sys/netinet/sctp_asconf.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #include <netinet/sctp_pcb.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctputil.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_asconf.h>
  46 #include <netinet/sctp_timer.h>
  47
  48 /*
  49  * debug flags:
  50  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  51  * SCTP_DEBUG_ASCONF2: detailed info
  52  */
  53
  54
  55 /*
  56  * RFC 5061
  57  *
  58  * An ASCONF parameter queue exists per asoc which holds the pending address
  59  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  60  *
  61  * A restricted_addrs list exists per assoc to hold local addresses that are
  62  * not (yet) usable by the assoc as a source address.  These addresses are
  63  * either pending an ASCONF operation (and exist on the ASCONF parameter
  64  * queue), or they are permanently restricted (the peer has returned an
  65  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  66  *
  67  * Deleted addresses are always immediately removed from the lists as they will
  68  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  69  * only if allowed.
  70  */
  71
  72 /*
  73  * ASCONF parameter processing.
  74  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  75  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  76  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  77  */
  78 static struct mbuf *
  79 sctp_asconf_success_response(uint32_t id)
  80 {
  81         struct mbuf *m_reply = NULL;
  82         struct sctp_asconf_paramhdr *aph;
  83
  84         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  85             0, M_NOWAIT, 1, MT_DATA);
  86         if (m_reply == NULL) {
  87                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  88                     "asconf_success_response: couldn't get mbuf!\n");
  89                 return (NULL);
  90         }
  91         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  92         aph->correlation_id = id;
  93         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  94         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  95         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  96         aph->ph.param_length = htons(aph->ph.param_length);
  97
  98         return (m_reply);
  99 }
 100
 101 static struct mbuf *
 102 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 103     uint16_t tlv_length)
 104 {
 105         struct mbuf *m_reply = NULL;
 106         struct sctp_asconf_paramhdr *aph;
 107         struct sctp_error_cause *error;
 108         uint8_t *tlv;
 109
 110         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 111             tlv_length +
 112             sizeof(struct sctp_error_cause)),
 113             0, M_NOWAIT, 1, MT_DATA);
 114         if (m_reply == NULL) {
 115                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 116                     "asconf_error_response: couldn't get mbuf!\n");
 117                 return (NULL);
 118         }
 119         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 120         error = (struct sctp_error_cause *)(aph + 1);
 121
 122         aph->correlation_id = id;
 123         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 124         error->code = htons(cause);
 125         error->length = tlv_length + sizeof(struct sctp_error_cause);
 126         aph->ph.param_length = error->length +
 127             sizeof(struct sctp_asconf_paramhdr);
 128
 129         if (aph->ph.param_length > MLEN) {
 130                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 131                     "asconf_error_response: tlv_length (%xh) too big\n",
 132                     tlv_length);
 133                 sctp_m_freem(m_reply);  /* discard */
 134                 return (NULL);
 135         }
 136         if (error_tlv != NULL) {
 137                 tlv = (uint8_t *)(error + 1);
 138                 memcpy(tlv, error_tlv, tlv_length);
 139         }
 140         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 141         error->length = htons(error->length);
 142         aph->ph.param_length = htons(aph->ph.param_length);
 143
 144         return (m_reply);
 145 }
 146
 147 static struct mbuf *
 148 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 149     struct sctp_tcb *stcb, int send_hb, int response_required)
 150 {
 151         struct sctp_nets *net;
 152         struct mbuf *m_reply = NULL;
 153         union sctp_sockstore store;
 154         struct sctp_paramhdr *ph;
 155         uint16_t param_type, aparam_length;
 156 #if defined(INET) || defined(INET6)
 157         uint16_t param_length;
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162 #ifdef INET
 163         struct sockaddr_in *sin;
 164         struct sctp_ipv4addr_param *v4addr;
 165 #endif
 166 #ifdef INET6
 167         struct sockaddr_in6 *sin6;
 168         struct sctp_ipv6addr_param *v6addr;
 169 #endif
 170
 171         aparam_length = ntohs(aph->ph.param_length);
 172         ph = (struct sctp_paramhdr *)(aph + 1);
 173         param_type = ntohs(ph->param_type);
 174 #if defined(INET) || defined(INET6)
 175         param_length = ntohs(ph->param_length);
 176 #endif
 177         sa = &store.sa;
 178         switch (param_type) {
 179 #ifdef INET
 180         case SCTP_IPV4_ADDRESS:
 181                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 182                         /* invalid param size */
 183                         return (NULL);
 184                 }
 185                 v4addr = (struct sctp_ipv4addr_param *)ph;
 186                 sin = &store.sin;
 187                 memset(sin, 0, sizeof(*sin));
 188                 sin->sin_family = AF_INET;
 189                 sin->sin_len = sizeof(struct sockaddr_in);
 190                 sin->sin_port = stcb->rport;
 191                 sin->sin_addr.s_addr = v4addr->addr;
 192                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 193                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 194                         bad_address = 1;
 195                 }
 196                 if (sin->sin_addr.s_addr == INADDR_ANY)
 197                         zero_address = 1;
 198                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 199                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 200                 break;
 201 #endif
 202 #ifdef INET6
 203         case SCTP_IPV6_ADDRESS:
 204                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 205                         /* invalid param size */
 206                         return (NULL);
 207                 }
 208                 v6addr = (struct sctp_ipv6addr_param *)ph;
 209                 sin6 = &store.sin6;
 210                 memset(sin6, 0, sizeof(*sin6));
 211                 sin6->sin6_family = AF_INET6;
 212                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 213                 sin6->sin6_port = stcb->rport;
 214                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 215                     sizeof(struct in6_addr));
 216                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 217                         bad_address = 1;
 218                 }
 219                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 220                         zero_address = 1;
 221                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 222                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 223                 break;
 224 #endif
 225         default:
 226                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 227                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 228                     aparam_length);
 229                 return (m_reply);
 230         }                       /* end switch */
 231
 232         /* if 0.0.0.0/::0, add the source address instead */
 233         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 234                 sa = src;
 235                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 236                     "process_asconf_add_ip: using source addr ");
 237                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 238         }
 239         /* add the address */
 240         if (bad_address) {
 241                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 242                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 243                     aparam_length);
 244         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 245                     SCTP_DONOT_SETSCOPE,
 246             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 247                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 248                     "process_asconf_add_ip: error adding address\n");
 249                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 250                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 251                     aparam_length);
 252         } else {
 253                 /* notify upper layer */
 254                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 255                 if (response_required) {
 256                         m_reply =
 257                             sctp_asconf_success_response(aph->correlation_id);
 258                 }
 259                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 260                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 261                     stcb, net);
 262                 if (send_hb) {
 263                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 264                 }
 265         }
 266         return (m_reply);
 267 }
 268
 269 static int
 270 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 271 {
 272         struct sctp_nets *src_net, *net;
 273
 274         /* make sure the source address exists as a destination net */
 275         src_net = sctp_findnet(stcb, src);
 276         if (src_net == NULL) {
 277                 /* not found */
 278                 return (-1);
 279         }
 280         /* delete all destination addresses except the source */
 281         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 282                 if (net != src_net) {
 283                         /* delete this address */
 284                         sctp_remove_net(stcb, net);
 285                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 286                             "asconf_del_remote_addrs_except: deleting ");
 287                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 288                             (struct sockaddr *)&net->ro._l_addr);
 289                         /* notify upper layer */
 290                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 291                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 292                 }
 293         }
 294         return (0);
 295 }
 296
 297 static struct mbuf *
 298 sctp_process_asconf_delete_ip(struct sockaddr *src,
 299     struct sctp_asconf_paramhdr *aph,
 300     struct sctp_tcb *stcb, int response_required)
 301 {
 302         struct mbuf *m_reply = NULL;
 303         union sctp_sockstore store;
 304         struct sctp_paramhdr *ph;
 305         uint16_t param_type, aparam_length;
 306 #if defined(INET) || defined(INET6)
 307         uint16_t param_length;
 308 #endif
 309         struct sockaddr *sa;
 310         int zero_address = 0;
 311         int result;
 312 #ifdef INET
 313         struct sockaddr_in *sin;
 314         struct sctp_ipv4addr_param *v4addr;
 315 #endif
 316 #ifdef INET6
 317         struct sockaddr_in6 *sin6;
 318         struct sctp_ipv6addr_param *v6addr;
 319 #endif
 320
 321         aparam_length = ntohs(aph->ph.param_length);
 322         ph = (struct sctp_paramhdr *)(aph + 1);
 323         param_type = ntohs(ph->param_type);
 324 #if defined(INET) || defined(INET6)
 325         param_length = ntohs(ph->param_length);
 326 #endif
 327         sa = &store.sa;
 328         switch (param_type) {
 329 #ifdef INET
 330         case SCTP_IPV4_ADDRESS:
 331                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 332                         /* invalid param size */
 333                         return (NULL);
 334                 }
 335                 v4addr = (struct sctp_ipv4addr_param *)ph;
 336                 sin = &store.sin;
 337                 memset(sin, 0, sizeof(*sin));
 338                 sin->sin_family = AF_INET;
 339                 sin->sin_len = sizeof(struct sockaddr_in);
 340                 sin->sin_port = stcb->rport;
 341                 sin->sin_addr.s_addr = v4addr->addr;
 342                 if (sin->sin_addr.s_addr == INADDR_ANY)
 343                         zero_address = 1;
 344                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 345                     "process_asconf_delete_ip: deleting ");
 346                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 347                 break;
 348 #endif
 349 #ifdef INET6
 350         case SCTP_IPV6_ADDRESS:
 351                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 352                         /* invalid param size */
 353                         return (NULL);
 354                 }
 355                 v6addr = (struct sctp_ipv6addr_param *)ph;
 356                 sin6 = &store.sin6;
 357                 memset(sin6, 0, sizeof(*sin6));
 358                 sin6->sin6_family = AF_INET6;
 359                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 360                 sin6->sin6_port = stcb->rport;
 361                 memcpy(&sin6->sin6_addr, v6addr->addr,
 362                     sizeof(struct in6_addr));
 363                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 364                         zero_address = 1;
 365                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 366                     "process_asconf_delete_ip: deleting ");
 367                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 368                 break;
 369 #endif
 370         default:
 371                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 372                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 373                     aparam_length);
 374                 return (m_reply);
 375         }
 376
 377         /* make sure the source address is not being deleted */
 378         if (sctp_cmpaddr(sa, src)) {
 379                 /* trying to delete the source address! */
 380                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 381                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 382                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 383                     aparam_length);
 384                 return (m_reply);
 385         }
 386         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 387         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 388                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 389
 390                 if (result) {
 391                         /* src address did not exist? */
 392                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 393                         /* what error to reply with?? */
 394                         m_reply =
 395                             sctp_asconf_error_response(aph->correlation_id,
 396                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 397                             aparam_length);
 398                 } else if (response_required) {
 399                         m_reply =
 400                             sctp_asconf_success_response(aph->correlation_id);
 401                 }
 402                 return (m_reply);
 403         }
 404         /* delete the address */
 405         result = sctp_del_remote_addr(stcb, sa);
 406         /*
 407          * note if result == -2, the address doesn't exist in the asoc but
 408          * since it's being deleted anyways, we just ack the delete -- but
 409          * this probably means something has already gone awry
 410          */
 411         if (result == -1) {
 412                 /* only one address in the asoc */
