now reset the
2214                                          * cwnd/rto to start as if its a new
2215                                          * address?
2216                                          */
2217                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2218                                         net->RTO = 0;
2219
2220                                 }
2221                         }
2222                 } else if (type == SCTP_SET_PRIM_ADDR) {
2223                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2224                                 /* must validate the ifa is in the ep */
2225                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2226                                         continue;
2227                                 }
2228                         } else {
2229                                 /* Need to check scopes for this guy */
2230                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2231                                         continue;
2232                                 }
2233                         }
2234                 }
2235                 /* queue an asconf for this address add/delete */
2236                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2237                     stcb->asoc.asconf_supported == 1) {
2238                         /* queue an asconf for this addr */
2239                         status = sctp_asconf_queue_add(stcb, ifa, type);
2240                         /*
2241                          * if queued ok, and in the open state, update the
2242                          * count of queued params.  If in the non-open
2243                          * state, these get sent when the assoc goes open.
2244                          */
2245                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2246                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2247                                 if (status >= 0) {
2248                                         num_queued++;
2249                                 }
2250                         }
2251                 }
2252         }
2253         /*
2254          * If we have queued params in the open state, send out an ASCONF.
2255          */
2256         if (num_queued > 0) {
2257                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2258         }
2259 }
2260
2261 void
2262 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2263 {
2264         struct sctp_asconf_iterator *asc;
2265         struct sctp_ifa *ifa;
2266         struct sctp_laddr *l, *nl;
2267
2268         asc = (struct sctp_asconf_iterator *)ptr;
2269         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2270                 ifa = l->ifa;
2271                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2272                         /* Clear the defer use flag */
2273                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2274                 }
2275                 sctp_free_ifa(ifa);
2276                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2277                 SCTP_DECR_LADDR_COUNT();
2278         }
2279         SCTP_FREE(asc, SCTP_M_ASC_IT);
2280 }
2281
2282 /*
2283  * sa is the sockaddr to ask the peer to set primary to.
2284  * returns: 0 = completed, -1 = error
2285  */
2286 int32_t
2287 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2288 {
2289         uint32_t vrf_id;
2290         struct sctp_ifa *ifa;
2291
2292         /* find the ifa for the desired set primary */
2293         vrf_id = stcb->asoc.vrf_id;
2294         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2295         if (ifa == NULL) {
2296                 /* Invalid address */
2297                 return (-1);
2298         }
2299
2300         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2301         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2302                 /* set primary queuing succeeded */
2303                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2304                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2305                     (void *)stcb);
2306                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2307                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2308                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2309 #ifdef SCTP_TIMER_BASED_ASCONF
2310                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2311                             stcb->sctp_ep, stcb,
2312                             stcb->asoc.primary_destination);
2313 #else
2314                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2315 #endif
2316                 }
2317         } else {
2318                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2319                     (void *)stcb);
2320                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2321                 return (-1);
2322         }
2323         return (0);
2324 }
2325
2326 int
2327 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2328 {
2329         struct sctp_tmit_chunk *chk, *nchk;
2330         unsigned int offset, asconf_limit;
2331         struct sctp_asconf_chunk *acp;
2332         struct sctp_asconf_paramhdr *aph;
2333         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2334         struct sctp_paramhdr *ph;
2335         int add_cnt, del_cnt;
2336         uint16_t last_param_type;
2337
2338         add_cnt = del_cnt = 0;
2339         last_param_type = 0;
2340         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2341                 if (chk->data == NULL) {
2342                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2343                         continue;
2344                 }
2345                 offset = 0;
2346                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2347                 offset += sizeof(struct sctp_asconf_chunk);
2348                 asconf_limit = ntohs(acp->ch.chunk_length);
2349                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2350                 if (ph == NULL) {
2351                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2352                         continue;
2353                 }
2354                 offset += ntohs(ph->param_length);
2355
2356                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2357                 if (aph == NULL) {
2358                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2359                         continue;
2360                 }
2361                 while (aph != NULL) {
2362                         unsigned int param_length, param_type;
2363
2364                         param_type = ntohs(aph->ph.param_type);
2365                         param_length = ntohs(aph->ph.param_length);
2366                         if (offset + param_length > asconf_limit) {
2367                                 /* parameter goes beyond end of chunk! */
2368                                 break;
2369                         }
2370                         if (param_length > sizeof(aparam_buf)) {
2371                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2372                                 break;
2373                         }
2374                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2375                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2376                                 break;
2377                         }
2378
2379                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2380                         if (aph == NULL) {
2381                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2382                                 break;
2383                         }
2384
2385                         ph = (struct sctp_paramhdr *)(aph + 1);
