sys/netinet/sctp_asconf.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #include <netinet/sctp_pcb.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctputil.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_asconf.h>
  46 #include <netinet/sctp_timer.h>
  47
  48 /*
  49  * debug flags:
  50  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  51  * SCTP_DEBUG_ASCONF2: detailed info
  52  */
  53
  54
  55 /*
  56  * RFC 5061
  57  *
  58  * An ASCONF parameter queue exists per asoc which holds the pending address
  59  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  60  *
  61  * A restricted_addrs list exists per assoc to hold local addresses that are
  62  * not (yet) usable by the assoc as a source address.  These addresses are
  63  * either pending an ASCONF operation (and exist on the ASCONF parameter
  64  * queue), or they are permanently restricted (the peer has returned an
  65  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  66  *
  67  * Deleted addresses are always immediately removed from the lists as they will
  68  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  69  * only if allowed.
  70  */
  71
  72 /*
  73  * ASCONF parameter processing.
  74  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  75  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  76  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  77  */
  78 static struct mbuf *
  79 sctp_asconf_success_response(uint32_t id)
  80 {
  81         struct mbuf *m_reply = NULL;
  82         struct sctp_asconf_paramhdr *aph;
  83
  84         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  85             0, M_NOWAIT, 1, MT_DATA);
  86         if (m_reply == NULL) {
  87                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  88                     "asconf_success_response: couldn't get mbuf!\n");
  89                 return (NULL);
  90         }
  91         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  92         aph->correlation_id = id;
  93         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  94         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  95         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  96         aph->ph.param_length = htons(aph->ph.param_length);
  97
  98         return (m_reply);
  99 }
 100
 101 static struct mbuf *
 102 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 103     uint16_t tlv_length)
 104 {
 105         struct mbuf *m_reply = NULL;
 106         struct sctp_asconf_paramhdr *aph;
 107         struct sctp_error_cause *error;
 108         uint32_t buf_len;
 109         uint16_t i, param_length, cause_length, padding_length;
 110         uint8_t *tlv;
 111
 112         if (error_tlv == NULL) {
 113                 tlv_length = 0;
 114         }
 115         cause_length = sizeof(struct sctp_error_cause) + tlv_length;
 116         param_length = sizeof(struct sctp_asconf_paramhdr) + cause_length;
 117         padding_length = tlv_length % 4;
 118         if (padding_length != 0) {
 119                 padding_length = 4 - padding_length;
 120         }
 121         buf_len = param_length + padding_length;
 122         if (buf_len > MLEN) {
 123                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 124                     "asconf_error_response: tlv_length (%xh) too big\n",
 125                     tlv_length);
 126                 return (NULL);
 127         }
 128         m_reply = sctp_get_mbuf_for_msg(buf_len, 0, M_NOWAIT, 1, MT_DATA);
 129         if (m_reply == NULL) {
 130                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 131                     "asconf_error_response: couldn't get mbuf!\n");
 132                 return (NULL);
 133         }
 134         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 135         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 136         aph->ph.param_length = htons(param_length);
 137         aph->correlation_id = id;
 138         error = (struct sctp_error_cause *)(aph + 1);
 139         error->code = htons(cause);
 140         error->length = htons(cause_length);
 141         if (error_tlv != NULL) {
 142                 tlv = (uint8_t *)(error + 1);
 143                 memcpy(tlv, error_tlv, tlv_length);
 144                 for (i = 0; i < padding_length; i++) {
 145                         tlv[tlv_length + i] = 0;
 146                 }
 147         }
 148         SCTP_BUF_LEN(m_reply) = buf_len;
 149         return (m_reply);
 150 }
 151
 152 static struct mbuf *
 153 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 154     struct sctp_tcb *stcb, int send_hb, int response_required)
 155 {
 156         struct sctp_nets *net;
 157         struct mbuf *m_reply = NULL;
 158         union sctp_sockstore store;
 159         struct sctp_paramhdr *ph;
 160         uint16_t param_type, aparam_length;
 161 #if defined(INET) || defined(INET6)
 162         uint16_t param_length;
 163 #endif
 164         struct sockaddr *sa;
 165         int zero_address = 0;
 166         int bad_address = 0;
 167 #ifdef INET
 168         struct sockaddr_in *sin;
 169         struct sctp_ipv4addr_param *v4addr;
 170 #endif
 171 #ifdef INET6
 172         struct sockaddr_in6 *sin6;
 173         struct sctp_ipv6addr_param *v6addr;
 174 #endif
 175
 176         aparam_length = ntohs(aph->ph.param_length);
 177         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 178                 return (NULL);
 179         }
 180         ph = (struct sctp_paramhdr *)(aph + 1);
 181         param_type = ntohs(ph->param_type);
 182 #if defined(INET) || defined(INET6)
 183         param_length = ntohs(ph->param_length);
 184         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 185                 return (NULL);
 186         }
 187 #endif
 188         sa = &store.sa;
 189         switch (param_type) {
 190 #ifdef INET
 191         case SCTP_IPV4_ADDRESS:
 192                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 193                         /* invalid param size */
 194                         return (NULL);
 195                 }
 196                 v4addr = (struct sctp_ipv4addr_param *)ph;
 197                 sin = &store.sin;
 198                 memset(sin, 0, sizeof(*sin));
 199                 sin->sin_family = AF_INET;
 200                 sin->sin_len = sizeof(struct sockaddr_in);
 201                 sin->sin_port = stcb->rport;
 202                 sin->sin_addr.s_addr = v4addr->addr;
 203                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 204                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 205                         bad_address = 1;
 206                 }
 207                 if (sin->sin_addr.s_addr == INADDR_ANY)
 208                         zero_address = 1;
 209                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 210                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 211                 break;
 212 #endif
 213 #ifdef INET6
 214         case SCTP_IPV6_ADDRESS:
 215                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 216                         /* invalid param size */
 217                         return (NULL);
 218                 }
 219                 v6addr = (struct sctp_ipv6addr_param *)ph;
 220                 sin6 = &store.sin6;
 221                 memset(sin6, 0, sizeof(*sin6));
 222                 sin6->sin6_family = AF_INET6;
 223                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 224                 sin6->sin6_port = stcb->rport;
 225                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 226                     sizeof(struct in6_addr));
 227                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 228                         bad_address = 1;
 229                 }
 230                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 231                         zero_address = 1;
 232                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 233                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 234                 break;
 235 #endif
 236         default:
 237                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 238                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 239                     aparam_length);
 240                 return (m_reply);
 241         }                       /* end switch */
 242
 243         /* if 0.0.0.0/::0, add the source address instead */
 244         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 245                 sa = src;
 246                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 247                     "process_asconf_add_ip: using source addr ");
 248                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 249         }
 250         net = NULL;
 251         /* add the address */
 252         if (bad_address) {
 253                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 254                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 255                     aparam_length);
 256         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 257                     SCTP_DONOT_SETSCOPE,
 258             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 259                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 260                     "process_asconf_add_ip: error adding address\n");
 261                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 262                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 263                     aparam_length);
 264         } else {
 265                 if (response_required) {
 266                         m_reply =
 267                             sctp_asconf_success_response(aph->correlation_id);
 268                 }
 269                 if (net != NULL) {
 270                         /* notify upper layer */
 271                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 272                         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 273                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 274                             stcb, net);
 275                         if (send_hb) {
 276                                 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 277                         }
 278                 }
 279         }
 280         return (m_reply);
 281 }
 282
 283 static int
 284 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 285 {
 286         struct sctp_nets *src_net, *net, *nnet;
 287
 288         /* make sure the source address exists as a destination net */
 289         src_net = sctp_findnet(stcb, src);
 290         if (src_net == NULL) {
 291                 /* not found */
 292                 return (-1);
 293         }
 294
 295         /* delete all destination addresses except the source */
 296         TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
 297                 if (net != src_net) {
 298                         /* delete this address */
 299                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 300                             "asconf_del_remote_addrs_except: deleting ");
 301                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 302                             (struct sockaddr *)&net->ro._l_addr);
 303                         /* notify upper layer */
 304                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 305                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 306                         sctp_remove_net(stcb, net);
 307                 }
 308         }
 309         return (0);
 310 }
 311
 312 static struct mbuf *
 313 sctp_process_asconf_delete_ip(struct sockaddr *src,
 314     struct sctp_asconf_paramhdr *aph,
 315     struct sctp_tcb *stcb, int response_required)
 316 {
 317         struct mbuf *m_reply = NULL;
 318         union sctp_sockstore store;
 319         struct sctp_paramhdr *ph;
 320         uint16_t param_type, aparam_length;
 321 #if defined(INET) || defined(INET6)
 322         uint16_t param_length;
 323 #endif
 324         struct sockaddr *sa;
 325         int zero_address = 0;
 326         int result;
 327 #ifdef INET
 328         struct sockaddr_in *sin;
 329         struct sctp_ipv4addr_param *v4addr;
 330 #endif
 331 #ifdef INET6
 332         struct sockaddr_in6 *sin6;
 333         struct sctp_ipv6addr_param *v6addr;
 334 #endif
 335
 336         aparam_length = ntohs(aph->ph.param_length);
 337         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 338                 return (NULL);
 339         }
 340         ph = (struct sctp_paramhdr *)(aph + 1);
 341         param_type = ntohs(ph->param_type);
 342 #if defined(INET) || defined(INET6)
 343         param_length = ntohs(ph->param_length);
 344         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 345                 return (NULL);
 346         }
 347 #endif
 348         sa = &store.sa;
 349         switch (param_type) {
 350 #ifdef INET
 351         case SCTP_IPV4_ADDRESS:
 352                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 353                         /* invalid param size */
 354                         return (NULL);
 355                 }
 356                 v4addr = (struct sctp_ipv4addr_param *)ph;
 357                 sin = &store.sin;
 358                 memset(sin, 0, sizeof(*sin));
 359                 sin->sin_family = AF_INET;
 360                 sin->sin_len = sizeof(struct sockaddr_in);
 361                 sin->sin_port = stcb->rport;
 362                 sin->sin_addr.s_addr = v4addr->addr;
 363                 if (sin->sin_addr.s_addr == INADDR_ANY)
 364                         zero_address = 1;
 365                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 366                     "process_asconf_delete_ip: deleting ");
 367                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 368                 break;
 369 #endif
 370 #ifdef INET6
 371         case SCTP_IPV6_ADDRESS:
 372                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 373                         /* invalid param size */
 374                         return (NULL);
 375                 }
 376                 v6addr = (struct sctp_ipv6addr_param *)ph;
 377                 sin6 = &store.sin6;
 378                 memset(sin6, 0, sizeof(*sin6));
 379                 sin6->sin6_family = AF_INET6;
 380                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 381                 sin6->sin6_port = stcb->rport;
 382                 memcpy(&sin6->sin6_addr, v6addr->addr,
 383                     sizeof(struct in6_addr));
 384                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 385                         zero_address = 1;
 386                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 387                     "process_asconf_delete_ip: deleting ");
 388                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 389                 break;
 390 #endif
 391         default:
 392                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 393                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 394                     aparam_length);
 395                 return (m_reply);
 396         }
 397
 398         /* make sure the source address is not being deleted */
 399         if (sctp_cmpaddr(sa, src)) {
 400                 /* trying to delete the source address! */
 401                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 402                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 403                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 404                     aparam_length);
 405                 return (m_reply);
 406         }
 407
 408         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 409         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 410                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 411
 412                 if (result) {
 413                         /* src address did not exist? */
 414                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 415                         /* what error to reply with?? */
 416                         m_reply =
 417                             sctp_asconf_error_response(aph->correlation_id,
 418                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 419                             aparam_length);
 420                 } else if (response_required) {
 421                         m_reply =
 422                             sctp_asconf_success_response(aph->correlation_id);
 423                 }
 424                 return (m_reply);
 425         }
 426
 427         /* delete the address */
 428         result = sctp_del_remote_addr(stcb, sa);
 429         /*
 430          * note if result == -2, the address doesn't exist in the asoc but
 431          * since it's being deleted anyways, we just ack the delete -- but
 432          * this probably means something has already gone awry
 433          */
 434         if (result == -1) {
 435                 /* only one address in the asoc */
 436                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 437                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 438                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 439                     aparam_length);
 440         } else {
 441                 if (response_required) {
 442                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 443                 }
 444                 /* notify upper layer */
 445                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 446         }
 447         return (m_reply);
 448 }
 449
 450 static struct mbuf *
 451 sctp_process_asconf_set_primary(struct sockaddr *src,
 452     struct sctp_asconf_paramhdr *aph,
 453     struct sctp_tcb *stcb, int response_required)
 454 {
 455         struct mbuf *m_reply = NULL;
 456         union sctp_sockstore store;
 457         struct sctp_paramhdr *ph;
 458         uint16_t param_type, aparam_length;
 459 #if defined(INET) || defined(INET6)
 460         uint16_t param_length;
 461 #endif
 462         struct sockaddr *sa;
 463         int zero_address = 0;
 464 #ifdef INET
 465         struct sockaddr_in *sin;
 466         struct sctp_ipv4addr_param *v4addr;
 467 #endif
 468 #ifdef INET6
 469         struct sockaddr_in6 *sin6;
 470         struct sctp_ipv6addr_param *v6addr;
 471 #endif
 472
 473         aparam_length = ntohs(aph->ph.param_length);
 474         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 475                 return (NULL);
 476         }
 477         ph = (struct sctp_paramhdr *)(aph + 1);
 478         param_type = ntohs(ph->param_type);
 479 #if defined(INET) || defined(INET6)
 480         param_length = ntohs(ph->param_length);
 481         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 482                 return (NULL);
 483         }
 484 #endif
 485         sa = &store.sa;
 486         switch (param_type) {
 487 #ifdef INET
 488         case SCTP_IPV4_ADDRESS:
 489                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 490                         /* invalid param size */
 491                         return (NULL);
 492                 }
 493                 v4addr = (struct sctp_ipv4addr_param *)ph;
 494                 sin = &store.sin;
 495                 memset(sin, 0, sizeof(*sin));
 496                 sin->sin_family = AF_INET;
 497                 sin->sin_len = sizeof(struct sockaddr_in);
 498                 sin->sin_addr.s_addr = v4addr->addr;
 499                 if (sin->sin_addr.s_addr == INADDR_ANY)
 500                         zero_address = 1;
 501                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 502                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 503                 break;
 504 #endif
 505 #ifdef INET6
 506         case SCTP_IPV6_ADDRESS:
 507                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 508                         /* invalid param size */
 509                         return (NULL);
 510                 }
 511                 v6addr = (struct sctp_ipv6addr_param *)ph;
 512                 sin6 = &store.sin6;