 413                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 414                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 415                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 416                     aparam_length);
 417         } else {
 418                 if (response_required) {
 419                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 420                 }
 421                 /* notify upper layer */
 422                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 423         }
 424         return (m_reply);
 425 }
 426
 427 static struct mbuf *
 428 sctp_process_asconf_set_primary(struct sockaddr *src,
 429     struct sctp_asconf_paramhdr *aph,
 430     struct sctp_tcb *stcb, int response_required)
 431 {
 432         struct mbuf *m_reply = NULL;
 433         union sctp_sockstore store;
 434         struct sctp_paramhdr *ph;
 435         uint16_t param_type, aparam_length;
 436 #if defined(INET) || defined(INET6)
 437         uint16_t param_length;
 438 #endif
 439         struct sockaddr *sa;
 440         int zero_address = 0;
 441 #ifdef INET
 442         struct sockaddr_in *sin;
 443         struct sctp_ipv4addr_param *v4addr;
 444 #endif
 445 #ifdef INET6
 446         struct sockaddr_in6 *sin6;
 447         struct sctp_ipv6addr_param *v6addr;
 448 #endif
 449
 450         aparam_length = ntohs(aph->ph.param_length);
 451         ph = (struct sctp_paramhdr *)(aph + 1);
 452         param_type = ntohs(ph->param_type);
 453 #if defined(INET) || defined(INET6)
 454         param_length = ntohs(ph->param_length);
 455 #endif
 456         sa = &store.sa;
 457         switch (param_type) {
 458 #ifdef INET
 459         case SCTP_IPV4_ADDRESS:
 460                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 461                         /* invalid param size */
 462                         return (NULL);
 463                 }
 464                 v4addr = (struct sctp_ipv4addr_param *)ph;
 465                 sin = &store.sin;
 466                 memset(sin, 0, sizeof(*sin));
 467                 sin->sin_family = AF_INET;
 468                 sin->sin_len = sizeof(struct sockaddr_in);
 469                 sin->sin_addr.s_addr = v4addr->addr;
 470                 if (sin->sin_addr.s_addr == INADDR_ANY)
 471                         zero_address = 1;
 472                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 473                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 474                 break;
 475 #endif
 476 #ifdef INET6
 477         case SCTP_IPV6_ADDRESS:
 478                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 479                         /* invalid param size */
 480                         return (NULL);
 481                 }
 482                 v6addr = (struct sctp_ipv6addr_param *)ph;
 483                 sin6 = &store.sin6;
 484                 memset(sin6, 0, sizeof(*sin6));
 485                 sin6->sin6_family = AF_INET6;
 486                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 487                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 488                     sizeof(struct in6_addr));
 489                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 490                         zero_address = 1;
 491                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 492                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 493                 break;
 494 #endif
 495         default:
 496                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 497                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 498                     aparam_length);
 499                 return (m_reply);
 500         }
 501
 502         /* if 0.0.0.0/::0, use the source address instead */
 503         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 504                 sa = src;
 505                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 506                     "process_asconf_set_primary: using source addr ");
 507                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 508         }
 509         /* set the primary address */
 510         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 511                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 512                     "process_asconf_set_primary: primary address set\n");
 513                 /* notify upper layer */
 514                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 515                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 516                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 517                     (stcb->asoc.alternate)) {
 518                         sctp_free_remote_addr(stcb->asoc.alternate);
 519                         stcb->asoc.alternate = NULL;
 520                 }
 521                 if (response_required) {
 522                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 523                 }
 524                 /*
 525                  * Mobility adaptation. Ideally, when the reception of SET
 526                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 527                  * destination, unacknowledged DATA are retransmitted
 528                  * immediately to the new primary destination for seamless
 529                  * handover. If the destination is UNCONFIRMED and marked to
 530                  * REQ_PRIM, The retransmission occur when reception of the
 531                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 532                  * sctp_input.c) Also, when change of the primary
 533                  * destination, it is better that all subsequent new DATA
 534                  * containing already queued DATA are transmitted to the new
 535                  * primary destination. (by micchie)
 536                  */
 537                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 538                     SCTP_MOBILITY_BASE) ||
 539                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 540                     SCTP_MOBILITY_FASTHANDOFF)) &&
 541                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 542                     SCTP_MOBILITY_PRIM_DELETED) &&
 543                     (stcb->asoc.primary_destination->dest_state &
 544                     SCTP_ADDR_UNCONFIRMED) == 0) {
 545
 546                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 547                             stcb->sctp_ep, stcb, NULL,
 548                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 549                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 550                             SCTP_MOBILITY_FASTHANDOFF)) {
 551                                 sctp_assoc_immediate_retrans(stcb,
 552                                     stcb->asoc.primary_destination);
 553                         }
 554                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 555                             SCTP_MOBILITY_BASE)) {
 556                                 sctp_move_chunks_from_net(stcb,
 557                                     stcb->asoc.deleted_primary);
 558                         }
 559                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 560                             stcb->asoc.deleted_primary);
 561                 }
 562         } else {
 563                 /* couldn't set the requested primary address! */
 564                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 565                     "process_asconf_set_primary: set primary failed!\n");
 566                 /* must have been an invalid address, so report */
 567                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 568                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 569                     aparam_length);
 570         }
 571
 572         return (m_reply);
 573 }
 574
 575 /*
 576  * handles an ASCONF chunk.
 577  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 578  */
 579 void
 580 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 581     struct sockaddr *src,
 582     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 583     int first)
 584 {
 585         struct sctp_association *asoc;
 586         uint32_t serial_num;
 587         struct mbuf *n, *m_ack, *m_result, *m_tail;
 588         struct sctp_asconf_ack_chunk *ack_cp;
 589         struct sctp_asconf_paramhdr *aph;
 590         struct sctp_ipv6addr_param *p_addr;
 591         unsigned int asconf_limit, cnt;
 592         int error = 0;          /* did an error occur? */
 593
 594         /* asconf param buffer */
 595         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 596         struct sctp_asconf_ack *ack, *ack_next;
 597
 598         /* verify minimum length */
 599         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 600                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 601                     "handle_asconf: chunk too small = %xh\n",
 602                     ntohs(cp->ch.chunk_length));
 603                 return;
 604         }
 605         asoc = &stcb->asoc;
 606         serial_num = ntohl(cp->serial_number);
 607
 608         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 609                 /* got a duplicate ASCONF */
 610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 611                     "handle_asconf: got duplicate serial number = %xh\n",
 612                     serial_num);
 613                 return;
 614         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 615                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 616                     serial_num, asoc->asconf_seq_in + 1);
 617                 return;
 618         }
 619         /* it's the expected "next" sequence number, so process it */
 620         asoc->asconf_seq_in = serial_num;       /* update sequence */
 621         /* get length of all the param's in the ASCONF */
 622         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 623         SCTPDBG(SCTP_DEBUG_ASCONF1,
 624             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 625             asconf_limit, serial_num);
 626
 627         if (first) {
 628                 /* delete old cache */
 629                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 630
 631                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 632                         if (ack->serial_number == serial_num)
 633                                 break;
 634                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 635                             ack->serial_number, serial_num);
 636                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 637                         if (ack->data != NULL) {
 638                                 sctp_m_freem(ack->data);
 639                         }
 640                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 641                 }
 642         }
 643         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 644             M_NOWAIT, 1, MT_DATA);
 645         if (m_ack == NULL) {
 646                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 647                     "handle_asconf: couldn't get mbuf!\n");
 648                 return;
 649         }
 650         m_tail = m_ack;         /* current reply chain's tail */
 651
 652         /* fill in ASCONF-ACK header */
 653         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 654         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 655         ack_cp->ch.chunk_flags = 0;
 656         ack_cp->serial_number = htonl(serial_num);
 657         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 658         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 659         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 660
 661         /* skip the lookup address parameter */
 662         offset += sizeof(struct sctp_asconf_chunk);
 663         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 664         if (p_addr == NULL) {
 665                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 666                     "handle_asconf: couldn't get lookup addr!\n");
 667                 /* respond with a missing/invalid mandatory parameter error */
 668                 return;
 669         }
 670         /* param_length is already validated in process_control... */
 671         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 672         /* get pointer to first asconf param in ASCONF */
 673         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 674         if (aph == NULL) {
 675                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 676                 goto send_reply;
 677         }
 678         /* process through all parameters */
 679         cnt = 0;
 680         while (aph != NULL) {
 681                 unsigned int param_length, param_type;
 682
 683                 param_type = ntohs(aph->ph.param_type);
 684                 param_length = ntohs(aph->ph.param_length);
 685                 if (offset + param_length > asconf_limit) {
 686                         /* parameter goes beyond end of chunk! */
 687                         sctp_m_freem(m_ack);
 688                         return;
 689                 }
 690                 m_result = NULL;
 691
 692                 if (param_length > sizeof(aparam_buf)) {
 693                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 694                         sctp_m_freem(m_ack);
 695                         return;
 696                 }
 697                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 698                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 699                         sctp_m_freem(m_ack);
 700                 }
 701                 /* get the entire parameter */
 702                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 703                 if (aph == NULL) {
 704                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 705                         sctp_m_freem(m_ack);
 706                         return;
 707                 }
 708                 switch (param_type) {
 709                 case SCTP_ADD_IP_ADDRESS:
 710                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 711                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 712                         cnt++;
 713                         break;
 714                 case SCTP_DEL_IP_ADDRESS:
 715                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 716                             error);
 717                         break;
 718                 case SCTP_ERROR_CAUSE_IND:
 719                         /* not valid in an ASCONF chunk */
 720                         break;
 721                 case SCTP_SET_PRIM_ADDR:
 722                         m_result = sctp_process_asconf_set_primary(src, aph,
 723                             stcb, error);
 724                         break;
 725                 case SCTP_NAT_VTAGS:
 726                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 727                         break;
 728                 case SCTP_SUCCESS_REPORT:
 729                         /* not valid in an ASCONF chunk */
 730                         break;
 731                 case SCTP_ULP_ADAPTATION:
 732                         /* FIX */
 733                         break;
 734                 default:
 735                         if ((param_type & 0x8000) == 0) {
 736                                 /* Been told to STOP at this param */
 737                                 asconf_limit = offset;
 738                                 /*
 739                                  * FIX FIX - We need to call
 740                                  * sctp_arethere_unrecognized_parameters()
 741                                  * to get a operr and send it for any
 742                                  * param's with the 0x4000 bit set OR do it
 743                                  * here ourselves... note we still must STOP
 744                                  * if the 0x8000 bit is clear.