2386                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2387                                 switch (param_type) {
2388                                 case SCTP_ADD_IP_ADDRESS:
2389                                         add_cnt++;
2390                                         break;
2391                                 case SCTP_DEL_IP_ADDRESS:
2392                                         del_cnt++;
2393                                         break;
2394                                 default:
2395                                         break;
2396                                 }
2397                                 last_param_type = param_type;
2398                         }
2399
2400                         offset += SCTP_SIZE32(param_length);
2401                         if (offset >= asconf_limit) {
2402                                 /* no more data in the mbuf chain */
2403                                 break;
2404                         }
2405                         /* get pointer to next asconf param */
2406                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2407                 }
2408         }
2409
2410         /*
2411          * we want to find the sequences which consist of ADD -> DEL -> ADD
2412          * or DEL -> ADD
2413          */
2414         if (add_cnt > del_cnt ||
2415             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2416                 return (1);
2417         }
2418         return (0);
2419 }
2420
2421 static struct sockaddr *
2422 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2423 {
2424         struct sctp_vrf *vrf = NULL;
2425         struct sctp_ifn *sctp_ifn;
2426         struct sctp_ifa *sctp_ifa;
2427
2428         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2429                 SCTP_IPI_ADDR_RLOCK();
2430         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2431         if (vrf == NULL) {
2432                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2433                         SCTP_IPI_ADDR_RUNLOCK();
2434                 return (NULL);
2435         }
2436         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2437                 if (stcb->asoc.scope.loopback_scope == 0 &&
2438                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2439                         /* Skip if loopback_scope not set */
2440                         continue;
2441                 }
2442                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2443                         switch (sctp_ifa->address.sa.sa_family) {
2444 #ifdef INET
2445                         case AF_INET:
2446                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2447                                         struct sockaddr_in *sin;
2448
2449                                         sin = &sctp_ifa->address.sin;
2450                                         if (sin->sin_addr.s_addr == 0) {
2451                                                 /* skip unspecifed addresses */
2452                                                 continue;
2453                                         }
2454                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2455                                             &sin->sin_addr) != 0) {
2456                                                 continue;
2457                                         }
2458                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2459                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2460                                                 continue;
2461
2462                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2463                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2464                                                 continue;
2465                                         /*
2466                                          * found a valid local v4 address to
2467                                          * use
2468                                          */
2469                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2470                                                 SCTP_IPI_ADDR_RUNLOCK();
2471                                         return (&sctp_ifa->address.sa);
2472                                 }
2473                                 break;
2474 #endif
2475 #ifdef INET6
2476                         case AF_INET6:
2477                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2478                                         struct sockaddr_in6 *sin6;
2479
2480                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2481                                                 continue;
2482                                         }
2483
2484                                         sin6 = &sctp_ifa->address.sin6;
2485                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2486                                                 /*
2487                                                  * we skip unspecifed
2488                                                  * addresses
2489                                                  */
2490                                                 continue;
2491                                         }
2492                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2493                                             &sin6->sin6_addr) != 0) {
2494                                                 continue;
2495                                         }
2496                                         if (stcb->asoc.scope.local_scope == 0 &&
2497                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2498                                                 continue;
2499                                         if (stcb->asoc.scope.site_scope == 0 &&
2500                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2501                                                 continue;
2502
2503                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2504                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2505                                                 continue;
2506                                         /*
2507                                          * found a valid local v6 address to
2508                                          * use
2509                                          */
2510                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2511                                                 SCTP_IPI_ADDR_RUNLOCK();
2512                                         return (&sctp_ifa->address.sa);
2513                                 }
2514                                 break;
2515 #endif
2516                         default:
2517                                 break;
2518                         }
2519                 }
2520         }
2521         /* no valid addresses found */
2522         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2523                 SCTP_IPI_ADDR_RUNLOCK();
2524         return (NULL);
2525 }
2526
2527 static struct sockaddr *
2528 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2529 {
2530         struct sctp_laddr *laddr;
2531
2532         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2533                 if (laddr->ifa == NULL) {
2534                         continue;
2535                 }
2536                 /* is the address restricted ? */
2537                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2538                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2539                         continue;
2540
2541                 /* found a valid local address to use */
2542                 return (&laddr->ifa->address.sa);
2543         }
2544         /* no valid addresses found */
2545         return (NULL);
2546 }
2547
2548 /*
2549  * builds an ASCONF chunk from queued ASCONF params.