 513                 memset(sin6, 0, sizeof(*sin6));
 514                 sin6->sin6_family = AF_INET6;
 515                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 516                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 517                     sizeof(struct in6_addr));
 518                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 519                         zero_address = 1;
 520                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 521                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 522                 break;
 523 #endif
 524         default:
 525                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 526                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 527                     aparam_length);
 528                 return (m_reply);
 529         }
 530
 531         /* if 0.0.0.0/::0, use the source address instead */
 532         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 533                 sa = src;
 534                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 535                     "process_asconf_set_primary: using source addr ");
 536                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 537         }
 538         /* set the primary address */
 539         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 540                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 541                     "process_asconf_set_primary: primary address set\n");
 542                 /* notify upper layer */
 543                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 544                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 545                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 546                     (stcb->asoc.alternate)) {
 547                         sctp_free_remote_addr(stcb->asoc.alternate);
 548                         stcb->asoc.alternate = NULL;
 549                 }
 550                 if (response_required) {
 551                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 552                 }
 553                 /*
 554                  * Mobility adaptation. Ideally, when the reception of SET
 555                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 556                  * destination, unacknowledged DATA are retransmitted
 557                  * immediately to the new primary destination for seamless
 558                  * handover. If the destination is UNCONFIRMED and marked to
 559                  * REQ_PRIM, The retransmission occur when reception of the
 560                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 561                  * sctp_input.c) Also, when change of the primary
 562                  * destination, it is better that all subsequent new DATA
 563                  * containing already queued DATA are transmitted to the new
 564                  * primary destination. (by micchie)
 565                  */
 566                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 567                     SCTP_MOBILITY_BASE) ||
 568                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 569                     SCTP_MOBILITY_FASTHANDOFF)) &&
 570                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 571                     SCTP_MOBILITY_PRIM_DELETED) &&
 572                     (stcb->asoc.primary_destination->dest_state &
 573                     SCTP_ADDR_UNCONFIRMED) == 0) {
 574
 575                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 576                             stcb->sctp_ep, stcb, NULL,
 577                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 578                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 579                             SCTP_MOBILITY_FASTHANDOFF)) {
 580                                 sctp_assoc_immediate_retrans(stcb,
 581                                     stcb->asoc.primary_destination);
 582                         }
 583                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 584                             SCTP_MOBILITY_BASE)) {
 585                                 sctp_move_chunks_from_net(stcb,
 586                                     stcb->asoc.deleted_primary);
 587                         }
 588                         sctp_delete_prim_timer(stcb->sctp_ep, stcb);
 589                 }
 590         } else {
 591                 /* couldn't set the requested primary address! */
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "process_asconf_set_primary: set primary failed!\n");
 594                 /* must have been an invalid address, so report */
 595                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 596                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 597                     aparam_length);
 598         }
 599
 600         return (m_reply);
 601 }
 602
 603 /*
 604  * handles an ASCONF chunk.
 605  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 606  */
 607 void
 608 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 609     struct sockaddr *src,
 610     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 611     int first)
 612 {
 613         struct sctp_association *asoc;
 614         uint32_t serial_num;
 615         struct mbuf *n, *m_ack, *m_result, *m_tail;
 616         struct sctp_asconf_ack_chunk *ack_cp;
 617         struct sctp_asconf_paramhdr *aph;
 618         struct sctp_ipv6addr_param *p_addr;
 619         unsigned int asconf_limit, cnt;
 620         int error = 0;          /* did an error occur? */
 621
 622         /* asconf param buffer */
 623         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 624         struct sctp_asconf_ack *ack, *ack_next;
 625
 626         /* verify minimum length */
 627         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 628                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 629                     "handle_asconf: chunk too small = %xh\n",
 630                     ntohs(cp->ch.chunk_length));
 631                 return;
 632         }
 633         asoc = &stcb->asoc;
 634         serial_num = ntohl(cp->serial_number);
 635
 636         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 637                 /* got a duplicate ASCONF */
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: got duplicate serial number = %xh\n",
 640                     serial_num);
 641                 return;
 642         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 643                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 644                     serial_num, asoc->asconf_seq_in + 1);
 645                 return;
 646         }
 647
 648         /* it's the expected "next" sequence number, so process it */
 649         asoc->asconf_seq_in = serial_num;       /* update sequence */
 650         /* get length of all the param's in the ASCONF */
 651         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 652         SCTPDBG(SCTP_DEBUG_ASCONF1,
 653             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 654             asconf_limit, serial_num);
 655
 656         if (first) {
 657                 /* delete old cache */
 658                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 659
 660                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 661                         if (ack->serial_number == serial_num)
 662                                 break;
 663                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 664                             ack->serial_number, serial_num);
 665                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 666                         if (ack->data != NULL) {
 667                                 sctp_m_freem(ack->data);
 668                         }
 669                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 670                 }
 671         }
 672
 673         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 674             M_NOWAIT, 1, MT_DATA);
 675         if (m_ack == NULL) {
 676                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 677                     "handle_asconf: couldn't get mbuf!\n");
 678                 return;
 679         }
 680         m_tail = m_ack;         /* current reply chain's tail */
 681
 682         /* fill in ASCONF-ACK header */
 683         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 684         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 685         ack_cp->ch.chunk_flags = 0;
 686         ack_cp->serial_number = htonl(serial_num);
 687         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 688         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 689         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 690
 691         /* skip the lookup address parameter */
 692         offset += sizeof(struct sctp_asconf_chunk);
 693         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 694         if (p_addr == NULL) {
 695                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 696                     "handle_asconf: couldn't get lookup addr!\n");
 697                 /* respond with a missing/invalid mandatory parameter error */
 698                 sctp_m_freem(m_ack);
 699                 return;
 700         }
 701         /* skip lookup addr */
 702         offset += SCTP_SIZE32(ntohs(p_addr->ph.param_length));
 703         /* get pointer to first asconf param in ASCONF */
 704         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 705         if (aph == NULL) {
 706                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 707                 goto send_reply;
 708         }
 709         /* process through all parameters */
 710         cnt = 0;
 711         while (aph != NULL) {
 712                 unsigned int param_length, param_type;
 713
 714                 param_type = ntohs(aph->ph.param_type);
 715                 param_length = ntohs(aph->ph.param_length);
 716                 if (offset + param_length > asconf_limit) {
 717                         /* parameter goes beyond end of chunk! */
 718                         sctp_m_freem(m_ack);
 719                         return;
 720                 }
 721                 m_result = NULL;
 722
 723                 if (param_length > sizeof(aparam_buf)) {
 724                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 725                         sctp_m_freem(m_ack);
 726                         return;
 727                 }
 728                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 729                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 730                         sctp_m_freem(m_ack);
 731                         return;
 732                 }
 733                 /* get the entire parameter */
 734                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 735                 if (aph == NULL) {
 736                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 737                         sctp_m_freem(m_ack);
 738                         return;
 739                 }
 740                 switch (param_type) {
 741                 case SCTP_ADD_IP_ADDRESS:
 742                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 743                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 744                         cnt++;
 745                         break;
 746                 case SCTP_DEL_IP_ADDRESS:
 747                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 748                             error);
 749                         break;
 750                 case SCTP_ERROR_CAUSE_IND:
 751                         /* not valid in an ASCONF chunk */
 752                         break;
 753                 case SCTP_SET_PRIM_ADDR:
 754                         m_result = sctp_process_asconf_set_primary(src, aph,
 755                             stcb, error);
 756                         break;
 757                 case SCTP_NAT_VTAGS:
 758                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 759                         break;
 760                 case SCTP_SUCCESS_REPORT:
 761                         /* not valid in an ASCONF chunk */
 762                         break;
 763                 case SCTP_ULP_ADAPTATION:
 764                         /* FIX */
 765                         break;
 766                 default:
 767                         if ((param_type & 0x8000) == 0) {
 768                                 /* Been told to STOP at this param */
 769                                 asconf_limit = offset;
 770                                 /*
 771                                  * FIX FIX - We need to call
 772                                  * sctp_arethere_unrecognized_parameters()
 773                                  * to get a operr and send it for any
 774                                  * param's with the 0x4000 bit set OR do it
 775                                  * here ourselves... note we still must STOP
 776                                  * if the 0x8000 bit is clear.
 777                                  */
 778                         }
 779                         /* unknown/invalid param type */
 780                         break;
 781                 }               /* switch */
 782
 783                 /* add any (error) result to the reply mbuf chain */
 784                 if (m_result != NULL) {
 785                         SCTP_BUF_NEXT(m_tail) = m_result;
 786                         m_tail = m_result;
 787                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 788                         /* set flag to force success reports */
 789                         error = 1;
 790                 }
 791                 offset += SCTP_SIZE32(param_length);
 792                 /* update remaining ASCONF message length to process */
 793                 if (offset >= asconf_limit) {
 794                         /* no more data in the mbuf chain */
 795                         break;
 796                 }
 797                 /* get pointer to next asconf param */
 798                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 799                     sizeof(struct sctp_asconf_paramhdr),
 800                     (uint8_t *)&aparam_buf);
 801                 if (aph == NULL) {
 802                         /* can't get an asconf paramhdr */
 803                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 804                         /* FIX ME - add error here... */
 805                 }
 806         }
 807
 808 send_reply:
 809         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 810         /* save the ASCONF-ACK reply */
 811         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 812             struct sctp_asconf_ack);
 813         if (ack == NULL) {
 814                 sctp_m_freem(m_ack);
 815                 return;
 816         }
 817         ack->serial_number = serial_num;
 818         ack->last_sent_to = NULL;
 819         ack->data = m_ack;
 820         ack->len = 0;
 821         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 822                 ack->len += SCTP_BUF_LEN(n);
 823         }
 824         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 825
 826         /* see if last_control_chunk_from is set properly (use IP src addr) */
 827         if (stcb->asoc.last_control_chunk_from == NULL) {
 828                 /*
 829                  * this could happen if the source address was just newly
 830                  * added
 831                  */
 832                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 833                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 834                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 835                 /* look up the from address */
 836                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 837 #ifdef SCTP_DEBUG
 838                 if (stcb->asoc.last_control_chunk_from == NULL) {
 839                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 840                 }
 841 #endif
 842         }
 843 }
 844
 845 /*
 846  * does the address match? returns 0 if not, 1 if so
 847  */
 848 static uint32_t
 849 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 850 {
 851         switch (sa->sa_family) {
 852 #ifdef INET6
 853         case AF_INET6:
 854                 {
 855                         /* XXX scopeid */
 856                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 857
 858                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 859                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 860                             sizeof(struct in6_addr)) == 0)) {
 861                                 return (1);
 862                         }
 863                         break;
 864                 }
 865 #endif
 866 #ifdef INET
 867         case AF_INET:
 868                 {
 869                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 870
 871                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 872                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 873                             sizeof(struct in_addr)) == 0)) {
 874                                 return (1);
 875                         }
 876                         break;
 877                 }
 878 #endif
 879         default:
 880                 break;
 881         }
 882         return (0);
 883 }
 884
 885 /*
 886  * does the address match? returns 0 if not, 1 if so
 887  */
 888 static uint32_t
 889 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 890 {
 891 #if defined(INET) || defined(INET6)
 892         uint16_t param_type, param_length;
 893
 894         param_type = ntohs(ph->param_type);
 895         param_length = ntohs(ph->param_length);
 896 #endif
 897         switch (sa->sa_family) {
 898 #ifdef INET6
 899         case AF_INET6:
 900                 {
 901                         /* XXX scopeid */
 902                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 903                         struct sctp_ipv6addr_param *v6addr;
 904
 905                         v6addr = (struct sctp_ipv6addr_param *)ph;
 906                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 907                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 908                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 909                             sizeof(struct in6_addr)) == 0)) {
 910                                 return (1);
 911                         }
 912                         break;
 913                 }
 914 #endif
 915 #ifdef INET
 916         case AF_INET:
 917                 {
 918                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 919                         struct sctp_ipv4addr_param *v4addr;
 920
 921                         v4addr = (struct sctp_ipv4addr_param *)ph;
 922                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 923                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 924                             (memcmp(&v4addr->addr, &sin->sin_addr,
 925                             sizeof(struct in_addr)) == 0)) {
 926                                 return (1);
 927                         }
 928                         break;
 929                 }
 930 #endif
 931         default:
 932                 break;
 933         }
 934         return (0);
 935 }
 936
 937 /*
 938  * Cleanup for non-responded/OP ERR'd ASCONF
 939  */
 940 void
 941 sctp_asconf_cleanup(struct sctp_tcb *stcb)
 942 {
 943         /*
 944          * clear out any existing asconfs going out
 945          */
 946         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, NULL,
 947             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 948         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 949         /* remove the old ASCONF on our outbound queue */
 950         sctp_toss_old_asconf(stcb);
 951 }
 952
 953 /*
 954  * cleanup any cached source addresses that may be topologically
 955  * incorrect after a new address has been added to this interface.