 745                                  */
 746                         }
 747                         /* unknown/invalid param type */
 748                         break;
 749                 }               /* switch */
 750
 751                 /* add any (error) result to the reply mbuf chain */
 752                 if (m_result != NULL) {
 753                         SCTP_BUF_NEXT(m_tail) = m_result;
 754                         m_tail = m_result;
 755                         /* update lengths, make sure it's aligned too */
 756                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 757                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 758                         /* set flag to force success reports */
 759                         error = 1;
 760                 }
 761                 offset += SCTP_SIZE32(param_length);
 762                 /* update remaining ASCONF message length to process */
 763                 if (offset >= asconf_limit) {
 764                         /* no more data in the mbuf chain */
 765                         break;
 766                 }
 767                 /* get pointer to next asconf param */
 768                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 769                     sizeof(struct sctp_asconf_paramhdr),
 770                     (uint8_t *)&aparam_buf);
 771                 if (aph == NULL) {
 772                         /* can't get an asconf paramhdr */
 773                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 774                         /* FIX ME - add error here... */
 775                 }
 776         }
 777
 778 send_reply:
 779         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 780         /* save the ASCONF-ACK reply */
 781         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 782             struct sctp_asconf_ack);
 783         if (ack == NULL) {
 784                 sctp_m_freem(m_ack);
 785                 return;
 786         }
 787         ack->serial_number = serial_num;
 788         ack->last_sent_to = NULL;
 789         ack->data = m_ack;
 790         ack->len = 0;
 791         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 792                 ack->len += SCTP_BUF_LEN(n);
 793         }
 794         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 795
 796         /* see if last_control_chunk_from is set properly (use IP src addr) */
 797         if (stcb->asoc.last_control_chunk_from == NULL) {
 798                 /*
 799                  * this could happen if the source address was just newly
 800                  * added
 801                  */
 802                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 803                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 804                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 805                 /* look up the from address */
 806                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 807 #ifdef SCTP_DEBUG
 808                 if (stcb->asoc.last_control_chunk_from == NULL) {
 809                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 810                 }
 811 #endif
 812         }
 813 }
 814
 815 /*
 816  * does the address match? returns 0 if not, 1 if so
 817  */
 818 static uint32_t
 819 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 820 {
 821         switch (sa->sa_family) {
 822 #ifdef INET6
 823         case AF_INET6:
 824                 {
 825                         /* XXX scopeid */
 826                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 827
 828                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 829                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 830                             sizeof(struct in6_addr)) == 0)) {
 831                                 return (1);
 832                         }
 833                         break;
 834                 }
 835 #endif
 836 #ifdef INET
 837         case AF_INET:
 838                 {
 839                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 840
 841                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 842                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 843                             sizeof(struct in_addr)) == 0)) {
 844                                 return (1);
 845                         }
 846                         break;
 847                 }
 848 #endif
 849         default:
 850                 break;
 851         }
 852         return (0);
 853 }
 854
 855 /*
 856  * does the address match? returns 0 if not, 1 if so
 857  */
 858 static uint32_t
 859 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 860 {
 861 #if defined(INET) || defined(INET6)
 862         uint16_t param_type, param_length;
 863
 864         param_type = ntohs(ph->param_type);
 865         param_length = ntohs(ph->param_length);
 866 #endif
 867         switch (sa->sa_family) {
 868 #ifdef INET6
 869         case AF_INET6:
 870                 {
 871                         /* XXX scopeid */
 872                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 873                         struct sctp_ipv6addr_param *v6addr;
 874
 875                         v6addr = (struct sctp_ipv6addr_param *)ph;
 876                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 877                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 878                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 879                             sizeof(struct in6_addr)) == 0)) {
 880                                 return (1);
 881                         }
 882                         break;
 883                 }
 884 #endif
 885 #ifdef INET
 886         case AF_INET:
 887                 {
 888                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 889                         struct sctp_ipv4addr_param *v4addr;
 890
 891                         v4addr = (struct sctp_ipv4addr_param *)ph;
 892                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 893                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 894                             (memcmp(&v4addr->addr, &sin->sin_addr,
 895                             sizeof(struct in_addr)) == 0)) {
 896                                 return (1);
 897                         }
 898                         break;
 899                 }
 900 #endif
 901         default:
 902                 break;
 903         }
 904         return (0);
 905 }
 906
 907 /*
 908  * Cleanup for non-responded/OP ERR'd ASCONF
 909  */
 910 void
 911 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 912 {
 913         /*
 914          * clear out any existing asconfs going out
 915          */
 916         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 917             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 918         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 919         /* remove the old ASCONF on our outbound queue */
 920         sctp_toss_old_asconf(stcb);
 921 }
 922
 923 /*
 924  * cleanup any cached source addresses that may be topologically
 925  * incorrect after a new address has been added to this interface.
 926  */
 927 static void
 928 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 929 {
 930         struct sctp_nets *net;
 931
 932         /*
 933          * Ideally, we want to only clear cached routes and source addresses
 934          * that are topologically incorrect.  But since there is no easy way
 935          * to know whether the newly added address on the ifn would cause a
 936          * routing change (i.e. a new egress interface would be chosen)
 937          * without doing a new routing lookup and source address selection,
 938          * we will (for now) just flush any cached route using a different
 939          * ifn (and cached source addrs) and let output re-choose them
 940          * during the next send on that net.
 941          */
 942         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 943                 /*
 944                  * clear any cached route (and cached source address) if the
 945                  * route's interface is NOT the same as the address change.
 946                  * If it's the same interface, just clear the cached source
 947                  * address.
 948                  */
 949                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 950                     ((ifn == NULL) ||
 951                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 952                         /* clear any cached route */
 953                         RTFREE(net->ro.ro_rt);
 954                         net->ro.ro_rt = NULL;
 955                 }
 956                 /* clear any cached source address */
 957                 if (net->src_addr_selected) {
 958                         sctp_free_ifa(net->ro._s_addr);
 959                         net->ro._s_addr = NULL;
 960                         net->src_addr_selected = 0;
 961                 }
 962         }
 963 }
 964
 965
 966 void
 967 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 968 {
 969         int error;
 970
 971         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 972                 return;
 973         }
 974         if (stcb->asoc.deleted_primary == NULL) {
 975                 return;
 976         }
 977         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 978                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 979                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 980                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 981                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 982                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 983                     stcb->asoc.deleted_primary,
 984                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
 985                 stcb->asoc.num_send_timers_up--;
 986                 if (stcb->asoc.num_send_timers_up < 0) {
 987                         stcb->asoc.num_send_timers_up = 0;
 988                 }
 989                 SCTP_TCB_LOCK_ASSERT(stcb);
 990                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 991                     stcb->asoc.deleted_primary);
 992                 if (error) {
 993                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 994                         return;
 995                 }
 996                 SCTP_TCB_LOCK_ASSERT(stcb);
 997 #ifdef SCTP_AUDITING_ENABLED
 998                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
 999 #endif
1000                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1001                 if ((stcb->asoc.num_send_timers_up == 0) &&
1002                     (stcb->asoc.sent_queue_cnt > 0)) {
1003                         struct sctp_tmit_chunk *chk;
1004
1005                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1006                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1007                             stcb, chk->whoTo);
1008                 }
1009         }
1010         return;
1011 }
1012
1013 static int
1014     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1015
1016 void
1017 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1018 {
1019         struct sctp_tmit_chunk *chk;
1020
1021         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1022         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1023             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1024         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1025         net->error_count = 0;
1026         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1027                 if (chk->whoTo == net) {
1028                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1029                                 chk->sent = SCTP_DATAGRAM_RESEND;
1030                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1031                                 sctp_flight_size_decrease(chk);
1032                                 sctp_total_flight_decrease(stcb, chk);
1033                                 net->marked_retrans++;
1034                                 stcb->asoc.marked_retrans++;
1035                         }
1036                 }
1037         }
1038         if (net->marked_retrans) {
1039                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1040         }
1041 }
1042
1043 static void
1044 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1045 {
1046         struct sctp_nets *net;
1047         int addrnum, changed;
1048
1049         /*
1050          * If number of local valid addresses is 1, the valid address is
1051          * probably newly added address. Several valid addresses in this
1052          * association.  A source address may not be changed.  Additionally,
1053          * they can be configured on a same interface as "alias" addresses.
1054          * (by micchie)
1055          */
1056         addrnum = sctp_local_addr_count(stcb);
1057         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1058             addrnum);
1059         if (addrnum == 1) {
1060                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1061                         /* clear any cached route and source address */
1062                         if (net->ro.ro_rt) {
1063                                 RTFREE(net->ro.ro_rt);
1064                                 net->ro.ro_rt = NULL;
1065                         }
1066                         if (net->src_addr_selected) {
1067                                 sctp_free_ifa(net->ro._s_addr);
1068                                 net->ro._s_addr = NULL;
1069                                 net->src_addr_selected = 0;
1070                         }
1071                         /* Retransmit unacknowledged DATA chunks immediately */
1072                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1073                             SCTP_MOBILITY_FASTHANDOFF)) {
1074                                 sctp_net_immediate_retrans(stcb, net);
1075                         }
1076                         /* also, SET PRIMARY is maybe already sent */
1077                 }
1078                 return;
1079         }
1080         /* Multiple local addresses exsist in the association.  */
1081         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1082                 /* clear any cached route and source address */
1083                 if (net->ro.ro_rt) {
1084                         RTFREE(net->ro.ro_rt);
1085                         net->ro.ro_rt = NULL;
1086                 }
1087                 if (net->src_addr_selected) {
1088                         sctp_free_ifa(net->ro._s_addr);
1089                         net->ro._s_addr = NULL;
1090                         net->src_addr_selected = 0;
1091                 }
1092                 /*
1093                  * Check if the nexthop is corresponding to the new address.