2550  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2551  */
2552 struct mbuf *
2553 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2554 {
2555         struct mbuf *m_asconf, *m_asconf_chk;
2556         struct sctp_asconf_addr *aa;
2557         struct sctp_asconf_chunk *acp;
2558         struct sctp_asconf_paramhdr *aph;
2559         struct sctp_asconf_addr_param *aap;
2560         uint32_t p_length;
2561         uint32_t correlation_id = 1;    /* 0 is reserved... */
2562         caddr_t ptr, lookup_ptr;
2563         uint8_t lookup_used = 0;
2564
2565         /* are there any asconf params to send? */
2566         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2567                 if (aa->sent == 0)
2568                         break;
2569         }
2570         if (aa == NULL)
2571                 return (NULL);
2572
2573         /*
2574          * get a chunk header mbuf and a cluster for the asconf params since
2575          * it's simpler to fill in the asconf chunk header lookup address on
2576          * the fly
2577          */
2578         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2579         if (m_asconf_chk == NULL) {
2580                 /* no mbuf's */
2581                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2582                     "compose_asconf: couldn't get chunk mbuf!\n");
2583                 return (NULL);
2584         }
2585         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2586         if (m_asconf == NULL) {
2587                 /* no mbuf's */
2588                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2589                     "compose_asconf: couldn't get mbuf!\n");
2590                 sctp_m_freem(m_asconf_chk);
2591                 return (NULL);
2592         }
2593         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2594         SCTP_BUF_LEN(m_asconf) = 0;
2595         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2596         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2597         /* save pointers to lookup address and asconf params */
2598         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2599         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2600
2601         /* fill in chunk header info */
2602         acp->ch.chunk_type = SCTP_ASCONF;
2603         acp->ch.chunk_flags = 0;
2604         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2605         stcb->asoc.asconf_seq_out++;
2606
2607         /* add parameters... up to smallest MTU allowed */
2608         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2609                 if (aa->sent)
2610                         continue;
2611                 /* get the parameter length */
2612                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2613                 /* will it fit in current chunk? */
2614                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2615                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2616                         /* won't fit, so we're done with this chunk */
2617                         break;
2618                 }
2619                 /* assign (and store) a correlation id */
2620                 aa->ap.aph.correlation_id = correlation_id++;
2621
2622                 /*
2623                  * fill in address if we're doing a delete this is a simple
2624                  * way for us to fill in the correlation address, which
2625                  * should only be used by the peer if we're deleting our
2626                  * source address and adding a new address (e.g. renumbering
2627                  * case)
2628                  */
2629                 if (lookup_used == 0 &&
2630                     (aa->special_del == 0) &&
2631                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2632                         struct sctp_ipv6addr_param *lookup;
2633                         uint16_t p_size, addr_size;
2634
2635                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2636                         lookup->ph.param_type =
2637                             htons(aa->ap.addrp.ph.param_type);
2638                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2639                                 /* copy IPv6 address */
2640                                 p_size = sizeof(struct sctp_ipv6addr_param);
2641                                 addr_size = sizeof(struct in6_addr);
2642                         } else {
2643                                 /* copy IPv4 address */
2644                                 p_size = sizeof(struct sctp_ipv4addr_param);
2645                                 addr_size = sizeof(struct in_addr);
2646                         }
2647                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2648                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2649                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2650                         lookup_used = 1;
2651                 }
2652                 /* copy into current space */
2653                 memcpy(ptr, &aa->ap, p_length);
2654
2655                 /* network elements and update lengths */
2656                 aph = (struct sctp_asconf_paramhdr *)ptr;
2657                 aap = (struct sctp_asconf_addr_param *)ptr;
2658                 /* correlation_id is transparent to peer, no htonl needed */
2659                 aph->ph.param_type = htons(aph->ph.param_type);
2660                 aph->ph.param_length = htons(aph->ph.param_length);
2661                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2662                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2663
2664                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2665                 ptr += SCTP_SIZE32(p_length);
2666
2667                 /*
2668                  * these params are removed off the pending list upon
2669                  * getting an ASCONF-ACK back from the peer, just set flag
2670                  */
2671                 aa->sent = 1;
2672         }
2673         /* check to see if the lookup addr has been populated yet */
2674         if (lookup_used == 0) {
2675                 /* NOTE: if the address param is optional, can skip this... */
2676                 /* add any valid (existing) address... */
2677                 struct sctp_ipv6addr_param *lookup;
2678                 uint16_t p_size, addr_size;
2679                 struct sockaddr *found_addr;
2680                 caddr_t addr_ptr;
2681
2682                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2683                         found_addr = sctp_find_valid_localaddr(stcb,
2684                             addr_locked);
2685                 else
2686                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2687
2688                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2689                 if (found_addr != NULL) {
2690                         switch (found_addr->sa_family) {
2691 #ifdef INET6
2692                         case AF_INET6:
2693                                 /* copy IPv6 address */
2694                                 lookup->ph.param_type =
2695                                     htons(SCTP_IPV6_ADDRESS);