 956  */
 957 static void
 958 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 959 {
 960         struct sctp_nets *net;
 961
 962         /*
 963          * Ideally, we want to only clear cached routes and source addresses
 964          * that are topologically incorrect.  But since there is no easy way
 965          * to know whether the newly added address on the ifn would cause a
 966          * routing change (i.e. a new egress interface would be chosen)
 967          * without doing a new routing lookup and source address selection,
 968          * we will (for now) just flush any cached route using a different
 969          * ifn (and cached source addrs) and let output re-choose them
 970          * during the next send on that net.
 971          */
 972         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 973                 /*
 974                  * clear any cached route (and cached source address) if the
 975                  * route's interface is NOT the same as the address change.
 976                  * If it's the same interface, just clear the cached source
 977                  * address.
 978                  */
 979                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 980                     ((ifn == NULL) ||
 981                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 982                         /* clear any cached route */
 983                         RTFREE(net->ro.ro_rt);
 984                         net->ro.ro_rt = NULL;
 985                 }
 986                 /* clear any cached source address */
 987                 if (net->src_addr_selected) {
 988                         sctp_free_ifa(net->ro._s_addr);
 989                         net->ro._s_addr = NULL;
 990                         net->src_addr_selected = 0;
 991                 }
 992         }
 993 }
 994
 995
 996 void
 997 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 998 {
 999         int error;
1000
1001         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1002                 return;
1003         }
1004         if (stcb->asoc.deleted_primary == NULL) {
1005                 return;
1006         }
1007
1008         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1009                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1010                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1011                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1012                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1013                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1014                     stcb->asoc.deleted_primary,
1015                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1016                 stcb->asoc.num_send_timers_up--;
1017                 if (stcb->asoc.num_send_timers_up < 0) {
1018                         stcb->asoc.num_send_timers_up = 0;
1019                 }
1020                 SCTP_TCB_LOCK_ASSERT(stcb);
1021                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1022                     stcb->asoc.deleted_primary);
1023                 if (error) {
1024                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1025                         return;
1026                 }
1027                 SCTP_TCB_LOCK_ASSERT(stcb);
1028 #ifdef SCTP_AUDITING_ENABLED
1029                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1030 #endif
1031                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1032                 if ((stcb->asoc.num_send_timers_up == 0) &&
1033                     (stcb->asoc.sent_queue_cnt > 0)) {
1034                         struct sctp_tmit_chunk *chk;
1035
1036                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1037                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1038                             stcb, chk->whoTo);
1039                 }
1040         }
1041         return;
1042 }
1043
1044 static int
1045     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1046
1047 void
1048 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1049 {
1050         struct sctp_tmit_chunk *chk;
1051
1052         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1053         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1054             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1055         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1056         net->error_count = 0;
1057         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1058                 if (chk->whoTo == net) {
1059                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1060                                 chk->sent = SCTP_DATAGRAM_RESEND;
1061                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1062                                 sctp_flight_size_decrease(chk);
1063                                 sctp_total_flight_decrease(stcb, chk);
1064                                 net->marked_retrans++;
1065                                 stcb->asoc.marked_retrans++;
1066                         }
1067                 }
1068         }
1069         if (net->marked_retrans) {
1070                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1071         }
1072 }
1073
1074 static void
1075 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1076 {
1077         struct sctp_nets *net;
1078         int addrnum, changed;
1079
1080         /*
1081          * If number of local valid addresses is 1, the valid address is
1082          * probably newly added address. Several valid addresses in this
1083          * association.  A source address may not be changed.  Additionally,
1084          * they can be configured on a same interface as "alias" addresses.
1085          * (by micchie)
1086          */
1087         addrnum = sctp_local_addr_count(stcb);
1088         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1089             addrnum);
1090         if (addrnum == 1) {
1091                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1092                         /* clear any cached route and source address */
1093                         if (net->ro.ro_rt) {
1094                                 RTFREE(net->ro.ro_rt);
1095                                 net->ro.ro_rt = NULL;
1096                         }
1097                         if (net->src_addr_selected) {
1098                                 sctp_free_ifa(net->ro._s_addr);
1099                                 net->ro._s_addr = NULL;
1100                                 net->src_addr_selected = 0;
1101                         }
1102                         /* Retransmit unacknowledged DATA chunks immediately */
1103                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1104                             SCTP_MOBILITY_FASTHANDOFF)) {
1105                                 sctp_net_immediate_retrans(stcb, net);
1106                         }
1107                         /* also, SET PRIMARY is maybe already sent */
1108                 }
1109                 return;
1110         }
1111
1112         /* Multiple local addresses exsist in the association.  */
1113         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1114                 /* clear any cached route and source address */
1115                 if (net->ro.ro_rt) {
1116                         RTFREE(net->ro.ro_rt);
1117                         net->ro.ro_rt = NULL;
1118                 }
1119                 if (net->src_addr_selected) {
1120                         sctp_free_ifa(net->ro._s_addr);
1121                         net->ro._s_addr = NULL;
1122                         net->src_addr_selected = 0;
1123                 }
1124                 /*
1125                  * Check if the nexthop is corresponding to the new address.
1126                  * If the new address is corresponding to the current
1127                  * nexthop, the path will be changed. If the new address is
1128                  * NOT corresponding to the current nexthop, the path will
1129                  * not be changed.
1130                  */
1131                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1132                     stcb->sctp_ep->def_vrf_id,
1133                     stcb->sctp_ep->fibnum);
1134                 if (net->ro.ro_rt == NULL)
1135                         continue;
1136
1137                 changed = 0;
1138                 switch (net->ro._l_addr.sa.sa_family) {
1139 #ifdef INET
1140                 case AF_INET:
1141                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1142                                 changed = 1;
1143                         }
1144                         break;
1145 #endif
1146 #ifdef INET6
1147                 case AF_INET6:
1148                         if (sctp_v6src_match_nexthop(
1149                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1150                                 changed = 1;
1151                         }
1152                         break;
1153 #endif
1154                 default:
1155                         break;
1156                 }
1157                 /*
1158                  * if the newly added address does not relate routing
1159                  * information, we skip.
1160                  */
1161                 if (changed == 0)
1162                         continue;
1163                 /* Retransmit unacknowledged DATA chunks immediately */
1164                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1165                     SCTP_MOBILITY_FASTHANDOFF)) {
1166                         sctp_net_immediate_retrans(stcb, net);
1167                 }
1168                 /* Send SET PRIMARY for this new address */
1169                 if (net == stcb->asoc.primary_destination) {
1170                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1171                             SCTP_SET_PRIM_ADDR);
1172                 }
1173         }
1174 }
1175
1176 /*
1177  * process an ADD/DELETE IP ack from peer.
1178  * addr: corresponding sctp_ifa to the address being added/deleted.
1179  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1180  * flag: 1=success, 0=failure.
1181  */
1182 static void
1183 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1184 {
1185         /*
1186          * do the necessary asoc list work- if we get a failure indication,
1187          * leave the address on the assoc's restricted list.  If we get a
1188          * success indication, remove the address from the restricted list.
1189          */
1190         /*
1191          * Note: this will only occur for ADD_IP_ADDRESS, since
1192          * DEL_IP_ADDRESS is never actually added to the list...
1193          */
1194         if (flag) {
1195                 /* success case, so remove from the restricted list */
1196                 sctp_del_local_addr_restricted(stcb, addr);
1197
1198                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1199                     SCTP_MOBILITY_BASE) ||
1200                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1201                     SCTP_MOBILITY_FASTHANDOFF)) {
1202                         sctp_path_check_and_react(stcb, addr);
1203                         return;
1204                 }
1205                 /* clear any cached/topologically incorrect source addresses */
1206                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1207         }
1208         /* else, leave it on the list */
1209 }
1210
1211 /*
1212  * add an asconf add/delete/set primary IP address parameter to the queue.
1213  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1214  * returns 0 if queued, -1 if not queued/removed.
1215  * NOTE: if adding, but a delete for the same address is already scheduled
1216  * (and not yet sent out), simply remove it from queue.  Same for deleting
1217  * an address already scheduled for add.  If a duplicate operation is found,
1218  * ignore the new one.
1219  */
1220 static int
1221 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1222     uint16_t type)
1223 {
1224         struct sctp_asconf_addr *aa, *aa_next;
1225
1226         /* make sure the request isn't already in the queue */
1227         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1228                 /* address match? */
1229                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1230                         continue;
1231                 /*
1232                  * is the request already in queue but not sent? pass the
1233                  * request already sent in order to resolve the following
1234                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1235                  * can't remove the ADD request already sent 3. arrival of
1236                  * ADD
1237                  */
1238                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1239                         return (-1);
1240                 }
1241                 /* is the negative request already in queue, and not sent */
1242                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1243                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1244                         /* add requested, delete already queued */
1245                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1246                         /* remove the ifa from the restricted list */
1247                         sctp_del_local_addr_restricted(stcb, ifa);
1248                         /* free the asconf param */
1249                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1250                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1251                         return (-1);
1252                 }
1253                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1254                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1255                         /* delete requested, add already queued */
1256                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1257                         /* remove the aa->ifa from the restricted list */
1258                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1259                         /* free the asconf param */
1260                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1261                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1262                         return (-1);
1263                 }
1264         }                       /* for each aa */
1265
1266         /* adding new request to the queue */
1267         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1268             SCTP_M_ASC_ADDR);
1269         if (aa == NULL) {
1270                 /* didn't get memory */
1271                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1272                 return (-1);
1273         }
1274         aa->special_del = 0;
1275         /* fill in asconf address parameter fields */
1276         /* top level elements are "networked" during send */
1277         aa->ap.aph.ph.param_type = type;
1278         aa->ifa = ifa;
1279         atomic_add_int(&ifa->refcount, 1);
1280         /* correlation_id filled in during send routine later... */
1281         switch (ifa->address.sa.sa_family) {
1282 #ifdef INET6
1283         case AF_INET6:
1284                 {
1285                         struct sockaddr_in6 *sin6;
1286
1287                         sin6 = &ifa->address.sin6;
1288                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1289                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1290                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1291                             sizeof(struct sctp_ipv6addr_param);
1292                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1293                             sizeof(struct in6_addr));
1294                         break;
1295                 }
1296 #endif
1297 #ifdef INET
1298         case AF_INET:
1299                 {
1300                         struct sockaddr_in *sin;
1301
1302                         sin = &ifa->address.sin;
1303                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1304                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1305                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1306                             sizeof(struct sctp_ipv4addr_param);
1307                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1308                             sizeof(struct in_addr));
1309                         break;
1310                 }
1311 #endif
1312         default:
1313                 /* invalid family! */
1314                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1315                 sctp_free_ifa(ifa);
1316                 return (-1);
1317         }
1318         aa->sent = 0;           /* clear sent flag */
1319
1320         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1321 #ifdef SCTP_DEBUG
1322         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1323                 if (type == SCTP_ADD_IP_ADDRESS) {
1324                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1325                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1326                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1327                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1328                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1329                 } else {
1330                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1331                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1332                 }
1333         }
1334 #endif
1335
1336         return (0);
1337 }
1338
1339
1340 /*
1341  * add an asconf operation for the given ifa and type.