1094                  * If the new address is corresponding to the current
1095                  * nexthop, the path will be changed. If the new address is
1096                  * NOT corresponding to the current nexthop, the path will
1097                  * not be changed.
1098                  */
1099                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1100                     stcb->sctp_ep->def_vrf_id,
1101                     stcb->sctp_ep->fibnum);
1102                 if (net->ro.ro_rt == NULL)
1103                         continue;
1104
1105                 changed = 0;
1106                 switch (net->ro._l_addr.sa.sa_family) {
1107 #ifdef INET
1108                 case AF_INET:
1109                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1110                                 changed = 1;
1111                         }
1112                         break;
1113 #endif
1114 #ifdef INET6
1115                 case AF_INET6:
1116                         if (sctp_v6src_match_nexthop(
1117                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1118                                 changed = 1;
1119                         }
1120                         break;
1121 #endif
1122                 default:
1123                         break;
1124                 }
1125                 /*
1126                  * if the newly added address does not relate routing
1127                  * information, we skip.
1128                  */
1129                 if (changed == 0)
1130                         continue;
1131                 /* Retransmit unacknowledged DATA chunks immediately */
1132                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1133                     SCTP_MOBILITY_FASTHANDOFF)) {
1134                         sctp_net_immediate_retrans(stcb, net);
1135                 }
1136                 /* Send SET PRIMARY for this new address */
1137                 if (net == stcb->asoc.primary_destination) {
1138                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1139                             SCTP_SET_PRIM_ADDR);
1140                 }
1141         }
1142 }
1143
1144 /*
1145  * process an ADD/DELETE IP ack from peer.
1146  * addr: corresponding sctp_ifa to the address being added/deleted.
1147  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1148  * flag: 1=success, 0=failure.
1149  */
1150 static void
1151 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1152 {
1153         /*
1154          * do the necessary asoc list work- if we get a failure indication,
1155          * leave the address on the assoc's restricted list.  If we get a
1156          * success indication, remove the address from the restricted list.
1157          */
1158         /*
1159          * Note: this will only occur for ADD_IP_ADDRESS, since
1160          * DEL_IP_ADDRESS is never actually added to the list...
1161          */
1162         if (flag) {
1163                 /* success case, so remove from the restricted list */
1164                 sctp_del_local_addr_restricted(stcb, addr);
1165
1166                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1167                     SCTP_MOBILITY_BASE) ||
1168                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1169                     SCTP_MOBILITY_FASTHANDOFF)) {
1170                         sctp_path_check_and_react(stcb, addr);
1171                         return;
1172                 }
1173                 /* clear any cached/topologically incorrect source addresses */
1174                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1175         }
1176         /* else, leave it on the list */
1177 }
1178
1179 /*
1180  * add an asconf add/delete/set primary IP address parameter to the queue.
1181  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1182  * returns 0 if queued, -1 if not queued/removed.
1183  * NOTE: if adding, but a delete for the same address is already scheduled
1184  * (and not yet sent out), simply remove it from queue.  Same for deleting
1185  * an address already scheduled for add.  If a duplicate operation is found,
1186  * ignore the new one.
1187  */
1188 static int
1189 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1190     uint16_t type)
1191 {
1192         struct sctp_asconf_addr *aa, *aa_next;
1193
1194         /* make sure the request isn't already in the queue */
1195         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1196                 /* address match? */
1197                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1198                         continue;
1199                 /*
1200                  * is the request already in queue but not sent? pass the
1201                  * request already sent in order to resolve the following
1202                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1203                  * can't remove the ADD request already sent 3. arrival of
1204                  * ADD
1205                  */
1206                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1207                         return (-1);
1208                 }
1209                 /* is the negative request already in queue, and not sent */
1210                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1211                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1212                         /* add requested, delete already queued */
1213                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1214                         /* remove the ifa from the restricted list */
1215                         sctp_del_local_addr_restricted(stcb, ifa);
1216                         /* free the asconf param */
1217                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1218                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1219                         return (-1);
1220                 }
1221                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1222                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1223                         /* delete requested, add already queued */
1224                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1225                         /* remove the aa->ifa from the restricted list */
1226                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1227                         /* free the asconf param */
1228                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1229                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1230                         return (-1);
1231                 }
1232         }                       /* for each aa */
1233
1234         /* adding new request to the queue */
1235         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1236             SCTP_M_ASC_ADDR);
1237         if (aa == NULL) {
1238                 /* didn't get memory */
1239                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1240                 return (-1);
1241         }
1242         aa->special_del = 0;
1243         /* fill in asconf address parameter fields */
1244         /* top level elements are "networked" during send */
1245         aa->ap.aph.ph.param_type = type;
1246         aa->ifa = ifa;
1247         atomic_add_int(&ifa->refcount, 1);
1248         /* correlation_id filled in during send routine later... */
1249         switch (ifa->address.sa.sa_family) {
1250 #ifdef INET6
1251         case AF_INET6:
1252                 {
1253                         struct sockaddr_in6 *sin6;
1254
1255                         sin6 = &ifa->address.sin6;
1256                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1257                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1258                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1259                             sizeof(struct sctp_ipv6addr_param);
1260                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1261                             sizeof(struct in6_addr));
1262                         break;
1263                 }
1264 #endif
1265 #ifdef INET
1266         case AF_INET:
1267                 {
1268                         struct sockaddr_in *sin;
1269
1270                         sin = &ifa->address.sin;
1271                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1272                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1273                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1274                             sizeof(struct sctp_ipv4addr_param);
1275                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1276                             sizeof(struct in_addr));
1277                         break;
1278                 }
1279 #endif
1280         default:
1281                 /* invalid family! */
1282                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1283                 sctp_free_ifa(ifa);
1284                 return (-1);
1285         }
1286         aa->sent = 0;           /* clear sent flag */
1287
1288         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1289 #ifdef SCTP_DEBUG
1290         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1291                 if (type == SCTP_ADD_IP_ADDRESS) {
1292                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1293                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1294                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1295                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1296                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1297                 } else {
1298                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1299                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1300                 }
1301         }
1302 #endif
1303
1304         return (0);
1305 }
1306
1307
1308 /*
1309  * add an asconf operation for the given ifa and type.
1310  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1311  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1312  * advisable.
1313  */
1314 static int
1315 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1316     uint16_t type)
1317 {
1318         uint32_t status;
1319         int pending_delete_queued = 0;
1320         int last;
1321
1322         /* see if peer supports ASCONF */
1323         if (stcb->asoc.asconf_supported == 0) {
1324                 return (-1);
1325         }
1326         /*
1327          * if this is deleting the last address from the assoc, mark it as
1328          * pending.
1329          */
1330         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1331                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1332                         last = (sctp_local_addr_count(stcb) == 0);
1333                 } else {
1334                         last = (sctp_local_addr_count(stcb) == 1);
1335                 }
1336                 if (last) {
1337                         /* set the pending delete info only */
1338                         stcb->asoc.asconf_del_pending = 1;
1339                         stcb->asoc.asconf_addr_del_pending = ifa;
1340                         atomic_add_int(&ifa->refcount, 1);
1341                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1342                             "asconf_queue_add: mark delete last address pending\n");
1343                         return (-1);
1344                 }
1345         }
1346         /* queue an asconf parameter */
1347         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1348
1349         /*
1350          * if this is an add, and there is a delete also pending (i.e. the
1351          * last local address is being changed), queue the pending delete
1352          * too.
1353          */
1354         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1355                 /* queue in the pending delete */
1356                 if (sctp_asconf_queue_mgmt(stcb,
1357                     stcb->asoc.asconf_addr_del_pending,
1358                     SCTP_DEL_IP_ADDRESS) == 0) {
1359                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1360                         pending_delete_queued = 1;
1361                         /* clear out the pending delete info */
1362                         stcb->asoc.asconf_del_pending = 0;
1363                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1364                         stcb->asoc.asconf_addr_del_pending = NULL;
1365                 }
1366         }
1367         if (pending_delete_queued) {
1368                 struct sctp_nets *net;
1369
1370                 /*
1371                  * since we know that the only/last address is now being
1372                  * changed in this case, reset the cwnd/rto on all nets to
1373                  * start as a new address and path.  Also clear the error
1374                  * counts to give the assoc the best chance to complete the
1375                  * address change.
1376                  */
1377                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1378                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1379                             net);
1380                         net->RTO = 0;
1381                         net->error_count = 0;
1382                 }
1383                 stcb->asoc.overall_error_count = 0;
1384                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1385                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1386                             stcb->asoc.overall_error_count,
1387                             0,
1388                             SCTP_FROM_SCTP_ASCONF,
1389                             __LINE__);
1390                 }
1391                 /* queue in an advisory set primary too */
1392                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1393                 /* let caller know we should send this out immediately */
1394                 status = 1;
1395         }
1396         return (status);
1397 }
1398
1399 /*-
1400  * add an asconf delete IP address parameter to the queue by sockaddr and
1401  * possibly with no sctp_ifa available.  This is only called by the routine
1402  * that checks the addresses in an INIT-ACK against the current address list.
1403  * returns 0 if completed, non-zero if not completed.
1404  * NOTE: if an add is already scheduled (and not yet sent out), simply
1405  * remove it from queue.  If a duplicate operation is found, ignore the
1406  * new one.