2696                                 p_size = sizeof(struct sctp_ipv6addr_param);
2697                                 addr_size = sizeof(struct in6_addr);
2698                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2699                                     found_addr)->sin6_addr;
2700                                 break;
2701 #endif
2702 #ifdef INET
2703                         case AF_INET:
2704                                 /* copy IPv4 address */
2705                                 lookup->ph.param_type =
2706                                     htons(SCTP_IPV4_ADDRESS);
2707                                 p_size = sizeof(struct sctp_ipv4addr_param);
2708                                 addr_size = sizeof(struct in_addr);
2709                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2710                                     found_addr)->sin_addr;
2711                                 break;
2712 #endif
2713                         default:
2714                                 p_size = 0;
2715                                 addr_size = 0;
2716                                 addr_ptr = NULL;
2717                                 break;
2718                         }
2719                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2720                         memcpy(lookup->addr, addr_ptr, addr_size);
2721                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2722                 } else {
2723                         /* uh oh... don't have any address?? */
2724                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2725                             "compose_asconf: no lookup addr!\n");
2726                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2727                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2728                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2729                         memset(lookup->addr, 0, sizeof(struct in_addr));
2730                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2731                 }
2732         }
2733         /* chain it all together */
2734         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2735         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2736         acp->ch.chunk_length = htons(*retlen);
2737
2738         return (m_asconf_chk);
2739 }
2740
2741 /*
2742  * section to handle address changes before an association is up eg. changes
2743  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2744  */
2745
2746 /*
2747  * processes the (local) addresses in the INIT-ACK chunk
2748  */
2749 static void
2750 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2751     unsigned int offset, unsigned int length)
2752 {
2753         struct sctp_paramhdr tmp_param, *ph;
2754         uint16_t plen, ptype;
2755         struct sctp_ifa *sctp_ifa;
2756         union sctp_sockstore store;
2757 #ifdef INET6
2758         struct sctp_ipv6addr_param addr6_store;
2759 #endif
2760 #ifdef INET
2761         struct sctp_ipv4addr_param addr4_store;
2762 #endif
2763
2764         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2765         if (stcb == NULL)       /* Un-needed check for SA */
2766                 return;
2767
2768         /* convert to upper bound */
2769         length += offset;
2770
2771         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2772                 return;
2773         }
2774         /* go through the addresses in the init-ack */
2775         ph = (struct sctp_paramhdr *)
2776             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2777             (uint8_t *)&tmp_param);
2778         while (ph != NULL) {
2779                 ptype = ntohs(ph->param_type);
2780                 plen = ntohs(ph->param_length);
2781                 switch (ptype) {
2782 #ifdef INET6
2783                 case SCTP_IPV6_ADDRESS:
2784                         {
2785                                 struct sctp_ipv6addr_param *a6p;
2786
2787                                 /* get the entire IPv6 address param */
2788                                 a6p = (struct sctp_ipv6addr_param *)
2789                                     sctp_m_getptr(m, offset,
2790                                     sizeof(struct sctp_ipv6addr_param),
2791                                     (uint8_t *)&addr6_store);
2792                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2793                                     a6p == NULL) {
2794                                         return;
2795                                 }
2796                                 memset(&store, 0, sizeof(union sctp_sockstore));
2797                                 store.sin6.sin6_family = AF_INET6;
2798                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2799                                 store.sin6.sin6_port = stcb->rport;
2800                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2801                                 break;
2802                         }
2803 #endif
2804 #ifdef INET
2805                 case SCTP_IPV4_ADDRESS:
2806                         {
2807                                 struct sctp_ipv4addr_param *a4p;
2808
2809                                 /* get the entire IPv4 address param */
2810                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2811                                     sizeof(struct sctp_ipv4addr_param),
2812                                     (uint8_t *)&addr4_store);
2813                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2814                                     a4p == NULL) {
2815                                         return;
2816                                 }
2817                                 memset(&store, 0, sizeof(union sctp_sockstore));
2818                                 store.sin.sin_family = AF_INET;
2819                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2820                                 store.sin.sin_port = stcb->rport;
2821                                 store.sin.sin_addr.s_addr = a4p->addr;
2822                                 break;
2823                         }
2824 #endif
2825                 default:
2826                         goto next_addr;
2827                 }
2828
2829                 /* see if this address really (still) exists */
2830                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2831                     SCTP_ADDR_NOT_LOCKED);
2832                 if (sctp_ifa == NULL) {
2833                         /* address doesn't exist anymore */
2834                         int status;
2835
2836                         /* are ASCONFs allowed ? */
2837                         if ((sctp_is_feature_on(stcb->sctp_ep,
2838                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2839                             stcb->asoc.asconf_supported) {
2840                                 /* queue an ASCONF DEL_IP_ADDRESS */
2841                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2842                                 /*
2843                                  * if queued ok, and in correct state, send
2844                                  * out the ASCONF.