1342  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1343  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1344  * advisable.
1345  */
1346 static int
1347 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1348     uint16_t type)
1349 {
1350         uint32_t status;
1351         int pending_delete_queued = 0;
1352         int last;
1353
1354         /* see if peer supports ASCONF */
1355         if (stcb->asoc.asconf_supported == 0) {
1356                 return (-1);
1357         }
1358
1359         /*
1360          * if this is deleting the last address from the assoc, mark it as
1361          * pending.
1362          */
1363         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1364                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1365                         last = (sctp_local_addr_count(stcb) == 0);
1366                 } else {
1367                         last = (sctp_local_addr_count(stcb) == 1);
1368                 }
1369                 if (last) {
1370                         /* set the pending delete info only */
1371                         stcb->asoc.asconf_del_pending = 1;
1372                         stcb->asoc.asconf_addr_del_pending = ifa;
1373                         atomic_add_int(&ifa->refcount, 1);
1374                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1375                             "asconf_queue_add: mark delete last address pending\n");
1376                         return (-1);
1377                 }
1378         }
1379
1380         /* queue an asconf parameter */
1381         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1382
1383         /*
1384          * if this is an add, and there is a delete also pending (i.e. the
1385          * last local address is being changed), queue the pending delete
1386          * too.
1387          */
1388         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1389                 /* queue in the pending delete */
1390                 if (sctp_asconf_queue_mgmt(stcb,
1391                     stcb->asoc.asconf_addr_del_pending,
1392                     SCTP_DEL_IP_ADDRESS) == 0) {
1393                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queuing pending delete\n");
1394                         pending_delete_queued = 1;
1395                         /* clear out the pending delete info */
1396                         stcb->asoc.asconf_del_pending = 0;
1397                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1398                         stcb->asoc.asconf_addr_del_pending = NULL;
1399                 }
1400         }
1401
1402         if (pending_delete_queued) {
1403                 struct sctp_nets *net;
1404
1405                 /*
1406                  * since we know that the only/last address is now being
1407                  * changed in this case, reset the cwnd/rto on all nets to
1408                  * start as a new address and path.  Also clear the error
1409                  * counts to give the assoc the best chance to complete the
1410                  * address change.
1411                  */
1412                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1413                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1414                             net);
1415                         net->RTO = 0;
1416                         net->error_count = 0;
1417                 }
1418                 stcb->asoc.overall_error_count = 0;
1419                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1420                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1421                             stcb->asoc.overall_error_count,
1422                             0,
1423                             SCTP_FROM_SCTP_ASCONF,
1424                             __LINE__);
1425                 }
1426
1427                 /* queue in an advisory set primary too */
1428                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1429                 /* let caller know we should send this out immediately */
1430                 status = 1;
1431         }
1432         return (status);
1433 }
1434
1435 /*-
1436  * add an asconf delete IP address parameter to the queue by sockaddr and
1437  * possibly with no sctp_ifa available.  This is only called by the routine
1438  * that checks the addresses in an INIT-ACK against the current address list.
1439  * returns 0 if completed, non-zero if not completed.
1440  * NOTE: if an add is already scheduled (and not yet sent out), simply
1441  * remove it from queue.  If a duplicate operation is found, ignore the
1442  * new one.
1443  */
1444 static int
1445 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1446 {
1447         struct sctp_ifa *ifa;
1448         struct sctp_asconf_addr *aa, *aa_next;
1449
1450         if (stcb == NULL) {
1451                 return (-1);
1452         }
1453         /* see if peer supports ASCONF */
1454         if (stcb->asoc.asconf_supported == 0) {
1455                 return (-1);
1456         }
1457         /* make sure the request isn't already in the queue */
1458         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1459                 /* address match? */
1460                 if (sctp_asconf_addr_match(aa, sa) == 0)
1461                         continue;
1462                 /* is the request already in queue (sent or not) */
1463                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1464                         return (-1);
1465                 }
1466                 /* is the negative request already in queue, and not sent */
1467                 if (aa->sent == 1)
1468                         continue;
1469                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1470                         /* add already queued, so remove existing entry */
1471                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1472                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1473                         /* free the entry */
1474                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1475                         return (-1);
1476                 }
1477         }                       /* for each aa */
1478
1479         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1480         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1481
1482         /* adding new request to the queue */
1483         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1484             SCTP_M_ASC_ADDR);
1485         if (aa == NULL) {
1486                 /* didn't get memory */
1487                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1488                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1489                 return (-1);
1490         }
1491         aa->special_del = 0;
1492         /* fill in asconf address parameter fields */
1493         /* top level elements are "networked" during send */
1494         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1495         aa->ifa = ifa;
1496         if (ifa)
1497                 atomic_add_int(&ifa->refcount, 1);
1498         /* correlation_id filled in during send routine later... */
1499         switch (sa->sa_family) {
1500 #ifdef INET6
1501         case AF_INET6:
1502                 {
1503                         /* IPv6 address */
1504                         struct sockaddr_in6 *sin6;
1505
1506                         sin6 = (struct sockaddr_in6 *)sa;
1507                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1508                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1509                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1510                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1511                             sizeof(struct in6_addr));
1512                         break;
1513                 }
1514 #endif
1515 #ifdef INET
1516         case AF_INET:
1517                 {
1518                         /* IPv4 address */
1519                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1520
1521                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1522                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1523                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1524                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1525                             sizeof(struct in_addr));
1526                         break;
1527                 }
1528 #endif
1529         default:
1530                 /* invalid family! */
1531                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1532                 if (ifa)
1533                         sctp_free_ifa(ifa);
1534                 return (-1);
1535         }
1536         aa->sent = 0;           /* clear sent flag */
1537
1538         /* delete goes to the back of the queue */
1539         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1540
1541         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1542         return (0);
1543 }
1544
1545 /*
1546  * find a specific asconf param on our "sent" queue
1547  */
1548 static struct sctp_asconf_addr *
1549 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1550 {
1551         struct sctp_asconf_addr *aa;
1552
1553         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1554                 if (aa->ap.aph.correlation_id == correlation_id &&
1555                     aa->sent == 1) {
1556                         /* found it */
1557                         return (aa);
1558                 }
1559         }
1560         /* didn't find it */
1561         return (NULL);
1562 }
1563
1564 /*
1565  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1566  * notifications based on the error response
1567  */
1568 static void
1569 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1570     struct sctp_asconf_paramhdr *aph)
1571 {
1572         struct sctp_error_cause *eh;
1573         struct sctp_paramhdr *ph;
1574         uint16_t param_type;
1575         uint16_t error_code;
1576
1577         eh = (struct sctp_error_cause *)(aph + 1);
1578         ph = (struct sctp_paramhdr *)(eh + 1);
1579         /* validate lengths */
1580         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1581             htons(aph->ph.param_length)) {
1582                 /* invalid error cause length */
1583                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1584                     "asconf_process_error: cause element too long\n");
1585                 return;
1586         }
1587         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1588             htons(eh->length)) {
1589                 /* invalid included TLV length */
1590                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1591                     "asconf_process_error: included TLV too long\n");
1592                 return;
1593         }
1594         /* which error code ? */
1595         error_code = ntohs(eh->code);
1596         param_type = ntohs(aph->ph.param_type);
1597         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1598         switch (error_code) {
1599         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1600                 /* we allow ourselves to "try again" for this error */
1601                 break;
1602         default:
1603                 /* peer can't handle it... */
1604                 switch (param_type) {
1605                 case SCTP_ADD_IP_ADDRESS:
1606                 case SCTP_DEL_IP_ADDRESS:
1607                 case SCTP_SET_PRIM_ADDR:
1608                         break;
1609                 default:
1610                         break;
1611                 }
1612         }
1613 }
1614
1615 /*
1616  * process an asconf queue param.
1617  * aparam: parameter to process, will be removed from the queue.
1618  * flag: 1=success case, 0=failure case
1619  */
1620 static void
1621 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1622     struct sctp_asconf_addr *aparam, uint32_t flag)
1623 {
1624         uint16_t param_type;
1625
1626         /* process this param */
1627         param_type = aparam->ap.aph.ph.param_type;
1628         switch (param_type) {
1629         case SCTP_ADD_IP_ADDRESS:
1630                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1631                     "process_param_ack: added IP address\n");
1632                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1633                 break;
1634         case SCTP_DEL_IP_ADDRESS:
1635                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1636                     "process_param_ack: deleted IP address\n");
1637                 /* nothing really to do... lists already updated */
1638                 break;
1639         case SCTP_SET_PRIM_ADDR:
1640                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1641                     "process_param_ack: set primary IP address\n");
1642                 /* nothing to do... peer may start using this addr */
1643                 break;
1644         default:
1645                 /* should NEVER happen */
1646                 break;
1647         }
1648
1649         /* remove the param and free it */
1650         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1651         if (aparam->ifa)
1652                 sctp_free_ifa(aparam->ifa);
1653         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1654 }
1655
1656 /*
1657  * cleanup from a bad asconf ack parameter
1658  */
1659 static void
1660 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1661 {
1662         /* assume peer doesn't really know how to do asconfs */
1663         /* XXX we could free the pending queue here */
1664
1665 }
1666
1667 void
1668 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1669     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1670     struct sctp_nets *net, int *abort_no_unlock)
1671 {
1672         struct sctp_association *asoc;
1673         uint32_t serial_num;
1674         uint16_t ack_length;
1675         struct sctp_asconf_paramhdr *aph;
1676         struct sctp_asconf_addr *aa, *aa_next;
1677         uint32_t last_error_id = 0;     /* last error correlation id */
1678         uint32_t id;
1679         struct sctp_asconf_addr *ap;
1680
1681         /* asconf param buffer */
1682         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1683
1684         /* verify minimum length */
1685         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1686                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1687                     "handle_asconf_ack: chunk too small = %xh\n",
1688                     ntohs(cp->ch.chunk_length));
1689                 return;
1690         }
1691         asoc = &stcb->asoc;
1692         serial_num = ntohl(cp->serial_number);
1693
1694         /*
1695          * NOTE: we may want to handle this differently- currently, we will
1696          * abort when we get an ack for the expected serial number + 1 (eg.
1697          * we didn't send it), process an ack normally if it is the expected
1698          * serial number, and re-send the previous ack for *ALL* other
1699          * serial numbers
1700          */
1701
1702         /*
1703          * if the serial number is the next expected, but I didn't send it,
1704          * abort the asoc, since someone probably just hijacked us...