1407  */
1408 static int
1409 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1410 {
1411         struct sctp_ifa *ifa;
1412         struct sctp_asconf_addr *aa, *aa_next;
1413
1414         if (stcb == NULL) {
1415                 return (-1);
1416         }
1417         /* see if peer supports ASCONF */
1418         if (stcb->asoc.asconf_supported == 0) {
1419                 return (-1);
1420         }
1421         /* make sure the request isn't already in the queue */
1422         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1423                 /* address match? */
1424                 if (sctp_asconf_addr_match(aa, sa) == 0)
1425                         continue;
1426                 /* is the request already in queue (sent or not) */
1427                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1428                         return (-1);
1429                 }
1430                 /* is the negative request already in queue, and not sent */
1431                 if (aa->sent == 1)
1432                         continue;
1433                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1434                         /* add already queued, so remove existing entry */
1435                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1436                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1437                         /* free the entry */
1438                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1439                         return (-1);
1440                 }
1441         }                       /* for each aa */
1442
1443         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1444         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1445
1446         /* adding new request to the queue */
1447         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1448             SCTP_M_ASC_ADDR);
1449         if (aa == NULL) {
1450                 /* didn't get memory */
1451                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1452                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1453                 return (-1);
1454         }
1455         aa->special_del = 0;
1456         /* fill in asconf address parameter fields */
1457         /* top level elements are "networked" during send */
1458         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1459         aa->ifa = ifa;
1460         if (ifa)
1461                 atomic_add_int(&ifa->refcount, 1);
1462         /* correlation_id filled in during send routine later... */
1463         switch (sa->sa_family) {
1464 #ifdef INET6
1465         case AF_INET6:
1466                 {
1467                         /* IPv6 address */
1468                         struct sockaddr_in6 *sin6;
1469
1470                         sin6 = (struct sockaddr_in6 *)sa;
1471                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1472                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1473                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1474                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1475                             sizeof(struct in6_addr));
1476                         break;
1477                 }
1478 #endif
1479 #ifdef INET
1480         case AF_INET:
1481                 {
1482                         /* IPv4 address */
1483                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1484
1485                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1486                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1487                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1488                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1489                             sizeof(struct in_addr));
1490                         break;
1491                 }
1492 #endif
1493         default:
1494                 /* invalid family! */
1495                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1496                 if (ifa)
1497                         sctp_free_ifa(ifa);
1498                 return (-1);
1499         }
1500         aa->sent = 0;           /* clear sent flag */
1501
1502         /* delete goes to the back of the queue */
1503         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1504
1505         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1506         return (0);
1507 }
1508
1509 /*
1510  * find a specific asconf param on our "sent" queue
1511  */
1512 static struct sctp_asconf_addr *
1513 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1514 {
1515         struct sctp_asconf_addr *aa;
1516
1517         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1518                 if (aa->ap.aph.correlation_id == correlation_id &&
1519                     aa->sent == 1) {
1520                         /* found it */
1521                         return (aa);
1522                 }
1523         }
1524         /* didn't find it */
1525         return (NULL);
1526 }
1527
1528 /*
1529  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1530  * notifications based on the error response
1531  */
1532 static void
1533 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1534     struct sctp_asconf_paramhdr *aph)
1535 {
1536         struct sctp_error_cause *eh;
1537         struct sctp_paramhdr *ph;
1538         uint16_t param_type;
1539         uint16_t error_code;
1540
1541         eh = (struct sctp_error_cause *)(aph + 1);
1542         ph = (struct sctp_paramhdr *)(eh + 1);
1543         /* validate lengths */
1544         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1545             htons(aph->ph.param_length)) {
1546                 /* invalid error cause length */
1547                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1548                     "asconf_process_error: cause element too long\n");
1549                 return;
1550         }
1551         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1552             htons(eh->length)) {
1553                 /* invalid included TLV length */
1554                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1555                     "asconf_process_error: included TLV too long\n");
1556                 return;
1557         }
1558         /* which error code ? */
1559         error_code = ntohs(eh->code);
1560         param_type = ntohs(aph->ph.param_type);
1561         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1562         switch (error_code) {
1563         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1564                 /* we allow ourselves to "try again" for this error */
1565                 break;
1566         default:
1567                 /* peer can't handle it... */
1568                 switch (param_type) {
1569                 case SCTP_ADD_IP_ADDRESS:
1570                 case SCTP_DEL_IP_ADDRESS:
1571                 case SCTP_SET_PRIM_ADDR:
1572                         break;
1573                 default:
1574                         break;
1575                 }
1576         }
1577 }
1578
1579 /*
1580  * process an asconf queue param.
1581  * aparam: parameter to process, will be removed from the queue.
1582  * flag: 1=success case, 0=failure case
1583  */
1584 static void
1585 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1586     struct sctp_asconf_addr *aparam, uint32_t flag)
1587 {
1588         uint16_t param_type;
1589
1590         /* process this param */
1591         param_type = aparam->ap.aph.ph.param_type;
1592         switch (param_type) {
1593         case SCTP_ADD_IP_ADDRESS:
1594                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1595                     "process_param_ack: added IP address\n");
1596                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1597                 break;
1598         case SCTP_DEL_IP_ADDRESS:
1599                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1600                     "process_param_ack: deleted IP address\n");
1601                 /* nothing really to do... lists already updated */
1602                 break;
1603         case SCTP_SET_PRIM_ADDR:
1604                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1605                     "process_param_ack: set primary IP address\n");
1606                 /* nothing to do... peer may start using this addr */
1607                 break;
1608         default:
1609                 /* should NEVER happen */
1610                 break;
1611         }
1612
1613         /* remove the param and free it */
1614         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1615         if (aparam->ifa)
1616                 sctp_free_ifa(aparam->ifa);
1617         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1618 }
1619
1620 /*
1621  * cleanup from a bad asconf ack parameter
1622  */
1623 static void
1624 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1625 {
1626         /* assume peer doesn't really know how to do asconfs */
1627         /* XXX we could free the pending queue here */
1628
1629 }
1630
1631 void
1632 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1633     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1634     struct sctp_nets *net, int *abort_no_unlock)
1635 {
1636         struct sctp_association *asoc;
1637         uint32_t serial_num;
1638         uint16_t ack_length;
1639         struct sctp_asconf_paramhdr *aph;
1640         struct sctp_asconf_addr *aa, *aa_next;
1641         uint32_t last_error_id = 0;     /* last error correlation id */
1642         uint32_t id;
1643         struct sctp_asconf_addr *ap;
1644
1645         /* asconf param buffer */
1646         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1647
1648         /* verify minimum length */
1649         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1650                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1651                     "handle_asconf_ack: chunk too small = %xh\n",
1652                     ntohs(cp->ch.chunk_length));
1653                 return;
1654         }
1655         asoc = &stcb->asoc;
1656         serial_num = ntohl(cp->serial_number);
1657
1658         /*
1659          * NOTE: we may want to handle this differently- currently, we will
1660          * abort when we get an ack for the expected serial number + 1 (eg.
1661          * we didn't send it), process an ack normally if it is the expected
1662          * serial number, and re-send the previous ack for *ALL* other
1663          * serial numbers
1664          */
1665
1666         /*
1667          * if the serial number is the next expected, but I didn't send it,
1668          * abort the asoc, since someone probably just hijacked us...
1669          */
1670         if (serial_num == (asoc->asconf_seq_out + 1)) {
1671                 struct mbuf *op_err;
1672                 char msg[SCTP_DIAG_INFO_LEN];
1673
1674                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1675                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1676                     serial_num);
1677                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1678                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1679                 *abort_no_unlock = 1;
1680                 return;
1681         }
1682         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1683                 /* got a duplicate/unexpected ASCONF-ACK */
1684                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1685                     serial_num, asoc->asconf_seq_out_acked + 1);
1686                 return;
1687         }
1688         if (serial_num == asoc->asconf_seq_out - 1) {
1689                 /* stop our timer */
1690                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1691                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1692         }
1693         /* process the ASCONF-ACK contents */
1694         ack_length = ntohs(cp->ch.chunk_length) -
1695             sizeof(struct sctp_asconf_ack_chunk);
1696         offset += sizeof(struct sctp_asconf_ack_chunk);
1697         /* process through all parameters */
1698         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1699                 unsigned int param_length, param_type;
1700
1701                 /* get pointer to next asconf parameter */
1702                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1703                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1704                 if (aph == NULL) {
1705                         /* can't get an asconf paramhdr */
1706                         sctp_asconf_ack_clear(stcb);
1707                         return;
1708                 }
1709                 param_type = ntohs(aph->ph.param_type);
1710                 param_length = ntohs(aph->ph.param_length);
1711                 if (param_length > ack_length) {
1712                         sctp_asconf_ack_clear(stcb);
1713                         return;
1714                 }
1715                 if (param_length < sizeof(struct sctp_paramhdr)) {
1716                         sctp_asconf_ack_clear(stcb);
1717                         return;
1718                 }
1719                 /* get the complete parameter... */
1720                 if (param_length > sizeof(aparam_buf)) {
1721                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1722                             "param length (%u) larger than buffer size!\n", param_length);
1723                         sctp_asconf_ack_clear(stcb);
1724                         return;
1725                 }
1726                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1727                 if (aph == NULL) {
1728                         sctp_asconf_ack_clear(stcb);
1729                         return;
1730                 }
1731                 /* correlation_id is transparent to peer, no ntohl needed */
1732                 id = aph->correlation_id;
1733
1734                 switch (param_type) {
1735                 case SCTP_ERROR_CAUSE_IND:
1736                         last_error_id = id;
1737                         /* find the corresponding asconf param in our queue */
1738                         ap = sctp_asconf_find_param(stcb, id);
1739                         if (ap == NULL) {
1740                                 /* hmm... can't find this in our queue! */
1741                                 break;
1742                         }
1743                         /* process the parameter, failed flag */
1744                         sctp_asconf_process_param_ack(stcb, ap, 0);
1745                         /* process the error response */
1746                         sctp_asconf_process_error(stcb, aph);
1747                         break;
1748                 case SCTP_SUCCESS_REPORT:
1749                         /* find the corresponding asconf param in our queue */
1750                         ap = sctp_asconf_find_param(stcb, id);
1751                         if (ap == NULL) {
1752                                 /* hmm... can't find this in our queue! */
1753                                 break;
1754                         }
1755                         /* process the parameter, success flag */
1756                         sctp_asconf_process_param_ack(stcb, ap, 1);
1757                         break;
1758                 default:
1759                         break;
1760                 }               /* switch */
1761
1762                 /* update remaining ASCONF-ACK message length to process */
1763                 ack_length -= SCTP_SIZE32(param_length);
1764                 if (ack_length <= 0) {
1765                         /* no more data in the mbuf chain */
1766                         break;
1767                 }
1768                 offset += SCTP_SIZE32(param_length);
1769         }                       /* while */
1770
1771         /*
1772          * if there are any "sent" params still on the queue, these are
1773          * implicitly "success", or "failed" (if we got an error back) ...
1774          * so process these appropriately
1775          *
1776          * we assume that the correlation_id's are monotonically increasing
1777          * beginning from 1 and that we don't have *that* many outstanding
1778          * at any given time
1779          */
1780         if (last_error_id == 0)
1781                 last_error_id--;/* set to "max" value */
1782         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1783                 if (aa->sent == 1) {
1784                         /*
1785                          * implicitly successful or failed if correlation_id
1786                          * < last_error_id, then success else, failure
1787                          */
1788                         if (aa->ap.aph.correlation_id < last_error_id)
1789                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1790                         else
1791                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1792                 } else {
1793                         /*
1794                          * since we always process in order (FIFO queue) if
1795                          * we reach one that hasn't been sent, the rest
1796                          * should not have been sent either. so, we're
1797                          * done...