2845                                  */
2846                                 if (status == 0 &&
2847                                     SCTP_GET_STATE(&stcb->asoc) ==
2848                                     SCTP_STATE_OPEN) {
2849 #ifdef SCTP_TIMER_BASED_ASCONF
2850                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2851                                             stcb->sctp_ep, stcb,
2852                                             stcb->asoc.primary_destination);
2853 #else
2854                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2855 #endif
2856                                 }
2857                         }
2858                 }
2859
2860 next_addr:
2861                 /*
2862                  * Sanity check:  Make sure the length isn't 0, otherwise
2863                  * we'll be stuck in this loop for a long time...
2864                  */
2865                 if (SCTP_SIZE32(plen) == 0) {
2866                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2867                             plen, ptype);
2868                         return;
2869                 }
2870                 /* get next parameter */
2871                 offset += SCTP_SIZE32(plen);
2872                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2873                         return;
2874                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2875                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2876         }                       /* while */
2877 }
2878
2879 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2880 /*
2881  * checks to see if a specific address is in the initack address list returns
2882  * 1 if found, 0 if not
2883  */
2884 static uint32_t
2885 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2886 {
2887         struct sctp_paramhdr tmp_param, *ph;
2888         uint16_t plen, ptype;
2889 #ifdef INET
2890         struct sockaddr_in *sin;
2891         struct sctp_ipv4addr_param *a4p;
2892         struct sctp_ipv6addr_param addr4_store;
2893 #endif
2894 #ifdef INET6
2895         struct sockaddr_in6 *sin6;
2896         struct sctp_ipv6addr_param *a6p;
2897         struct sctp_ipv6addr_param addr6_store;
2898         struct sockaddr_in6 sin6_tmp;
2899 #endif
2900
2901         switch (sa->sa_family) {
2902 #ifdef INET
2903         case AF_INET:
2904                 break;
2905 #endif
2906 #ifdef INET6
2907         case AF_INET6:
2908                 break;
2909 #endif
2910         default:
2911                 return (0);
2912         }
2913
2914         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2915         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2916         /* convert to upper bound */
2917         length += offset;
2918
2919         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2920                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2921                     "find_initack_addr: invalid offset?\n");
2922                 return (0);
2923         }
2924         /* go through the addresses in the init-ack */
2925         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2926             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2927         while (ph != NULL) {
2928                 ptype = ntohs(ph->param_type);
2929                 plen = ntohs(ph->param_length);
2930                 switch (ptype) {
2931 #ifdef INET6
2932                 case SCTP_IPV6_ADDRESS:
2933                         if (sa->sa_family == AF_INET6) {
2934                                 /* get the entire IPv6 address param */
2935                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2936                                         break;
2937                                 }
2938                                 /* get the entire IPv6 address param */
2939                                 a6p = (struct sctp_ipv6addr_param *)
2940                                     sctp_m_getptr(m, offset,
2941                                     sizeof(struct sctp_ipv6addr_param),
2942                                     (uint8_t *)&addr6_store);
2943                                 if (a6p == NULL) {
2944                                         return (0);
2945                                 }
2946                                 sin6 = (struct sockaddr_in6 *)sa;
2947                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2948                                         /* create a copy and clear scope */
2949                                         memcpy(&sin6_tmp, sin6,
2950                                             sizeof(struct sockaddr_in6));
2951                                         sin6 = &sin6_tmp;
2952                                         in6_clearscope(&sin6->sin6_addr);
2953                                 }
2954                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2955                                     sizeof(struct in6_addr)) == 0) {
2956                                         /* found it */
2957                                         return (1);
2958                                 }
2959                         }
2960                         break;
2961 #endif                          /* INET6 */
2962 #ifdef INET
2963                 case SCTP_IPV4_ADDRESS:
2964                         if (sa->sa_family == AF_INET) {
2965                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2966                                         break;
2967                                 }
2968                                 /* get the entire IPv4 address param */
2969                                 a4p = (struct sctp_ipv4addr_param *)
2970                                     sctp_m_getptr(m, offset,
2971                                     sizeof(struct sctp_ipv4addr_param),
2972                                     (uint8_t *)&addr4_store);
2973                                 if (a4p == NULL) {
2974                                         return (0);
2975                                 }
2976                                 sin = (struct sockaddr_in *)sa;
2977                                 if (sin->sin_addr.s_addr == a4p->addr) {
2978                                         /* found it */
2979                                         return (1);
2980                                 }
2981                         }
2982                         break;
2983 #endif
2984                 default:
2985                         break;
2986                 }
2987                 /* get next parameter */
2988                 offset += SCTP_SIZE32(plen);
2989                 if (offset + sizeof(struct sctp_paramhdr) > length) {
2990                         return (0);
2991                 }
2992                 ph = (struct sctp_paramhdr *)
2993                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2994                     (uint8_t *)&tmp_param);
2995         }                       /* while */
2996         /* not found! */
2997         return (0);
2998 }
2999
3000 /*
3001  * makes sure that the current endpoint local addr list is consistent with
3002  * the new association (eg. subset bound, asconf allowed) adds addresses as
3003  * necessary
3004  */
3005 static void
3006 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3007     int length, struct sockaddr *init_addr)
3008 {
3009         struct sctp_laddr *laddr;
3010
3011         /* go through the endpoint list */
3012         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3013                 /* be paranoid and validate the laddr */