1705          */
1706         if (serial_num == (asoc->asconf_seq_out + 1)) {
1707                 struct mbuf *op_err;
1708                 char msg[SCTP_DIAG_INFO_LEN];
1709
1710                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1711                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1712                     serial_num);
1713                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1714                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1715                 *abort_no_unlock = 1;
1716                 return;
1717         }
1718         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1719                 /* got a duplicate/unexpected ASCONF-ACK */
1720                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1721                     serial_num, asoc->asconf_seq_out_acked + 1);
1722                 return;
1723         }
1724
1725         if (serial_num == asoc->asconf_seq_out - 1) {
1726                 /* stop our timer */
1727                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, NULL,
1728                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1729         }
1730
1731         /* process the ASCONF-ACK contents */
1732         ack_length = ntohs(cp->ch.chunk_length) -
1733             sizeof(struct sctp_asconf_ack_chunk);
1734         offset += sizeof(struct sctp_asconf_ack_chunk);
1735         /* process through all parameters */
1736         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1737                 unsigned int param_length, param_type;
1738
1739                 /* get pointer to next asconf parameter */
1740                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1741                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1742                 if (aph == NULL) {
1743                         /* can't get an asconf paramhdr */
1744                         sctp_asconf_ack_clear(stcb);
1745                         return;
1746                 }
1747                 param_type = ntohs(aph->ph.param_type);
1748                 param_length = ntohs(aph->ph.param_length);
1749                 if (param_length > ack_length) {
1750                         sctp_asconf_ack_clear(stcb);
1751                         return;
1752                 }
1753                 if (param_length < sizeof(struct sctp_paramhdr)) {
1754                         sctp_asconf_ack_clear(stcb);
1755                         return;
1756                 }
1757                 /* get the complete parameter... */
1758                 if (param_length > sizeof(aparam_buf)) {
1759                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1760                             "param length (%u) larger than buffer size!\n", param_length);
1761                         sctp_asconf_ack_clear(stcb);
1762                         return;
1763                 }
1764                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1765                 if (aph == NULL) {
1766                         sctp_asconf_ack_clear(stcb);
1767                         return;
1768                 }
1769                 /* correlation_id is transparent to peer, no ntohl needed */
1770                 id = aph->correlation_id;
1771
1772                 switch (param_type) {
1773                 case SCTP_ERROR_CAUSE_IND:
1774                         last_error_id = id;
1775                         /* find the corresponding asconf param in our queue */
1776                         ap = sctp_asconf_find_param(stcb, id);
1777                         if (ap == NULL) {
1778                                 /* hmm... can't find this in our queue! */
1779                                 break;
1780                         }
1781                         /* process the parameter, failed flag */
1782                         sctp_asconf_process_param_ack(stcb, ap, 0);
1783                         /* process the error response */
1784                         sctp_asconf_process_error(stcb, aph);
1785                         break;
1786                 case SCTP_SUCCESS_REPORT:
1787                         /* find the corresponding asconf param in our queue */
1788                         ap = sctp_asconf_find_param(stcb, id);
1789                         if (ap == NULL) {
1790                                 /* hmm... can't find this in our queue! */
1791                                 break;
1792                         }
1793                         /* process the parameter, success flag */
1794                         sctp_asconf_process_param_ack(stcb, ap, 1);
1795                         break;
1796                 default:
1797                         break;
1798                 }               /* switch */
1799
1800                 /* update remaining ASCONF-ACK message length to process */
1801                 ack_length -= SCTP_SIZE32(param_length);
1802                 if (ack_length <= 0) {
1803                         /* no more data in the mbuf chain */
1804                         break;
1805                 }
1806                 offset += SCTP_SIZE32(param_length);
1807         }                       /* while */
1808
1809         /*
1810          * if there are any "sent" params still on the queue, these are
1811          * implicitly "success", or "failed" (if we got an error back) ...
1812          * so process these appropriately
1813          *
1814          * we assume that the correlation_id's are monotonically increasing
1815          * beginning from 1 and that we don't have *that* many outstanding
1816          * at any given time
1817          */
1818         if (last_error_id == 0)
1819                 last_error_id--;        /* set to "max" value */
1820         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1821                 if (aa->sent == 1) {
1822                         /*
1823                          * implicitly successful or failed if correlation_id
1824                          * < last_error_id, then success else, failure
1825                          */
1826                         if (aa->ap.aph.correlation_id < last_error_id)
1827                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1828                         else
1829                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1830                 } else {
1831                         /*
1832                          * since we always process in order (FIFO queue) if
1833                          * we reach one that hasn't been sent, the rest
1834                          * should not have been sent either. so, we're
1835                          * done...
1836                          */
1837                         break;
1838                 }
1839         }
1840
1841         /* update the next sequence number to use */
1842         asoc->asconf_seq_out_acked++;
1843         /* remove the old ASCONF on our outbound queue */
1844         sctp_toss_old_asconf(stcb);
1845         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1846 #ifdef SCTP_TIMER_BASED_ASCONF
1847                 /* we have more params, so restart our timer */
1848                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1849                     stcb, net);
1850 #else
1851                 /* we have more params, so send out more */
1852                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1853 #endif
1854         }
1855 }
1856
1857 #ifdef INET6
1858 static uint32_t
1859 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1860 {
1861         struct sockaddr_in6 *sin6, *net6;
1862         struct sctp_nets *net;
1863
1864         if (sa->sa_family != AF_INET6) {
1865                 /* wrong family */
1866                 return (0);
1867         }
1868         sin6 = (struct sockaddr_in6 *)sa;
1869         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1870                 /* not link local address */
1871                 return (0);
1872         }
1873         /* hunt through our destination nets list for this scope_id */
1874         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1875                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1876                     AF_INET6)
1877                         continue;
1878                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1879                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1880                         continue;
1881                 if (sctp_is_same_scope(sin6, net6)) {
1882                         /* found one */
1883                         return (1);
1884                 }
1885         }
1886         /* didn't find one */
1887         return (0);
1888 }
1889 #endif
1890
1891 /*
1892  * address management functions
1893  */
1894 static void
1895 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1896     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1897 {
1898         int status;
1899
1900         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1901             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1902                 /* subset bound, no ASCONF allowed case, so ignore */
1903                 return;
1904         }
1905         /*
1906          * note: we know this is not the subset bound, no ASCONF case eg.
1907          * this is boundall or subset bound w/ASCONF allowed
1908          */
1909
1910         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1911         switch (ifa->address.sa.sa_family) {
1912 #ifdef INET6
1913         case AF_INET6:
1914                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1915                     &ifa->address.sin6.sin6_addr) != 0) {
1916                         return;
1917                 }
1918                 break;
1919 #endif
1920 #ifdef INET
1921         case AF_INET:
1922                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1923                     &ifa->address.sin.sin_addr) != 0) {
1924                         return;
1925                 }
1926                 break;
1927 #endif
1928         default:
1929                 return;
1930         }
1931 #ifdef INET6
1932         /* make sure we're "allowed" to add this type of addr */
1933         if (ifa->address.sa.sa_family == AF_INET6) {
1934                 /* invalid if we're not a v6 endpoint */
1935                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1936                         return;
1937                 /* is the v6 addr really valid ? */
1938                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1939                         return;
1940                 }
1941         }
1942 #endif
1943         /* put this address on the "pending/do not use yet" list */
1944         sctp_add_local_addr_restricted(stcb, ifa);
1945         /*
1946          * check address scope if address is out of scope, don't queue
1947          * anything... note: this would leave the address on both inp and
1948          * asoc lists
1949          */
1950         switch (ifa->address.sa.sa_family) {
1951 #ifdef INET6
1952         case AF_INET6:
1953                 {
1954                         struct sockaddr_in6 *sin6;
1955
1956                         sin6 = &ifa->address.sin6;
1957                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1958                                 /* we skip unspecifed addresses */
1959                                 return;
1960                         }
1961                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1962                                 if (stcb->asoc.scope.local_scope == 0) {
1963                                         return;
1964                                 }
1965                                 /* is it the right link local scope? */
1966                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1967                                         return;
1968                                 }
1969                         }
1970                         if (stcb->asoc.scope.site_scope == 0 &&
1971                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1972                                 return;
1973                         }
1974                         break;
1975                 }
1976 #endif
1977 #ifdef INET
1978         case AF_INET:
1979                 {
1980                         struct sockaddr_in *sin;
1981
1982                         /* invalid if we are a v6 only endpoint */
1983                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1984                             SCTP_IPV6_V6ONLY(inp))
1985                                 return;
1986
1987                         sin = &ifa->address.sin;
1988                         if (sin->sin_addr.s_addr == 0) {
1989                                 /* we skip unspecifed addresses */
1990                                 return;
1991                         }
1992                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1993                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1994                                 return;
1995                         }
1996                         break;
1997                 }
1998 #endif
1999         default:
2000                 /* else, not AF_INET or AF_INET6, so skip */
2001                 return;
2002         }
2003
2004         /* queue an asconf for this address add/delete */
2005         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
2006                 /* does the peer do asconf? */
2007                 if (stcb->asoc.asconf_supported) {
2008                         /* queue an asconf for this addr */
2009                         status = sctp_asconf_queue_add(stcb, ifa, type);
2010
2011                         /*
2012                          * if queued ok, and in the open state, send out the
2013                          * ASCONF.  If in the non-open state, these will be
2014                          * sent when the state goes open.
2015                          */
2016                         if (status == 0 &&
2017                             ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2018                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
2019 #ifdef SCTP_TIMER_BASED_ASCONF
2020                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2021                                     stcb, stcb->asoc.primary_destination);
2022 #else
2023                                 sctp_send_asconf(stcb, NULL, addr_locked);
2024 #endif
2025                         }
2026                 }
2027         }
2028 }
2029
2030
2031 int
2032 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2033 {
2034         struct sctp_asconf_iterator *asc;
2035         struct sctp_ifa *ifa;
2036         struct sctp_laddr *l;
2037         int cnt_invalid = 0;
2038
2039         asc = (struct sctp_asconf_iterator *)ptr;
2040         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2041                 ifa = l->ifa;
2042                 switch (ifa->address.sa.sa_family) {
2043 #ifdef INET6
2044                 case AF_INET6:
2045                         /* invalid if we're not a v6 endpoint */
2046                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2047                                 cnt_invalid++;
2048                                 if (asc->cnt == cnt_invalid)
2049                                         return (1);
2050                         }
2051                         break;
2052 #endif
2053 #ifdef INET
2054                 case AF_INET:
2055                         {
2056                                 /* invalid if we are a v6 only endpoint */
2057                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2058                                     SCTP_IPV6_V6ONLY(inp)) {
2059                                         cnt_invalid++;
2060                                         if (asc->cnt == cnt_invalid)
2061                                                 return (1);
2062                                 }
2063                                 break;
2064                         }
2065 #endif
2066                 default:
2067                         /* invalid address family */
2068                         cnt_invalid++;
2069                         if (asc->cnt == cnt_invalid)
2070                                 return (1);
2071                 }
2072         }
2073         return (0);
2074 }
2075
2076 static int
2077 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2078 {
2079         struct sctp_ifa *ifa;
2080         struct sctp_asconf_iterator *asc;
2081         struct sctp_laddr *laddr, *nladdr, *l;
2082
2083         /* Only for specific case not bound all */
2084         asc = (struct sctp_asconf_iterator *)ptr;
2085         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2086                 ifa = l->ifa;
2087                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2088                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2089                             sctp_nxt_addr) {
2090                                 if (laddr->ifa == ifa) {
2091                                         laddr->action = 0;
2092                                         break;
2093                                 }
2094
2095                         }
2096                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2097                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2098                                 /* remove only after all guys are done */
2099                                 if (laddr->ifa == ifa) {
2100                                         sctp_del_local_addr_ep(inp, ifa);
2101                                 }
2102                         }
2103                 }
2104         }
2105         return (0);
2106 }
2107
2108 void
2109 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2110     void *ptr, uint32_t val SCTP_UNUSED)
2111 {
2112         struct sctp_asconf_iterator *asc;
2113         struct sctp_ifa *ifa;
2114         struct sctp_laddr *l;
2115         int cnt_invalid = 0;
2116         int type, status;
2117         int num_queued = 0;
2118
2119         asc = (struct sctp_asconf_iterator *)ptr;
2120         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2121                 ifa = l->ifa;
2122                 type = l->action;
2123
2124                 /* address's vrf_id must be the vrf_id of the assoc */
2125                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2126                         continue;
2127                 }
2128
2129                 /* Same checks again for assoc */
2130                 switch (ifa->address.sa.sa_family) {
2131 #ifdef INET6
2132                 case AF_INET6:
2133                         {
2134                                 /* invalid if we're not a v6 endpoint */
2135                                 struct sockaddr_in6 *sin6;
2136
2137                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2138                                         cnt_invalid++;
2139                                         if (asc->cnt == cnt_invalid)
2140                                                 return;
2141                                         else
2142                                                 continue;
2143                                 }
2144                                 sin6 = &ifa->address.sin6;
2145                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2146                                         /* we skip unspecifed addresses */
2147                                         continue;
2148                                 }
2149                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2150                                     &sin6->sin6_addr) != 0) {
2151                                         continue;
2152                                 }
2153                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2154                                         if (stcb->asoc.scope.local_scope == 0) {
2155                                                 continue;
2156                                         }
2157                                         /* is it the right link local scope? */
2158                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2159                                                 continue;
2160                                         }
2161                                 }
2162                                 break;
2163                         }
2164 #endif
2165 #ifdef INET
2166                 case AF_INET:
2167                         {
2168                                 /* invalid if we are a v6 only endpoint */
2169                                 struct sockaddr_in *sin;
2170
2171                                 /* invalid if we are a v6 only endpoint */
2172                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2173                                     SCTP_IPV6_V6ONLY(inp))
2174                                         continue;
2175
2176                                 sin = &ifa->address.sin;
2177                                 if (sin->sin_addr.s_addr == 0) {
2178                                         /* we skip unspecifed addresses */
2179                                         continue;
2180                                 }
2181                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2182                                     &sin->sin_addr) != 0) {
2183                                         continue;
2184                                 }
2185                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2186                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2187                                         continue;
2188                                 }
2189                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2190                                     SCTP_IPV6_V6ONLY(inp)) {
2191                                         cnt_invalid++;
2192                                         if (asc->cnt == cnt_invalid)
2193                                                 return;
2194                                         else
2195                                                 continue;
2196                                 }
2197                                 break;
2198                         }
2199 #endif
2200                 default:
2201                         /* invalid address family */
2202                         cnt_invalid++;
2203                         if (asc->cnt == cnt_invalid)
2204                                 return;
2205                         else
2206                                 continue;
2207                         break;
2208                 }
2209
2210                 if (type == SCTP_ADD_IP_ADDRESS) {
2211                         /* prevent this address from being used as a source */
2212                         sctp_add_local_addr_restricted(stcb, ifa);
2213                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2214                         struct sctp_nets *net;
2215
2216                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2217                                 sctp_rtentry_t *rt;
2218
2219                                 /* delete this address if cached */
2220                                 if (net->ro._s_addr == ifa) {
2221                                         sctp_free_ifa(net->ro._s_addr);
2222                                         net->ro._s_addr = NULL;
2223                                         net->src_addr_selected = 0;
2224                                         rt = net->ro.ro_rt;
2225                                         if (rt) {
2226                                                 RTFREE(rt);
2227                                                 net->ro.ro_rt = NULL;
2228                                         }
2229                                         /*
2230                                          * Now we deleted our src address,
2231                                          * should we not also now reset the
2232                                          * cwnd/rto to start as if its a new
2233                                          * address?