1798                          */
1799                         break;
1800                 }
1801         }
1802
1803         /* update the next sequence number to use */
1804         asoc->asconf_seq_out_acked++;
1805         /* remove the old ASCONF on our outbound queue */
1806         sctp_toss_old_asconf(stcb);
1807         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1808 #ifdef SCTP_TIMER_BASED_ASCONF
1809                 /* we have more params, so restart our timer */
1810                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1811                     stcb, net);
1812 #else
1813                 /* we have more params, so send out more */
1814                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1815 #endif
1816         }
1817 }
1818
1819 #ifdef INET6
1820 static uint32_t
1821 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1822 {
1823         struct sockaddr_in6 *sin6, *net6;
1824         struct sctp_nets *net;
1825
1826         if (sa->sa_family != AF_INET6) {
1827                 /* wrong family */
1828                 return (0);
1829         }
1830         sin6 = (struct sockaddr_in6 *)sa;
1831         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1832                 /* not link local address */
1833                 return (0);
1834         }
1835         /* hunt through our destination nets list for this scope_id */
1836         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1837                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1838                     AF_INET6)
1839                         continue;
1840                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1841                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1842                         continue;
1843                 if (sctp_is_same_scope(sin6, net6)) {
1844                         /* found one */
1845                         return (1);
1846                 }
1847         }
1848         /* didn't find one */
1849         return (0);
1850 }
1851 #endif
1852
1853 /*
1854  * address management functions
1855  */
1856 static void
1857 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1858     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1859 {
1860         int status;
1861
1862         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1863             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1864                 /* subset bound, no ASCONF allowed case, so ignore */
1865                 return;
1866         }
1867         /*
1868          * note: we know this is not the subset bound, no ASCONF case eg.
1869          * this is boundall or subset bound w/ASCONF allowed
1870          */
1871
1872         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1873         switch (ifa->address.sa.sa_family) {
1874 #ifdef INET6
1875         case AF_INET6:
1876                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1877                     &ifa->address.sin6.sin6_addr) != 0) {
1878                         return;
1879                 }
1880                 break;
1881 #endif
1882 #ifdef INET
1883         case AF_INET:
1884                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1885                     &ifa->address.sin.sin_addr) != 0) {
1886                         return;
1887                 }
1888                 break;
1889 #endif
1890         default:
1891                 return;
1892         }
1893 #ifdef INET6
1894         /* make sure we're "allowed" to add this type of addr */
1895         if (ifa->address.sa.sa_family == AF_INET6) {
1896                 /* invalid if we're not a v6 endpoint */
1897                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1898                         return;
1899                 /* is the v6 addr really valid ? */
1900                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1901                         return;
1902                 }
1903         }
1904 #endif
1905         /* put this address on the "pending/do not use yet" list */
1906         sctp_add_local_addr_restricted(stcb, ifa);
1907         /*
1908          * check address scope if address is out of scope, don't queue
1909          * anything... note: this would leave the address on both inp and
1910          * asoc lists
1911          */
1912         switch (ifa->address.sa.sa_family) {
1913 #ifdef INET6
1914         case AF_INET6:
1915                 {
1916                         struct sockaddr_in6 *sin6;
1917
1918                         sin6 = &ifa->address.sin6;
1919                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1920                                 /* we skip unspecifed addresses */
1921                                 return;
1922                         }
1923                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1924                                 if (stcb->asoc.scope.local_scope == 0) {
1925                                         return;
1926                                 }
1927                                 /* is it the right link local scope? */
1928                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1929                                         return;
1930                                 }
1931                         }
1932                         if (stcb->asoc.scope.site_scope == 0 &&
1933                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1934                                 return;
1935                         }
1936                         break;
1937                 }
1938 #endif
1939 #ifdef INET
1940         case AF_INET:
1941                 {
1942                         struct sockaddr_in *sin;
1943                         struct in6pcb *inp6;
1944
1945                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1946                         /* invalid if we are a v6 only endpoint */
1947                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1948                             SCTP_IPV6_V6ONLY(inp6))
1949                                 return;
1950
1951                         sin = &ifa->address.sin;
1952                         if (sin->sin_addr.s_addr == 0) {
1953                                 /* we skip unspecifed addresses */
1954                                 return;
1955                         }
1956                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1957                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1958                                 return;
1959                         }
1960                         break;
1961                 }
1962 #endif
1963         default:
1964                 /* else, not AF_INET or AF_INET6, so skip */
1965                 return;
1966         }
1967
1968         /* queue an asconf for this address add/delete */
1969         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1970                 /* does the peer do asconf? */
1971                 if (stcb->asoc.asconf_supported) {
1972                         /* queue an asconf for this addr */
1973                         status = sctp_asconf_queue_add(stcb, ifa, type);
1974
1975                         /*
1976                          * if queued ok, and in the open state, send out the
1977                          * ASCONF.  If in the non-open state, these will be
1978                          * sent when the state goes open.
1979                          */
1980                         if (status == 0 &&
1981                             ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
1982                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1983 #ifdef SCTP_TIMER_BASED_ASCONF
1984                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1985                                     stcb, stcb->asoc.primary_destination);
1986 #else
1987                                 sctp_send_asconf(stcb, NULL, addr_locked);
1988 #endif
1989                         }
1990                 }
1991         }
1992 }
1993
1994
1995 int
1996 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1997 {
1998         struct sctp_asconf_iterator *asc;
1999         struct sctp_ifa *ifa;
2000         struct sctp_laddr *l;
2001         int cnt_invalid = 0;
2002
2003         asc = (struct sctp_asconf_iterator *)ptr;
2004         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2005                 ifa = l->ifa;
2006                 switch (ifa->address.sa.sa_family) {
2007 #ifdef INET6
2008                 case AF_INET6:
2009                         /* invalid if we're not a v6 endpoint */
2010                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2011                                 cnt_invalid++;
2012                                 if (asc->cnt == cnt_invalid)
2013                                         return (1);
2014                         }
2015                         break;
2016 #endif
2017 #ifdef INET
2018                 case AF_INET:
2019                         {
2020                                 /* invalid if we are a v6 only endpoint */
2021                                 struct in6pcb *inp6;
2022
2023                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2024                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2025                                     SCTP_IPV6_V6ONLY(inp6)) {
2026                                         cnt_invalid++;
2027                                         if (asc->cnt == cnt_invalid)
2028                                                 return (1);
2029                                 }
2030                                 break;
2031                         }
2032 #endif
2033                 default:
2034                         /* invalid address family */
2035                         cnt_invalid++;
2036                         if (asc->cnt == cnt_invalid)
2037                                 return (1);
2038                 }
2039         }
2040         return (0);
2041 }
2042
2043 static int
2044 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2045 {
2046         struct sctp_ifa *ifa;
2047         struct sctp_asconf_iterator *asc;
2048         struct sctp_laddr *laddr, *nladdr, *l;
2049
2050         /* Only for specific case not bound all */
2051         asc = (struct sctp_asconf_iterator *)ptr;
2052         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2053                 ifa = l->ifa;
2054                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2055                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2056                             sctp_nxt_addr) {
2057                                 if (laddr->ifa == ifa) {
2058                                         laddr->action = 0;
2059                                         break;
2060                                 }
2061                         }
2062                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2063                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2064                                 /* remove only after all guys are done */
2065                                 if (laddr->ifa == ifa) {
2066                                         sctp_del_local_addr_ep(inp, ifa);
2067                                 }
2068                         }
2069                 }
2070         }
2071         return (0);
2072 }
2073
2074 void
2075 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2076     void *ptr, uint32_t val SCTP_UNUSED)
2077 {
2078         struct sctp_asconf_iterator *asc;
2079         struct sctp_ifa *ifa;
2080         struct sctp_laddr *l;
2081         int cnt_invalid = 0;
2082         int type, status;
2083         int num_queued = 0;
2084
2085         asc = (struct sctp_asconf_iterator *)ptr;
2086         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2087                 ifa = l->ifa;
2088                 type = l->action;
2089
2090                 /* address's vrf_id must be the vrf_id of the assoc */
2091                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2092                         continue;
2093                 }
2094                 /* Same checks again for assoc */
2095                 switch (ifa->address.sa.sa_family) {
2096 #ifdef INET6
2097                 case AF_INET6:
2098                         {
2099                                 /* invalid if we're not a v6 endpoint */
2100                                 struct sockaddr_in6 *sin6;
2101
2102                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2103                                         cnt_invalid++;
2104                                         if (asc->cnt == cnt_invalid)
2105                                                 return;
2106                                         else
2107                                                 continue;
2108                                 }
2109                                 sin6 = &ifa->address.sin6;
2110                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2111                                         /* we skip unspecifed addresses */
2112                                         continue;
2113                                 }
2114                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2115                                     &sin6->sin6_addr) != 0) {
2116                                         continue;
2117                                 }
2118                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2119                                         if (stcb->asoc.scope.local_scope == 0) {
2120                                                 continue;
2121                                         }
2122                                         /* is it the right link local scope? */
2123                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2124                                                 continue;
2125                                         }
2126                                 }
2127                                 break;
2128                         }
2129 #endif
2130 #ifdef INET
2131                 case AF_INET:
2132                         {
2133                                 /* invalid if we are a v6 only endpoint */
2134                                 struct in6pcb *inp6;
2135                                 struct sockaddr_in *sin;
2136
2137                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2138                                 /* invalid if we are a v6 only endpoint */
2139                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2140                                     SCTP_IPV6_V6ONLY(inp6))
2141                                         continue;
2142
2143                                 sin = &ifa->address.sin;
2144                                 if (sin->sin_addr.s_addr == 0) {
2145                                         /* we skip unspecifed addresses */
2146                                         continue;
2147                                 }
2148                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2149                                     &sin->sin_addr) != 0) {
2150                                         continue;
2151                                 }
2152                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2153                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2154                                         continue;
2155                                 }
2156                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2157                                     SCTP_IPV6_V6ONLY(inp6)) {
2158                                         cnt_invalid++;
2159                                         if (asc->cnt == cnt_invalid)
2160                                                 return;
2161                                         else
2162                                                 continue;
2163                                 }
2164                                 break;
2165                         }
2166 #endif
2167                 default:
2168                         /* invalid address family */
2169                         cnt_invalid++;
2170                         if (asc->cnt == cnt_invalid)
2171                                 return;
2172                         else
2173                                 continue;
2174                         break;
2175                 }
2176
2177                 if (type == SCTP_ADD_IP_ADDRESS) {
2178                         /* prevent this address from being used as a source */
2179                         sctp_add_local_addr_restricted(stcb, ifa);
2180                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2181                         struct sctp_nets *net;
2182
2183                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2184                                 sctp_rtentry_t *rt;
2185
2186                                 /* delete this address if cached */
2187                                 if (net->ro._s_addr == ifa) {
2188                                         sctp_free_ifa(net->ro._s_addr);
2189                                         net->ro._s_addr = NULL;
2190                                         net->src_addr_selected = 0;
2191                                         rt = net->ro.ro_rt;
2192                                         if (rt) {
2193                                                 RTFREE(rt);
2194                                                 net->ro.ro_rt = NULL;
2195                                         }
2196                                         /*
2197                                          * Now we deleted our src address,
2198                                          * should we not also now reset the
2199                                          * cwnd/rto to start as if its a new
2200                                          * address?