3014                 if (laddr->ifa == NULL) {
3015                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3016                             "check_addr_list_ep: laddr->ifa is NULL");
3017                         continue;
3018                 }
3019                 if (laddr->ifa == NULL) {
3020                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3021                         continue;
3022                 }
3023                 /* do i have it implicitly? */
3024                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3025                         continue;
3026                 }
3027                 /* check to see if in the init-ack */
3028                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3029                         /* try to add it */
3030                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3031                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3032                 }
3033         }
3034 }
3035
3036 /*
3037  * makes sure that the current kernel address list is consistent with the new
3038  * association (with all addrs bound) adds addresses as necessary
3039  */
3040 static void
3041 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3042     int length, struct sockaddr *init_addr,
3043     uint16_t local_scope, uint16_t site_scope,
3044     uint16_t ipv4_scope, uint16_t loopback_scope)
3045 {
3046         struct sctp_vrf *vrf = NULL;
3047         struct sctp_ifn *sctp_ifn;
3048         struct sctp_ifa *sctp_ifa;
3049         uint32_t vrf_id;
3050 #ifdef INET
3051         struct sockaddr_in *sin;
3052 #endif
3053 #ifdef INET6
3054         struct sockaddr_in6 *sin6;
3055 #endif
3056
3057         if (stcb) {
3058                 vrf_id = stcb->asoc.vrf_id;
3059         } else {
3060                 return;
3061         }
3062         SCTP_IPI_ADDR_RLOCK();
3063         vrf = sctp_find_vrf(vrf_id);
3064         if (vrf == NULL) {
3065                 SCTP_IPI_ADDR_RUNLOCK();
3066                 return;
3067         }
3068         /* go through all our known interfaces */
3069         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3070                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3071                         /* skip loopback interface */
3072                         continue;
3073                 }
3074                 /* go through each interface address */
3075                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3076                         /* do i have it implicitly? */
3077                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3078                                 continue;
3079                         }
3080                         switch (sctp_ifa->address.sa.sa_family) {
3081 #ifdef INET
3082                         case AF_INET:
3083                                 sin = &sctp_ifa->address.sin;
3084                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3085                                     &sin->sin_addr) != 0) {
3086                                         continue;
3087                                 }
3088                                 if ((ipv4_scope == 0) &&
3089                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3090                                         /* private address not in scope */
3091                                         continue;
3092                                 }
3093                                 break;
3094 #endif
3095 #ifdef INET6
3096                         case AF_INET6:
3097                                 sin6 = &sctp_ifa->address.sin6;
3098                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3099                                     &sin6->sin6_addr) != 0) {
3100                                         continue;
3101                                 }
3102                                 if ((local_scope == 0) &&
3103                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3104                                         continue;
3105                                 }
3106                                 if ((site_scope == 0) &&
3107                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3108                                         continue;
3109                                 }
3110                                 break;
3111 #endif
3112                         default:
3113                                 break;
3114                         }
3115                         /* check to see if in the init-ack */
3116                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3117                                 /* try to add it */
3118                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3119                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3120                                     SCTP_ADDR_LOCKED);
3121                         }
3122                 }               /* end foreach ifa */
3123         }                       /* end foreach ifn */
3124         SCTP_IPI_ADDR_RUNLOCK();
3125 }
3126
3127 /*
3128  * validates an init-ack chunk (from a cookie-echo) with current addresses
3129  * adds addresses from the init-ack into our local address list, if needed
3130  * queues asconf adds/deletes addresses as needed and makes appropriate list
3131  * changes for source address selection m, offset: points to the start of the
3132  * address list in an init-ack chunk length: total length of the address
3133  * params only init_addr: address where my INIT-ACK was sent from
3134  */
3135 void
3136 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3137     int length, struct sockaddr *init_addr,
3138     uint16_t local_scope, uint16_t site_scope,
3139     uint16_t ipv4_scope, uint16_t loopback_scope)
3140 {
3141         /* process the local addresses in the initack */
3142         sctp_process_initack_addresses(stcb, m, offset, length);
3143
3144         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3145                 /* bound all case */
3146                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3147                     local_scope, site_scope, ipv4_scope, loopback_scope);
3148         } else {
3149                 /* subset bound case */
3150                 if (sctp_is_feature_on(stcb->sctp_ep,
3151                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3152                         /* asconf's allowed */
3153                         sctp_check_address_list_ep(stcb, m, offset, length,
3154                             init_addr);
3155                 }
3156                 /* else, no asconfs allowed, so what we sent is what we get */
3157         }
3158 }
3159
3160 /*
3161  * sctp_bindx() support
3162  */
3163 uint32_t
3164 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3165     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3166 {
3167         struct sctp_ifa *ifa;
3168         struct sctp_laddr *laddr, *nladdr;
3169
3170         if (sa->sa_len == 0) {
3171                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3172                 return (EINVAL);
3173         }
3174         if (sctp_ifap) {
3175                 ifa = sctp_ifap;
3176         } else if (type == SCTP_ADD_IP_ADDRESS) {
3177                 /* For an add the address MUST be on the system */
3178                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3179         } else if (type == SCTP_DEL_IP_ADDRESS) {
3180                 /* For a delete we need to find it in the inp */