2234                                          */
2235                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2236                                         net->RTO = 0;
2237
2238                                 }
2239                         }
2240                 } else if (type == SCTP_SET_PRIM_ADDR) {
2241                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2242                                 /* must validate the ifa is in the ep */
2243                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2244                                         continue;
2245                                 }
2246                         } else {
2247                                 /* Need to check scopes for this guy */
2248                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2249                                         continue;
2250                                 }
2251                         }
2252                 }
2253                 /* queue an asconf for this address add/delete */
2254                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2255                     stcb->asoc.asconf_supported == 1) {
2256                         /* queue an asconf for this addr */
2257                         status = sctp_asconf_queue_add(stcb, ifa, type);
2258                         /*
2259                          * if queued ok, and in the open state, update the
2260                          * count of queued params.  If in the non-open
2261                          * state, these get sent when the assoc goes open.
2262                          */
2263                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2264                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2265                                 if (status >= 0) {
2266                                         num_queued++;
2267                                 }
2268                         }
2269                 }
2270         }
2271         /*
2272          * If we have queued params in the open state, send out an ASCONF.
2273          */
2274         if (num_queued > 0) {
2275                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2276         }
2277 }
2278
2279 void
2280 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2281 {
2282         struct sctp_asconf_iterator *asc;
2283         struct sctp_ifa *ifa;
2284         struct sctp_laddr *l, *nl;
2285
2286         asc = (struct sctp_asconf_iterator *)ptr;
2287         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2288                 ifa = l->ifa;
2289                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2290                         /* Clear the defer use flag */
2291                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2292                 }
2293                 sctp_free_ifa(ifa);
2294                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2295                 SCTP_DECR_LADDR_COUNT();
2296         }
2297         SCTP_FREE(asc, SCTP_M_ASC_IT);
2298 }
2299
2300 /*
2301  * sa is the sockaddr to ask the peer to set primary to.
2302  * returns: 0 = completed, -1 = error
2303  */
2304 int32_t
2305 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2306 {
2307         uint32_t vrf_id;
2308         struct sctp_ifa *ifa;
2309
2310         /* find the ifa for the desired set primary */
2311         vrf_id = stcb->asoc.vrf_id;
2312         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2313         if (ifa == NULL) {
2314                 /* Invalid address */
2315                 return (-1);
2316         }
2317
2318         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2319         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2320                 /* set primary queuing succeeded */
2321                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2322                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2323                     (void *)stcb);
2324                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2325                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2326                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2327 #ifdef SCTP_TIMER_BASED_ASCONF
2328                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2329                             stcb->sctp_ep, stcb,
2330                             stcb->asoc.primary_destination);
2331 #else
2332                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2333 #endif
2334                 }
2335         } else {
2336                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2337                     (void *)stcb);
2338                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2339                 return (-1);
2340         }
2341         return (0);
2342 }
2343
2344 int
2345 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2346 {
2347         struct sctp_tmit_chunk *chk, *nchk;
2348         unsigned int offset, asconf_limit;
2349         struct sctp_asconf_chunk *acp;
2350         struct sctp_asconf_paramhdr *aph;
2351         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2352         struct sctp_paramhdr *ph;
2353         int add_cnt, del_cnt;
2354         uint16_t last_param_type;
2355
2356         add_cnt = del_cnt = 0;
2357         last_param_type = 0;
2358         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2359                 if (chk->data == NULL) {
2360                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2361                         continue;
2362                 }
2363                 offset = 0;
2364                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2365                 offset += sizeof(struct sctp_asconf_chunk);
2366                 asconf_limit = ntohs(acp->ch.chunk_length);
2367                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2368                 if (ph == NULL) {
2369                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2370                         continue;
2371                 }
2372                 offset += ntohs(ph->param_length);
2373
2374                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2375                 if (aph == NULL) {
2376                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2377                         continue;
2378                 }
2379                 while (aph != NULL) {
2380                         unsigned int param_length, param_type;
2381
2382                         param_type = ntohs(aph->ph.param_type);
2383                         param_length = ntohs(aph->ph.param_length);
2384                         if (offset + param_length > asconf_limit) {
2385                                 /* parameter goes beyond end of chunk! */
2386                                 break;
2387                         }
2388                         if (param_length > sizeof(aparam_buf)) {
2389                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2390                                 break;
2391                         }
2392                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2393                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2394                                 break;
2395                         }
2396
2397                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2398                         if (aph == NULL) {
2399                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2400                                 break;
2401                         }
2402
2403                         ph = (struct sctp_paramhdr *)(aph + 1);
2404                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2405                                 switch (param_type) {
2406                                 case SCTP_ADD_IP_ADDRESS:
2407                                         add_cnt++;
2408                                         break;
2409                                 case SCTP_DEL_IP_ADDRESS:
2410                                         del_cnt++;
2411                                         break;
2412                                 default:
2413                                         break;
2414                                 }
2415                                 last_param_type = param_type;
2416                         }
2417
2418                         offset += SCTP_SIZE32(param_length);
2419                         if (offset >= asconf_limit) {
2420                                 /* no more data in the mbuf chain */
2421                                 break;
2422                         }
2423                         /* get pointer to next asconf param */
2424                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2425                 }
2426         }
2427
2428         /*
2429          * we want to find the sequences which consist of ADD -> DEL -> ADD
2430          * or DEL -> ADD
2431          */
2432         if (add_cnt > del_cnt ||
2433             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2434                 return (1);
2435         }
2436         return (0);
2437 }
2438
2439 static struct sockaddr *
2440 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2441 {
2442         struct sctp_vrf *vrf = NULL;
2443         struct sctp_ifn *sctp_ifn;
2444         struct sctp_ifa *sctp_ifa;
2445
2446         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2447                 SCTP_IPI_ADDR_RLOCK();
2448         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2449         if (vrf == NULL) {
2450                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2451                         SCTP_IPI_ADDR_RUNLOCK();
2452                 return (NULL);
2453         }
2454         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2455                 if (stcb->asoc.scope.loopback_scope == 0 &&
2456                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2457                         /* Skip if loopback_scope not set */
2458                         continue;
2459                 }
2460                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2461                         switch (sctp_ifa->address.sa.sa_family) {
2462 #ifdef INET
2463                         case AF_INET:
2464                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2465                                         struct sockaddr_in *sin;
2466
2467                                         sin = &sctp_ifa->address.sin;
2468                                         if (sin->sin_addr.s_addr == 0) {
2469                                                 /* skip unspecifed addresses */
2470                                                 continue;
2471                                         }
2472                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2473                                             &sin->sin_addr) != 0) {
2474                                                 continue;
2475                                         }
2476                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2477                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2478                                                 continue;
2479
2480                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2481                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2482                                                 continue;
2483                                         /*
2484                                          * found a valid local v4 address to
2485                                          * use
2486                                          */
2487                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2488                                                 SCTP_IPI_ADDR_RUNLOCK();
2489                                         return (&sctp_ifa->address.sa);
2490                                 }
2491                                 break;
2492 #endif
2493 #ifdef INET6
2494                         case AF_INET6:
2495                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2496                                         struct sockaddr_in6 *sin6;
2497
2498                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2499                                                 continue;
2500                                         }
2501
2502                                         sin6 = &sctp_ifa->address.sin6;
2503                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2504                                                 /*
2505                                                  * we skip unspecifed
2506                                                  * addresses
2507                                                  */
2508                                                 continue;
2509                                         }
2510                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2511                                             &sin6->sin6_addr) != 0) {
2512                                                 continue;
2513                                         }
2514                                         if (stcb->asoc.scope.local_scope == 0 &&
2515                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2516                                                 continue;
2517                                         if (stcb->asoc.scope.site_scope == 0 &&
2518                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2519                                                 continue;
2520
2521                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2522                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2523                                                 continue;
2524                                         /*
2525                                          * found a valid local v6 address to
2526                                          * use
2527                                          */
2528                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2529                                                 SCTP_IPI_ADDR_RUNLOCK();
2530                                         return (&sctp_ifa->address.sa);
2531                                 }
2532                                 break;
2533 #endif
2534                         default:
2535                                 break;
2536                         }
2537                 }
2538         }
2539         /* no valid addresses found */
2540         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2541                 SCTP_IPI_ADDR_RUNLOCK();
2542         return (NULL);
2543 }
2544
2545 static struct sockaddr *
2546 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2547 {
2548         struct sctp_laddr *laddr;
2549
2550         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2551                 if (laddr->ifa == NULL) {
2552                         continue;
2553                 }
2554                 /* is the address restricted ? */
2555                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2556                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2557                         continue;
2558
2559                 /* found a valid local address to use */
2560                 return (&laddr->ifa->address.sa);
2561         }
2562         /* no valid addresses found */
2563         return (NULL);
2564 }
2565
2566 /*
2567  * builds an ASCONF chunk from queued ASCONF params.