2201                                          */
2202                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2203                                         net->RTO = 0;
2204
2205                                 }
2206                         }
2207                 } else if (type == SCTP_SET_PRIM_ADDR) {
2208                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2209                                 /* must validate the ifa is in the ep */
2210                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2211                                         continue;
2212                                 }
2213                         } else {
2214                                 /* Need to check scopes for this guy */
2215                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2216                                         continue;
2217                                 }
2218                         }
2219                 }
2220                 /* queue an asconf for this address add/delete */
2221                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2222                     stcb->asoc.asconf_supported == 1) {
2223                         /* queue an asconf for this addr */
2224                         status = sctp_asconf_queue_add(stcb, ifa, type);
2225                         /*
2226                          * if queued ok, and in the open state, update the
2227                          * count of queued params.  If in the non-open
2228                          * state, these get sent when the assoc goes open.
2229                          */
2230                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2231                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2232                                 if (status >= 0) {
2233                                         num_queued++;
2234                                 }
2235                         }
2236                 }
2237         }
2238         /*
2239          * If we have queued params in the open state, send out an ASCONF.
2240          */
2241         if (num_queued > 0) {
2242                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2243         }
2244 }
2245
2246 void
2247 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2248 {
2249         struct sctp_asconf_iterator *asc;
2250         struct sctp_ifa *ifa;
2251         struct sctp_laddr *l, *nl;
2252
2253         asc = (struct sctp_asconf_iterator *)ptr;
2254         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2255                 ifa = l->ifa;
2256                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2257                         /* Clear the defer use flag */
2258                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2259                 }
2260                 sctp_free_ifa(ifa);
2261                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2262                 SCTP_DECR_LADDR_COUNT();
2263         }
2264         SCTP_FREE(asc, SCTP_M_ASC_IT);
2265 }
2266
2267 /*
2268  * sa is the sockaddr to ask the peer to set primary to.
2269  * returns: 0 = completed, -1 = error
2270  */
2271 int32_t
2272 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2273 {
2274         uint32_t vrf_id;
2275         struct sctp_ifa *ifa;
2276
2277         /* find the ifa for the desired set primary */
2278         vrf_id = stcb->asoc.vrf_id;
2279         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2280         if (ifa == NULL) {
2281                 /* Invalid address */
2282                 return (-1);
2283         }
2284         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2285         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2286                 /* set primary queuing succeeded */
2287                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2288                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2289                     (void *)stcb);
2290                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2291                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2292                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2293 #ifdef SCTP_TIMER_BASED_ASCONF
2294                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2295                             stcb->sctp_ep, stcb,
2296                             stcb->asoc.primary_destination);
2297 #else
2298                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2299 #endif
2300                 }
2301         } else {
2302                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2303                     (void *)stcb);
2304                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2305                 return (-1);
2306         }
2307         return (0);
2308 }
2309
2310 int
2311 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2312 {
2313         struct sctp_tmit_chunk *chk, *nchk;
2314         unsigned int offset, asconf_limit;
2315         struct sctp_asconf_chunk *acp;
2316         struct sctp_asconf_paramhdr *aph;
2317         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2318         struct sctp_paramhdr *ph;
2319         int add_cnt, del_cnt;
2320         uint16_t last_param_type;
2321
2322         add_cnt = del_cnt = 0;
2323         last_param_type = 0;
2324         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2325                 if (chk->data == NULL) {
2326                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2327                         continue;
2328                 }
2329                 offset = 0;
2330                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2331                 offset += sizeof(struct sctp_asconf_chunk);
2332                 asconf_limit = ntohs(acp->ch.chunk_length);
2333                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2334                 if (ph == NULL) {
2335                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2336                         continue;
2337                 }
2338                 offset += ntohs(ph->param_length);
2339
2340                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2341                 if (aph == NULL) {
2342                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2343                         continue;
2344                 }
2345                 while (aph != NULL) {
2346                         unsigned int param_length, param_type;
2347
2348                         param_type = ntohs(aph->ph.param_type);
2349                         param_length = ntohs(aph->ph.param_length);
2350                         if (offset + param_length > asconf_limit) {
2351                                 /* parameter goes beyond end of chunk! */
2352                                 break;
2353                         }
2354                         if (param_length > sizeof(aparam_buf)) {
2355                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2356                                 break;
2357                         }
2358                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2359                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2360                                 break;
2361                         }
2362                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2363                         if (aph == NULL) {
2364                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2365                                 break;
2366                         }
2367                         ph = (struct sctp_paramhdr *)(aph + 1);
2368                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2369                                 switch (param_type) {
2370                                 case SCTP_ADD_IP_ADDRESS:
2371                                         add_cnt++;
2372                                         break;
2373                                 case SCTP_DEL_IP_ADDRESS:
2374                                         del_cnt++;
2375                                         break;
2376                                 default:
2377                                         break;
2378                                 }
2379                                 last_param_type = param_type;
2380                         }
2381                         offset += SCTP_SIZE32(param_length);
2382                         if (offset >= asconf_limit) {
2383                                 /* no more data in the mbuf chain */
2384                                 break;
2385                         }
2386                         /* get pointer to next asconf param */
2387                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2388                 }
2389         }
2390
2391         /*
2392          * we want to find the sequences which consist of ADD -> DEL -> ADD
2393          * or DEL -> ADD
2394          */
2395         if (add_cnt > del_cnt ||
2396             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2397                 return (1);
2398         }
2399         return (0);
2400 }
2401
2402 static struct sockaddr *
2403 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2404 {
2405         struct sctp_vrf *vrf = NULL;
2406         struct sctp_ifn *sctp_ifn;
2407         struct sctp_ifa *sctp_ifa;
2408
2409         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2410                 SCTP_IPI_ADDR_RLOCK();
2411         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2412         if (vrf == NULL) {
2413                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2414                         SCTP_IPI_ADDR_RUNLOCK();
2415                 return (NULL);
2416         }
2417         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2418                 if (stcb->asoc.scope.loopback_scope == 0 &&
2419                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2420                         /* Skip if loopback_scope not set */
2421                         continue;
2422                 }
2423                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2424                         switch (sctp_ifa->address.sa.sa_family) {
2425 #ifdef INET
2426                         case AF_INET:
2427                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2428                                         struct sockaddr_in *sin;
2429
2430                                         sin = &sctp_ifa->address.sin;
2431                                         if (sin->sin_addr.s_addr == 0) {
2432                                                 /* skip unspecifed addresses */
2433                                                 continue;
2434                                         }
2435                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2436                                             &sin->sin_addr) != 0) {
2437                                                 continue;
2438                                         }
2439                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2440                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2441                                                 continue;
2442
2443                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2444                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2445                                                 continue;
2446                                         /*
2447                                          * found a valid local v4 address to
2448                                          * use
2449                                          */
2450                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2451                                                 SCTP_IPI_ADDR_RUNLOCK();
2452                                         return (&sctp_ifa->address.sa);
2453                                 }
2454                                 break;
2455 #endif
2456 #ifdef INET6
2457                         case AF_INET6:
2458                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2459                                         struct sockaddr_in6 *sin6;
2460
2461                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2462                                                 continue;
2463                                         }
2464                                         sin6 = &sctp_ifa->address.sin6;
2465                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2466                                                 /*
2467                                                  * we skip unspecifed
2468                                                  * addresses
2469                                                  */
2470                                                 continue;
2471                                         }
2472                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2473                                             &sin6->sin6_addr) != 0) {
2474                                                 continue;
2475                                         }
2476                                         if (stcb->asoc.scope.local_scope == 0 &&
2477                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2478                                                 continue;
2479                                         if (stcb->asoc.scope.site_scope == 0 &&
2480                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2481                                                 continue;
2482
2483                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2484                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2485                                                 continue;
2486                                         /*
2487                                          * found a valid local v6 address to
2488                                          * use
2489                                          */
2490                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2491                                                 SCTP_IPI_ADDR_RUNLOCK();
2492                                         return (&sctp_ifa->address.sa);
2493                                 }
2494                                 break;
2495 #endif
2496                         default:
2497                                 break;
2498                         }
2499                 }
2500         }
2501         /* no valid addresses found */
2502         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2503                 SCTP_IPI_ADDR_RUNLOCK();
2504         return (NULL);
2505 }
2506
2507 static struct sockaddr *
2508 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2509 {
2510         struct sctp_laddr *laddr;
2511
2512         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2513                 if (laddr->ifa == NULL) {
2514                         continue;
2515                 }
2516                 /* is the address restricted ? */
2517                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2518                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2519                         continue;
2520
2521                 /* found a valid local address to use */
2522                 return (&laddr->ifa->address.sa);
2523         }
2524         /* no valid addresses found */
2525         return (NULL);
2526 }
2527
2528 /*
2529  * builds an ASCONF chunk from queued ASCONF params.