3181                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3182         } else {
3183                 ifa = NULL;
3184         }
3185         if (ifa != NULL) {
3186                 if (type == SCTP_ADD_IP_ADDRESS) {
3187                         sctp_add_local_addr_ep(inp, ifa, type);
3188                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3189                         if (inp->laddr_count < 2) {
3190                                 /* can't delete the last local address */
3191                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3192                                 return (EINVAL);
3193                         }
3194                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3195                             sctp_nxt_addr) {
3196                                 if (ifa == laddr->ifa) {
3197                                         /* Mark in the delete */
3198                                         laddr->action = type;
3199                                 }
3200                         }
3201                 }
3202                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3203                         /*
3204                          * There is no need to start the iterator if the inp
3205                          * has no associations.
3206                          */
3207                         if (type == SCTP_DEL_IP_ADDRESS) {
3208                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3209                                         if (laddr->ifa == ifa) {
3210                                                 sctp_del_local_addr_ep(inp, ifa);
3211                                         }
3212                                 }
3213                         }
3214                 } else {
3215                         struct sctp_asconf_iterator *asc;
3216                         struct sctp_laddr *wi;
3217                         int ret;
3218
3219                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3220                             sizeof(struct sctp_asconf_iterator),
3221                             SCTP_M_ASC_IT);
3222                         if (asc == NULL) {
3223                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3224                                 return (ENOMEM);
3225                         }
3226                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3227                         if (wi == NULL) {
3228                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3229                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3230                                 return (ENOMEM);
3231                         }
3232                         LIST_INIT(&asc->list_of_work);
3233                         asc->cnt = 1;
3234                         SCTP_INCR_LADDR_COUNT();
3235                         wi->ifa = ifa;
3236                         wi->action = type;
3237                         atomic_add_int(&ifa->refcount, 1);
3238                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3239                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3240                             sctp_asconf_iterator_stcb,
3241                             sctp_asconf_iterator_ep_end,
3242                             SCTP_PCB_ANY_FLAGS,
3243                             SCTP_PCB_ANY_FEATURES,
3244                             SCTP_ASOC_ANY_STATE,
3245                             (void *)asc, 0,
3246                             sctp_asconf_iterator_end, inp, 0);
3247                         if (ret) {
3248                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3249                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3250                                 sctp_asconf_iterator_end(asc, 0);
3251                                 return (EFAULT);
3252                         }
3253                 }
3254                 return (0);
3255         } else {
3256                 /* invalid address! */
3257                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3258                 return (EADDRNOTAVAIL);
3259         }
3260 }
3261
3262 void
3263 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3264     struct sctp_nets *net)
3265 {
3266         struct sctp_asconf_addr *aa;
3267         struct sctp_ifa *sctp_ifap;
3268         struct sctp_asconf_tag_param *vtag;
3269 #ifdef INET
3270         struct sockaddr_in *to;
3271 #endif
3272 #ifdef INET6
3273         struct sockaddr_in6 *to6;
3274 #endif
3275         if (net == NULL) {
3276                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3277                 return;
3278         }
3279         if (stcb == NULL) {
3280                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3281                 return;
3282         }
3283         /*
3284          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3285          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3286          */
3287         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3288             SCTP_M_ASC_ADDR);
3289         if (aa == NULL) {
3290                 /* didn't get memory */
3291                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3292                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3293                 return;
3294         }
3295         aa->special_del = 0;
3296         /* fill in asconf address parameter fields */
3297         /* top level elements are "networked" during send */
3298         aa->ifa = NULL;
3299         aa->sent = 0;           /* clear sent flag */
3300         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3301         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3302         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3303         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3304         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3305         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3306
3307         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3308             SCTP_M_ASC_ADDR);
3309         if (aa == NULL) {
3310                 /* didn't get memory */
3311                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3312                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3313                 return;
3314         }
3315         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3316         /* fill in asconf address parameter fields */
3317         /* ADD(0.0.0.0) */
3318         switch (net->ro._l_addr.sa.sa_family) {
3319 #ifdef INET
3320         case AF_INET:
3321                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3322                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3323                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3324                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3325                 /* No need to add an address, we are using 0.0.0.0 */
3326                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3327                 break;
3328 #endif
3329 #ifdef INET6
3330         case AF_INET6:
3331                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3332                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3333                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3334                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3335                 /* No need to add an address, we are using 0.0.0.0 */