2568  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2569  */
2570 struct mbuf *
2571 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2572 {
2573         struct mbuf *m_asconf, *m_asconf_chk;
2574         struct sctp_asconf_addr *aa;
2575         struct sctp_asconf_chunk *acp;
2576         struct sctp_asconf_paramhdr *aph;
2577         struct sctp_asconf_addr_param *aap;
2578         uint32_t p_length;
2579         uint32_t correlation_id = 1;    /* 0 is reserved... */
2580         caddr_t ptr, lookup_ptr;
2581         uint8_t lookup_used = 0;
2582
2583         /* are there any asconf params to send? */
2584         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2585                 if (aa->sent == 0)
2586                         break;
2587         }
2588         if (aa == NULL)
2589                 return (NULL);
2590
2591         /*
2592          * get a chunk header mbuf and a cluster for the asconf params since
2593          * it's simpler to fill in the asconf chunk header lookup address on
2594          * the fly
2595          */
2596         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2597         if (m_asconf_chk == NULL) {
2598                 /* no mbuf's */
2599                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2600                     "compose_asconf: couldn't get chunk mbuf!\n");
2601                 return (NULL);
2602         }
2603         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2604         if (m_asconf == NULL) {
2605                 /* no mbuf's */
2606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2607                     "compose_asconf: couldn't get mbuf!\n");
2608                 sctp_m_freem(m_asconf_chk);
2609                 return (NULL);
2610         }
2611         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2612         SCTP_BUF_LEN(m_asconf) = 0;
2613         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2614         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2615         /* save pointers to lookup address and asconf params */
2616         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2617         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2618
2619         /* fill in chunk header info */
2620         acp->ch.chunk_type = SCTP_ASCONF;
2621         acp->ch.chunk_flags = 0;
2622         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2623         stcb->asoc.asconf_seq_out++;
2624
2625         /* add parameters... up to smallest MTU allowed */
2626         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2627                 if (aa->sent)
2628                         continue;
2629                 /* get the parameter length */
2630                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2631                 /* will it fit in current chunk? */
2632                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2633                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2634                         /* won't fit, so we're done with this chunk */
2635                         break;
2636                 }
2637                 /* assign (and store) a correlation id */
2638                 aa->ap.aph.correlation_id = correlation_id++;
2639
2640                 /*
2641                  * fill in address if we're doing a delete this is a simple
2642                  * way for us to fill in the correlation address, which
2643                  * should only be used by the peer if we're deleting our
2644                  * source address and adding a new address (e.g. renumbering
2645                  * case)
2646                  */
2647                 if (lookup_used == 0 &&
2648                     (aa->special_del == 0) &&
2649                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2650                         struct sctp_ipv6addr_param *lookup;
2651                         uint16_t p_size, addr_size;
2652
2653                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2654                         lookup->ph.param_type =
2655                             htons(aa->ap.addrp.ph.param_type);
2656                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2657                                 /* copy IPv6 address */
2658                                 p_size = sizeof(struct sctp_ipv6addr_param);
2659                                 addr_size = sizeof(struct in6_addr);
2660                         } else {
2661                                 /* copy IPv4 address */
2662                                 p_size = sizeof(struct sctp_ipv4addr_param);
2663                                 addr_size = sizeof(struct in_addr);
2664                         }
2665                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2666                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2667                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2668                         lookup_used = 1;
2669                 }
2670                 /* copy into current space */
2671                 memcpy(ptr, &aa->ap, p_length);
2672
2673                 /* network elements and update lengths */
2674                 aph = (struct sctp_asconf_paramhdr *)ptr;
2675                 aap = (struct sctp_asconf_addr_param *)ptr;
2676                 /* correlation_id is transparent to peer, no htonl needed */
2677                 aph->ph.param_type = htons(aph->ph.param_type);
2678                 aph->ph.param_length = htons(aph->ph.param_length);
2679                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2680                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2681
2682                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2683                 ptr += SCTP_SIZE32(p_length);
2684
2685                 /*
2686                  * these params are removed off the pending list upon
2687                  * getting an ASCONF-ACK back from the peer, just set flag
2688                  */
2689                 aa->sent = 1;
2690         }
2691         /* check to see if the lookup addr has been populated yet */
2692         if (lookup_used == 0) {
2693                 /* NOTE: if the address param is optional, can skip this... */
2694                 /* add any valid (existing) address... */
2695                 struct sctp_ipv6addr_param *lookup;
2696                 uint16_t p_size, addr_size;
2697                 struct sockaddr *found_addr;
2698                 caddr_t addr_ptr;
2699
2700                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2701                         found_addr = sctp_find_valid_localaddr(stcb,
2702                             addr_locked);
2703                 else
2704                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2705
2706                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2707                 if (found_addr != NULL) {
2708                         switch (found_addr->sa_family) {
2709 #ifdef INET6
2710                         case AF_INET6:
2711                                 /* copy IPv6 address */
2712                                 lookup->ph.param_type =
2713                                     htons(SCTP_IPV6_ADDRESS);
2714                                 p_size = sizeof(struct sctp_ipv6addr_param);
2715                                 addr_size = sizeof(struct in6_addr);
2716                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2717                                     found_addr)->sin6_addr;
2718                                 break;
2719 #endif
2720 #ifdef INET
2721                         case AF_INET:
2722                                 /* copy IPv4 address */
2723                                 lookup->ph.param_type =
2724                                     htons(SCTP_IPV4_ADDRESS);
2725                                 p_size = sizeof(struct sctp_ipv4addr_param);
2726                                 addr_size = sizeof(struct in_addr);
2727                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2728                                     found_addr)->sin_addr;
2729                                 break;
2730 #endif
2731                         default:
2732                                 p_size = 0;
2733                                 addr_size = 0;
2734                                 addr_ptr = NULL;
2735                                 break;
2736                         }
2737                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2738                         memcpy(lookup->addr, addr_ptr, addr_size);
2739                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2740                 } else {
2741                         /* uh oh... don't have any address?? */
2742                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2743                             "compose_asconf: no lookup addr!\n");
2744                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2745                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2746                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2747                         memset(lookup->addr, 0, sizeof(struct in_addr));
2748                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2749                 }
2750         }
2751         /* chain it all together */
2752         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2753         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2754         acp->ch.chunk_length = htons(*retlen);
2755
2756         return (m_asconf_chk);
2757 }
2758
2759 /*
2760  * section to handle address changes before an association is up eg. changes
2761  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2762  */
2763
2764 /*
2765  * processes the (local) addresses in the INIT-ACK chunk
2766  */
2767 static void
2768 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2769     unsigned int offset, unsigned int length)
2770 {
2771         struct sctp_paramhdr tmp_param, *ph;
2772         uint16_t plen, ptype;
2773         struct sctp_ifa *sctp_ifa;
2774         union sctp_sockstore store;
2775 #ifdef INET6
2776         struct sctp_ipv6addr_param addr6_store;
2777 #endif
2778 #ifdef INET
2779         struct sctp_ipv4addr_param addr4_store;
2780 #endif
2781
2782         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2783         if (stcb == NULL)       /* Un-needed check for SA */
2784                 return;
2785
2786         /* convert to upper bound */
2787         length += offset;
2788
2789         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2790                 return;
2791         }
2792         /* go through the addresses in the init-ack */
2793         ph = (struct sctp_paramhdr *)
2794             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2795             (uint8_t *)&tmp_param);
2796         while (ph != NULL) {
2797                 ptype = ntohs(ph->param_type);
2798                 plen = ntohs(ph->param_length);
2799                 switch (ptype) {
2800 #ifdef INET6
2801                 case SCTP_IPV6_ADDRESS:
2802                         {
2803                                 struct sctp_ipv6addr_param *a6p;
2804
2805                                 /* get the entire IPv6 address param */
2806                                 a6p = (struct sctp_ipv6addr_param *)
2807                                     sctp_m_getptr(m, offset,
2808                                     sizeof(struct sctp_ipv6addr_param),
2809                                     (uint8_t *)&addr6_store);
2810                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2811                                     a6p == NULL) {
2812                                         return;
2813                                 }
2814                                 memset(&store, 0, sizeof(union sctp_sockstore));
2815                                 store.sin6.sin6_family = AF_INET6;
2816                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2817                                 store.sin6.sin6_port = stcb->rport;
2818                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2819                                 break;
2820                         }
2821 #endif
2822 #ifdef INET
2823                 case SCTP_IPV4_ADDRESS:
2824                         {
2825                                 struct sctp_ipv4addr_param *a4p;
2826
2827                                 /* get the entire IPv4 address param */
2828                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2829                                     sizeof(struct sctp_ipv4addr_param),
2830                                     (uint8_t *)&addr4_store);
2831                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2832                                     a4p == NULL) {
2833                                         return;
2834                                 }
2835                                 memset(&store, 0, sizeof(union sctp_sockstore));
2836                                 store.sin.sin_family = AF_INET;
2837                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2838                                 store.sin.sin_port = stcb->rport;
2839                                 store.sin.sin_addr.s_addr = a4p->addr;
2840                                 break;
2841                         }
2842 #endif
2843                 default:
2844                         goto next_addr;
2845                 }
2846
2847                 /* see if this address really (still) exists */
2848                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2849                     SCTP_ADDR_NOT_LOCKED);
2850                 if (sctp_ifa == NULL) {
2851                         /* address doesn't exist anymore */
2852                         int status;
2853
2854                         /* are ASCONFs allowed ? */
2855                         if ((sctp_is_feature_on(stcb->sctp_ep,
2856                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2857                             stcb->asoc.asconf_supported) {
2858                                 /* queue an ASCONF DEL_IP_ADDRESS */
2859                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2860                                 /*
2861                                  * if queued ok, and in correct state, send
2862                                  * out the ASCONF.
2863                                  */
2864                                 if (status == 0 &&
2865                                     SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
2866 #ifdef SCTP_TIMER_BASED_ASCONF
2867                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2868                                             stcb->sctp_ep, stcb,
2869                                             stcb->asoc.primary_destination);
2870 #else
2871                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2872 #endif
2873                                 }
2874                         }
2875                 }
2876
2877 next_addr:
2878                 /*
2879                  * Sanity check:  Make sure the length isn't 0, otherwise
2880                  * we'll be stuck in this loop for a long time...
2881                  */
2882                 if (SCTP_SIZE32(plen) == 0) {
2883                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2884                             plen, ptype);
2885                         return;
2886                 }
2887                 /* get next parameter */
2888                 offset += SCTP_SIZE32(plen);
2889                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2890                         return;
2891                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2892                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2893         }                       /* while */
2894 }
2895
2896 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2897 /*
2898  * checks to see if a specific address is in the initack address list returns
2899  * 1 if found, 0 if not
2900  */
2901 static uint32_t
2902 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2903 {
2904         struct sctp_paramhdr tmp_param, *ph;
2905         uint16_t plen, ptype;
2906 #ifdef INET
2907         struct sockaddr_in *sin;
2908         struct sctp_ipv4addr_param *a4p;
2909         struct sctp_ipv6addr_param addr4_store;
2910 #endif
2911 #ifdef INET6
2912         struct sockaddr_in6 *sin6;
2913         struct sctp_ipv6addr_param *a6p;
2914         struct sctp_ipv6addr_param addr6_store;
2915         struct sockaddr_in6 sin6_tmp;
2916 #endif
2917
2918         switch (sa->sa_family) {
2919 #ifdef INET
2920         case AF_INET:
2921                 break;
2922 #endif
2923 #ifdef INET6
2924         case AF_INET6:
2925                 break;
2926 #endif
2927         default:
2928                 return (0);
2929         }
2930
2931         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2932         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2933         /* convert to upper bound */
2934         length += offset;
2935
2936         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2937                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2938                     "find_initack_addr: invalid offset?\n");
2939                 return (0);
2940         }
2941         /* go through the addresses in the init-ack */
2942         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2943             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2944         while (ph != NULL) {
2945                 ptype = ntohs(ph->param_type);
2946                 plen = ntohs(ph->param_length);
2947                 switch (ptype) {
2948 #ifdef INET6
2949                 case SCTP_IPV6_ADDRESS:
2950                         if (sa->sa_family == AF_INET6) {
2951                                 /* get the entire IPv6 address param */
2952                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2953                                         break;
2954                                 }
2955                                 /* get the entire IPv6 address param */
2956                                 a6p = (struct sctp_ipv6addr_param *)
2957                                     sctp_m_getptr(m, offset,
2958                                     sizeof(struct sctp_ipv6addr_param),
2959                                     (uint8_t *)&addr6_store);
2960                                 if (a6p == NULL) {
2961                                         return (0);
2962                                 }
2963                                 sin6 = (struct sockaddr_in6 *)sa;
2964                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2965                                         /* create a copy and clear scope */
2966                                         memcpy(&sin6_tmp, sin6,
2967                                             sizeof(struct sockaddr_in6));
2968                                         sin6 = &sin6_tmp;
2969                                         in6_clearscope(&sin6->sin6_addr);
2970                                 }
2971                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2972                                     sizeof(struct in6_addr)) == 0) {
2973                                         /* found it */
2974                                         return (1);
2975                                 }
2976                         }
2977                         break;
2978 #endif                          /* INET6 */
2979 #ifdef INET
2980                 case SCTP_IPV4_ADDRESS:
2981                         if (sa->sa_family == AF_INET) {
2982                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2983                                         break;
2984                                 }
2985                                 /* get the entire IPv4 address param */
2986                                 a4p = (struct sctp_ipv4addr_param *)
2987                                     sctp_m_getptr(m, offset,
2988                                     sizeof(struct sctp_ipv4addr_param),
2989                                     (uint8_t *)&addr4_store);
2990                                 if (a4p == NULL) {
2991                                         return (0);
2992                                 }
2993                                 sin = (struct sockaddr_in *)sa;
2994                                 if (sin->sin_addr.s_addr == a4p->addr) {
2995                                         /* found it */
2996                                         return (1);
2997                                 }
2998                         }
2999                         break;
3000 #endif
3001                 default:
3002                         break;
3003                 }
3004                 /* get next parameter */
3005                 offset += SCTP_SIZE32(plen);
3006                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3007                         return (0);
3008                 }
3009                 ph = (struct sctp_paramhdr *)
3010                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3011                     (uint8_t *)&tmp_param);
3012         }                       /* while */
3013         /* not found! */
3014         return (0);
3015 }
3016
3017 /*
3018  * makes sure that the current endpoint local addr list is consistent with
3019  * the new association (eg. subset bound, asconf allowed) adds addresses as
3020  * necessary
3021  */
3022 static void
3023 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3024     int length, struct sockaddr *init_addr)
3025 {
3026         struct sctp_laddr *laddr;
3027
3028         /* go through the endpoint list */
3029         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3030                 /* be paranoid and validate the laddr */
3031                 if (laddr->ifa == NULL) {
3032                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3033                             "check_addr_list_ep: laddr->ifa is NULL");
3034                         continue;
3035                 }
3036                 if (laddr->ifa == NULL) {