3336                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3337                 break;
3338 #endif
3339         default:
3340                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3341                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3342                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3343                 return;
3344         }
3345         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3346             SCTP_M_ASC_ADDR);
3347         if (aa == NULL) {
3348                 /* didn't get memory */
3349                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3350                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3351                 return;
3352         }
3353         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3354         /* fill in asconf address parameter fields */
3355         /* ADD(0.0.0.0) */
3356         switch (net->ro._l_addr.sa.sa_family) {
3357 #ifdef INET
3358         case AF_INET:
3359                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3360                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3361                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3362                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3363                 /* No need to add an address, we are using 0.0.0.0 */
3364                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3365                 break;
3366 #endif
3367 #ifdef INET6
3368         case AF_INET6:
3369                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3370                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3371                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3372                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3373                 /* No need to add an address, we are using 0.0.0.0 */
3374                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3375                 break;
3376 #endif
3377         default:
3378                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3379                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3380                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3381                 return;
3382         }
3383         /* Now we must hunt the addresses and add all global addresses */
3384         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3385                 struct sctp_vrf *vrf = NULL;
3386                 struct sctp_ifn *sctp_ifnp;
3387                 uint32_t vrf_id;
3388
3389                 vrf_id = stcb->sctp_ep->def_vrf_id;
3390                 vrf = sctp_find_vrf(vrf_id);
3391                 if (vrf == NULL) {
3392                         goto skip_rest;
3393                 }
3394
3395                 SCTP_IPI_ADDR_RLOCK();
3396                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3397                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3398                                 switch (sctp_ifap->address.sa.sa_family) {
3399 #ifdef INET
3400                                 case AF_INET:
3401                                         to = &sctp_ifap->address.sin;
3402                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3403                                             &to->sin_addr) != 0) {
3404                                                 continue;
3405                                         }
3406                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3407                                                 continue;
3408                                         }
3409                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3410                                                 continue;
3411                                         }
3412                                         break;
3413 #endif
3414 #ifdef INET6
3415                                 case AF_INET6:
3416                                         to6 = &sctp_ifap->address.sin6;
3417                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3418                                             &to6->sin6_addr) != 0) {
3419                                                 continue;
3420                                         }
3421                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3422                                                 continue;
3423                                         }
3424                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3425                                                 continue;
3426                                         }
3427                                         break;
3428 #endif
3429                                 default:
3430                                         continue;
3431                                 }
3432                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3433                         }
3434                 }
3435                 SCTP_IPI_ADDR_RUNLOCK();
3436         } else {
3437                 struct sctp_laddr *laddr;
3438
3439                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3440                         if (laddr->ifa == NULL) {
3441                                 continue;
3442                         }
3443                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3444                                 /*
3445                                  * Address being deleted by the system, dont
3446                                  * list.
3447                                  */
3448                                 continue;
3449                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3450                                 /*
3451                                  * Address being deleted on this ep don't
3452                                  * list.
3453                                  */
3454                                 continue;
3455                         }
3456                         sctp_ifap = laddr->ifa;
3457                         switch (sctp_ifap->address.sa.sa_family) {
3458 #ifdef INET
3459                         case AF_INET:
3460                                 to = &sctp_ifap->address.sin;
3461                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3462                                         continue;
3463                                 }
3464                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3465                                         continue;
3466                                 }
3467                                 break;
3468 #endif
3469 #ifdef INET6
3470                         case AF_INET6:
3471                                 to6 = &sctp_ifap->address.sin6;
3472                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3473                                         continue;
3474                                 }
3475                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3476                                         continue;
3477                                 }
3478                                 break;
3479 #endif
3480                         default:
3481                                 continue;
3482                         }
3483                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3484                 }
3485         }
3486 skip_rest:
3487         /* Now we must send the asconf into the queue */
3488         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3489 }