3037                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3038                         continue;
3039                 }
3040                 /* do i have it implicitly? */
3041                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3042                         continue;
3043                 }
3044                 /* check to see if in the init-ack */
3045                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3046                         /* try to add it */
3047                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3048                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3049                 }
3050         }
3051 }
3052
3053 /*
3054  * makes sure that the current kernel address list is consistent with the new
3055  * association (with all addrs bound) adds addresses as necessary
3056  */
3057 static void
3058 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3059     int length, struct sockaddr *init_addr,
3060     uint16_t local_scope, uint16_t site_scope,
3061     uint16_t ipv4_scope, uint16_t loopback_scope)
3062 {
3063         struct sctp_vrf *vrf = NULL;
3064         struct sctp_ifn *sctp_ifn;
3065         struct sctp_ifa *sctp_ifa;
3066         uint32_t vrf_id;
3067 #ifdef INET
3068         struct sockaddr_in *sin;
3069 #endif
3070 #ifdef INET6
3071         struct sockaddr_in6 *sin6;
3072 #endif
3073
3074         if (stcb) {
3075                 vrf_id = stcb->asoc.vrf_id;
3076         } else {
3077                 return;
3078         }
3079         SCTP_IPI_ADDR_RLOCK();
3080         vrf = sctp_find_vrf(vrf_id);
3081         if (vrf == NULL) {
3082                 SCTP_IPI_ADDR_RUNLOCK();
3083                 return;
3084         }
3085         /* go through all our known interfaces */
3086         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3087                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3088                         /* skip loopback interface */
3089                         continue;
3090                 }
3091                 /* go through each interface address */
3092                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3093                         /* do i have it implicitly? */
3094                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3095                                 continue;
3096                         }
3097                         switch (sctp_ifa->address.sa.sa_family) {
3098 #ifdef INET
3099                         case AF_INET:
3100                                 sin = &sctp_ifa->address.sin;
3101                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3102                                     &sin->sin_addr) != 0) {
3103                                         continue;
3104                                 }
3105                                 if ((ipv4_scope == 0) &&
3106                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3107                                         /* private address not in scope */
3108                                         continue;
3109                                 }
3110                                 break;
3111 #endif
3112 #ifdef INET6
3113                         case AF_INET6:
3114                                 sin6 = &sctp_ifa->address.sin6;
3115                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3116                                     &sin6->sin6_addr) != 0) {
3117                                         continue;
3118                                 }
3119                                 if ((local_scope == 0) &&
3120                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3121                                         continue;
3122                                 }
3123                                 if ((site_scope == 0) &&
3124                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3125                                         continue;
3126                                 }
3127                                 break;
3128 #endif
3129                         default:
3130                                 break;
3131                         }
3132                         /* check to see if in the init-ack */
3133                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3134                                 /* try to add it */
3135                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3136                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3137                                     SCTP_ADDR_LOCKED);
3138                         }
3139                 }               /* end foreach ifa */
3140         }                       /* end foreach ifn */
3141         SCTP_IPI_ADDR_RUNLOCK();
3142 }
3143
3144 /*
3145  * validates an init-ack chunk (from a cookie-echo) with current addresses
3146  * adds addresses from the init-ack into our local address list, if needed
3147  * queues asconf adds/deletes addresses as needed and makes appropriate list
3148  * changes for source address selection m, offset: points to the start of the
3149  * address list in an init-ack chunk length: total length of the address
3150  * params only init_addr: address where my INIT-ACK was sent from
3151  */
3152 void
3153 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3154     int length, struct sockaddr *init_addr,
3155     uint16_t local_scope, uint16_t site_scope,
3156     uint16_t ipv4_scope, uint16_t loopback_scope)
3157 {
3158         /* process the local addresses in the initack */
3159         sctp_process_initack_addresses(stcb, m, offset, length);
3160
3161         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3162                 /* bound all case */
3163                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3164                     local_scope, site_scope, ipv4_scope, loopback_scope);
3165         } else {
3166                 /* subset bound case */
3167                 if (sctp_is_feature_on(stcb->sctp_ep,
3168                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3169                         /* asconf's allowed */
3170                         sctp_check_address_list_ep(stcb, m, offset, length,
3171                             init_addr);
3172                 }
3173                 /* else, no asconfs allowed, so what we sent is what we get */
3174         }
3175 }
3176
3177 /*
3178  * sctp_bindx() support
3179  */
3180 uint32_t
3181 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3182     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3183 {
3184         struct sctp_ifa *ifa;
3185         struct sctp_laddr *laddr, *nladdr;
3186
3187         if (sa->sa_len == 0) {
3188                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3189                 return (EINVAL);
3190         }
3191         if (sctp_ifap) {
3192                 ifa = sctp_ifap;
3193         } else if (type == SCTP_ADD_IP_ADDRESS) {
3194                 /* For an add the address MUST be on the system */
3195                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3196         } else if (type == SCTP_DEL_IP_ADDRESS) {
3197                 /* For a delete we need to find it in the inp */
3198                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3199         } else {
3200                 ifa = NULL;
3201         }
3202         if (ifa != NULL) {
3203                 if (type == SCTP_ADD_IP_ADDRESS) {
3204                         sctp_add_local_addr_ep(inp, ifa, type);
3205                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3206                         if (inp->laddr_count < 2) {
3207                                 /* can't delete the last local address */
3208                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3209                                 return (EINVAL);
3210                         }
3211                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3212                             sctp_nxt_addr) {
3213                                 if (ifa == laddr->ifa) {
3214                                         /* Mark in the delete */
3215                                         laddr->action = type;
3216                                 }
3217                         }
3218                 }
3219                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3220                         /*
3221                          * There is no need to start the iterator if the inp
3222                          * has no associations.
3223                          */
3224                         if (type == SCTP_DEL_IP_ADDRESS) {
3225                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3226                                         if (laddr->ifa == ifa) {
3227                                                 sctp_del_local_addr_ep(inp, ifa);
3228                                         }
3229                                 }
3230                         }
3231                 } else {
3232                         struct sctp_asconf_iterator *asc;
3233                         struct sctp_laddr *wi;
3234                         int ret;
3235
3236                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3237                             sizeof(struct sctp_asconf_iterator),
3238                             SCTP_M_ASC_IT);
3239                         if (asc == NULL) {
3240                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3241                                 return (ENOMEM);
3242                         }
3243                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3244                         if (wi == NULL) {
3245                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3246                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3247                                 return (ENOMEM);
3248                         }
3249                         LIST_INIT(&asc->list_of_work);
3250                         asc->cnt = 1;
3251                         SCTP_INCR_LADDR_COUNT();
3252                         wi->ifa = ifa;
3253                         wi->action = type;
3254                         atomic_add_int(&ifa->refcount, 1);
3255                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3256                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3257                             sctp_asconf_iterator_stcb,
3258                             sctp_asconf_iterator_ep_end,
3259                             SCTP_PCB_ANY_FLAGS,
3260                             SCTP_PCB_ANY_FEATURES,
3261                             SCTP_ASOC_ANY_STATE,
3262                             (void *)asc, 0,
3263                             sctp_asconf_iterator_end, inp, 0);
3264                         if (ret) {
3265                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3266                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3267                                 sctp_asconf_iterator_end(asc, 0);
3268                                 return (EFAULT);
3269                         }
3270                 }
3271                 return (0);
3272         } else {
3273                 /* invalid address! */
3274                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3275                 return (EADDRNOTAVAIL);
3276         }
3277 }
3278
3279 void
3280 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3281     struct sctp_nets *net)
3282 {
3283         struct sctp_asconf_addr *aa;
3284         struct sctp_ifa *sctp_ifap;
3285         struct sctp_asconf_tag_param *vtag;
3286 #ifdef INET
3287         struct sockaddr_in *to;
3288 #endif
3289 #ifdef INET6
3290         struct sockaddr_in6 *to6;
3291 #endif
3292         if (net == NULL) {
3293                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3294                 return;
3295         }
3296         if (stcb == NULL) {
3297                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3298                 return;
3299         }
3300         /*
3301          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3302          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3303          */
3304         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3305             SCTP_M_ASC_ADDR);
3306         if (aa == NULL) {
3307                 /* didn't get memory */
3308                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3309                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3310                 return;
3311         }
3312         aa->special_del = 0;
3313         /* fill in asconf address parameter fields */
3314         /* top level elements are "networked" during send */
3315         aa->ifa = NULL;
3316         aa->sent = 0;           /* clear sent flag */
3317         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3318         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3319         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3320         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3321         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3322         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3323
3324         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3325             SCTP_M_ASC_ADDR);
3326         if (aa == NULL) {
3327                 /* didn't get memory */
3328                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3329                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3330                 return;
3331         }
3332         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3333         /* fill in asconf address parameter fields */
3334         /* ADD(0.0.0.0) */
3335         switch (net->ro._l_addr.sa.sa_family) {
3336 #ifdef INET
3337         case AF_INET:
3338                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3339                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3340                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3341                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3342                 /* No need to add an address, we are using 0.0.0.0 */
3343                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3344                 break;
3345 #endif
3346 #ifdef INET6
3347         case AF_INET6:
3348                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3349                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3350                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3351                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3352                 /* No need to add an address, we are using 0.0.0.0 */
3353                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3354                 break;
3355 #endif
3356         default:
3357                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3358                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3359                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3360                 return;
3361         }
3362         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3363             SCTP_M_ASC_ADDR);
3364         if (aa == NULL) {
3365                 /* didn't get memory */
3366                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3367                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3368                 return;
3369         }
3370         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3371         /* fill in asconf address parameter fields */
3372         /* ADD(0.0.0.0) */
3373         switch (net->ro._l_addr.sa.sa_family) {
3374 #ifdef INET
3375         case AF_INET:
3376                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3377                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3378                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3379                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3380                 /* No need to add an address, we are using 0.0.0.0 */
3381                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3382                 break;
3383 #endif
3384 #ifdef INET6
3385         case AF_INET6:
3386                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3387                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3388                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3389                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3390                 /* No need to add an address, we are using 0.0.0.0 */
3391                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3392                 break;
3393 #endif
3394         default:
3395                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3396                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3397                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3398                 return;
3399         }
3400         /* Now we must hunt the addresses and add all global addresses */
3401         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3402                 struct sctp_vrf *vrf = NULL;
3403                 struct sctp_ifn *sctp_ifnp;
3404                 uint32_t vrf_id;
3405
3406                 vrf_id = stcb->sctp_ep->def_vrf_id;
3407                 vrf = sctp_find_vrf(vrf_id);
3408                 if (vrf == NULL) {
3409                         goto skip_rest;
3410                 }
3411
3412                 SCTP_IPI_ADDR_RLOCK();
3413                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3414                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3415                                 switch (sctp_ifap->address.sa.sa_family) {
3416 #ifdef INET
3417                                 case AF_INET:
3418                                         to = &sctp_ifap->address.sin;
3419                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3420                                             &to->sin_addr) != 0) {
3421                                                 continue;
3422                                         }
3423                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3424                                                 continue;
3425                                         }
3426                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3427                                                 continue;
3428                                         }
3429                                         break;
3430 #endif
3431 #ifdef INET6
3432                                 case AF_INET6:
3433                                         to6 = &sctp_ifap->address.sin6;
3434                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3435                                             &to6->sin6_addr) != 0) {
3436                                                 continue;
3437                                         }
3438                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3439                                                 continue;
3440                                         }
3441                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3442                                                 continue;
3443                                         }
3444                                         break;
3445 #endif
3446                                 default:
3447                                         continue;
3448                                 }
3449                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3450                         }
3451                 }
3452                 SCTP_IPI_ADDR_RUNLOCK();
3453         } else {
3454                 struct sctp_laddr *laddr;
3455
3456                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3457                         if (laddr->ifa == NULL) {
3458                                 continue;
3459                         }
3460                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3461                                 /*
3462                                  * Address being deleted by the system, dont
3463                                  * list.
3464                                  */
3465                                 continue;
3466                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3467                                 /*
3468                                  * Address being deleted on this ep don't
3469                                  * list.
3470                                  */
3471                                 continue;
3472                         }
3473                         sctp_ifap = laddr->ifa;
3474                         switch (sctp_ifap->address.sa.sa_family) {
3475 #ifdef INET
3476                         case AF_INET:
3477                                 to = &sctp_ifap->address.sin;
3478                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3479                                         continue;
3480                                 }
3481                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3482                                         continue;
3483                                 }
3484                                 break;
3485 #endif
3486 #ifdef INET6
3487                         case AF_INET6:
3488                                 to6 = &sctp_ifap->address.sin6;
3489                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3490                                         continue;
3491                                 }
3492                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3493                                         continue;
3494                                 }
3495                                 break;
3496 #endif
3497                         default:
3498                                 continue;
3499                         }
3500                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3501                 }
3502         }
3503 skip_rest:
3504         /* Now we must send the asconf into the queue */
3505         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3506 }