2530  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2531  */
2532 struct mbuf *
2533 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2534 {
2535         struct mbuf *m_asconf, *m_asconf_chk;
2536         struct sctp_asconf_addr *aa;
2537         struct sctp_asconf_chunk *acp;
2538         struct sctp_asconf_paramhdr *aph;
2539         struct sctp_asconf_addr_param *aap;
2540         uint32_t p_length;
2541         uint32_t correlation_id = 1;    /* 0 is reserved... */
2542         caddr_t ptr, lookup_ptr;
2543         uint8_t lookup_used = 0;
2544
2545         /* are there any asconf params to send? */
2546         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2547                 if (aa->sent == 0)
2548                         break;
2549         }
2550         if (aa == NULL)
2551                 return (NULL);
2552
2553         /*
2554          * get a chunk header mbuf and a cluster for the asconf params since
2555          * it's simpler to fill in the asconf chunk header lookup address on
2556          * the fly
2557          */
2558         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2559         if (m_asconf_chk == NULL) {
2560                 /* no mbuf's */
2561                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2562                     "compose_asconf: couldn't get chunk mbuf!\n");
2563                 return (NULL);
2564         }
2565         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2566         if (m_asconf == NULL) {
2567                 /* no mbuf's */
2568                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2569                     "compose_asconf: couldn't get mbuf!\n");
2570                 sctp_m_freem(m_asconf_chk);
2571                 return (NULL);
2572         }
2573         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2574         SCTP_BUF_LEN(m_asconf) = 0;
2575         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2576         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2577         /* save pointers to lookup address and asconf params */
2578         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2579         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2580
2581         /* fill in chunk header info */
2582         acp->ch.chunk_type = SCTP_ASCONF;
2583         acp->ch.chunk_flags = 0;
2584         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2585         stcb->asoc.asconf_seq_out++;
2586
2587         /* add parameters... up to smallest MTU allowed */
2588         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2589                 if (aa->sent)
2590                         continue;
2591                 /* get the parameter length */
2592                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2593                 /* will it fit in current chunk? */
2594                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2595                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2596                         /* won't fit, so we're done with this chunk */
2597                         break;
2598                 }
2599                 /* assign (and store) a correlation id */
2600                 aa->ap.aph.correlation_id = correlation_id++;
2601
2602                 /*
2603                  * fill in address if we're doing a delete this is a simple
2604                  * way for us to fill in the correlation address, which
2605                  * should only be used by the peer if we're deleting our
2606                  * source address and adding a new address (e.g. renumbering
2607                  * case)
2608                  */
2609                 if (lookup_used == 0 &&
2610                     (aa->special_del == 0) &&
2611                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2612                         struct sctp_ipv6addr_param *lookup;
2613                         uint16_t p_size, addr_size;
2614
2615                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2616                         lookup->ph.param_type =
2617                             htons(aa->ap.addrp.ph.param_type);
2618                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2619                                 /* copy IPv6 address */
2620                                 p_size = sizeof(struct sctp_ipv6addr_param);
2621                                 addr_size = sizeof(struct in6_addr);
2622                         } else {
2623                                 /* copy IPv4 address */
2624                                 p_size = sizeof(struct sctp_ipv4addr_param);
2625                                 addr_size = sizeof(struct in_addr);
2626                         }
2627                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2628                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2629                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2630                         lookup_used = 1;
2631                 }
2632                 /* copy into current space */
2633                 memcpy(ptr, &aa->ap, p_length);
2634
2635                 /* network elements and update lengths */
2636                 aph = (struct sctp_asconf_paramhdr *)ptr;
2637                 aap = (struct sctp_asconf_addr_param *)ptr;
2638                 /* correlation_id is transparent to peer, no htonl needed */
2639                 aph->ph.param_type = htons(aph->ph.param_type);
2640                 aph->ph.param_length = htons(aph->ph.param_length);
2641                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2642                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2643
2644                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2645                 ptr += SCTP_SIZE32(p_length);
2646
2647                 /*
2648                  * these params are removed off the pending list upon
2649                  * getting an ASCONF-ACK back from the peer, just set flag
2650                  */
2651                 aa->sent = 1;
2652         }
2653         /* check to see if the lookup addr has been populated yet */
2654         if (lookup_used == 0) {
2655                 /* NOTE: if the address param is optional, can skip this... */
2656                 /* add any valid (existing) address... */
2657                 struct sctp_ipv6addr_param *lookup;
2658                 uint16_t p_size, addr_size;
2659                 struct sockaddr *found_addr;
2660                 caddr_t addr_ptr;
2661
2662                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2663                         found_addr = sctp_find_valid_localaddr(stcb,
2664                             addr_locked);
2665                 else
2666                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2667
2668                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2669                 if (found_addr != NULL) {
2670                         switch (found_addr->sa_family) {
2671 #ifdef INET6
2672                         case AF_INET6:
2673                                 /* copy IPv6 address */
2674                                 lookup->ph.param_type =
2675                                     htons(SCTP_IPV6_ADDRESS);
2676                                 p_size = sizeof(struct sctp_ipv6addr_param);
2677                                 addr_size = sizeof(struct in6_addr);
2678                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2679                                     found_addr)->sin6_addr;
2680                                 break;
2681 #endif
2682 #ifdef INET
2683                         case AF_INET:
2684                                 /* copy IPv4 address */
2685                                 lookup->ph.param_type =
2686                                     htons(SCTP_IPV4_ADDRESS);
2687                                 p_size = sizeof(struct sctp_ipv4addr_param);
2688                                 addr_size = sizeof(struct in_addr);
2689                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2690                                     found_addr)->sin_addr;
2691                                 break;
2692 #endif
2693                         default:
2694                                 p_size = 0;
2695                                 addr_size = 0;
2696                                 addr_ptr = NULL;
2697                                 break;
2698                         }
2699                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2700                         memcpy(lookup->addr, addr_ptr, addr_size);
2701                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2702                 } else {
2703                         /* uh oh... don't have any address?? */
2704                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2705                             "compose_asconf: no lookup addr!\n");
2706                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2707                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2708                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2709                         memset(lookup->addr, 0, sizeof(struct in_addr));
2710                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2711                 }
2712         }
2713         /* chain it all together */
2714         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2715         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2716         acp->ch.chunk_length = htons(*retlen);
2717
2718         return (m_asconf_chk);
2719 }
2720
2721 /*
2722  * section to handle address changes before an association is up eg. changes
2723  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2724  */
2725
2726 /*
2727  * processes the (local) addresses in the INIT-ACK chunk
2728  */
2729 static void
2730 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2731     unsigned int offset, unsigned int length)
2732 {
2733         struct sctp_paramhdr tmp_param, *ph;
2734         uint16_t plen, ptype;
2735         struct sctp_ifa *sctp_ifa;
2736         union sctp_sockstore store;
2737 #ifdef INET6
2738         struct sctp_ipv6addr_param addr6_store;
2739 #endif
2740 #ifdef INET
2741         struct sctp_ipv4addr_param addr4_store;
2742 #endif
2743
2744         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2745         if (stcb == NULL)       /* Un-needed check for SA */
2746                 return;
2747
2748         /* convert to upper bound */
2749         length += offset;
2750
2751         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2752                 return;
2753         }
2754         /* go through the addresses in the init-ack */
2755         ph = (struct sctp_paramhdr *)
2756             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2757             (uint8_t *)&tmp_param);
2758         while (ph != NULL) {
2759                 ptype = ntohs(ph->param_type);
2760                 plen = ntohs(ph->param_length);
2761                 switch (ptype) {
2762 #ifdef INET6
2763                 case SCTP_IPV6_ADDRESS:
2764                         {
2765                                 struct sctp_ipv6addr_param *a6p;
2766
2767                                 /* get the entire IPv6 address param */
2768                                 a6p = (struct sctp_ipv6addr_param *)
2769                                     sctp_m_getptr(m, offset,
2770                                     sizeof(struct sctp_ipv6addr_param),
2771                                     (uint8_t *)&addr6_store);
2772                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2773                                     a6p == NULL) {
2774                                         return;
2775                                 }
2776                                 memset(&store, 0, sizeof(union sctp_sockstore));
2777                                 store.sin6.sin6_family = AF_INET6;
2778                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2779                                 store.sin6.sin6_port = stcb->rport;
2780                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2781                                 break;
2782                         }
2783 #endif
2784 #ifdef INET
2785                 case SCTP_IPV4_ADDRESS:
2786                         {
2787                                 struct sctp_ipv4addr_param *a4p;
2788
2789                                 /* get the entire IPv4 address param */
2790                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2791                                     sizeof(struct sctp_ipv4addr_param),
2792                                     (uint8_t *)&addr4_store);
2793                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2794                                     a4p == NULL) {
2795                                         return;
2796                                 }
2797                                 memset(&store, 0, sizeof(union sctp_sockstore));
2798                                 store.sin.sin_family = AF_INET;
2799                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2800                                 store.sin.sin_port = stcb->rport;
2801                                 store.sin.sin_addr.s_addr = a4p->addr;
2802                                 break;
2803                         }
2804 #endif
2805                 default:
2806                         goto next_addr;
2807                 }
2808
2809                 /* see if this address really (still) exists */
2810                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2811                     SCTP_ADDR_NOT_LOCKED);
2812                 if (sctp_ifa == NULL) {
2813                         /* address doesn't exist anymore */
2814                         int status;
2815
2816                         /* are ASCONFs allowed ? */
2817                         if ((sctp_is_feature_on(stcb->sctp_ep,
2818                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2819                             stcb->asoc.asconf_supported) {
2820                                 /* queue an ASCONF DEL_IP_ADDRESS */
2821                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2822                                 /*
2823                                  * if queued ok, and in correct state, send
2824                                  * out the ASCONF.
2825                                  */
2826                                 if (status == 0 &&
2827                                     SCTP_GET_STATE(&stcb->asoc) ==
2828                                     SCTP_STATE_OPEN) {
2829 #ifdef SCTP_TIMER_BASED_ASCONF
2830                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2831                                             stcb->sctp_ep, stcb,
2832                                             stcb->asoc.primary_destination);
2833 #else
2834                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2835 #endif
2836                                 }
2837                         }
2838                 }
2839 next_addr:
2840                 /*
2841                  * Sanity check:  Make sure the length isn't 0, otherwise
2842                  * we'll be stuck in this loop for a long time...
2843                  */
2844                 if (SCTP_SIZE32(plen) == 0) {
2845                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2846                             plen, ptype);
2847                         return;
2848                 }
2849                 /* get next parameter */
2850                 offset += SCTP_SIZE32(plen);
2851                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2852                         return;
2853                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2854                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2855         }                       /* while */
2856 }
2857
2858 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2859 /*
2860  * checks to see if a specific address is in the initack address list returns
2861  * 1 if found, 0 if not
2862  */
2863 static uint32_t
2864 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2865 {
2866         struct sctp_paramhdr tmp_param, *ph;
2867         uint16_t plen, ptype;
2868 #ifdef INET
2869         struct sockaddr_in *sin;
2870         struct sctp_ipv4addr_param *a4p;
2871         struct sctp_ipv6addr_param addr4_store;
2872 #endif
2873 #ifdef INET6
2874         struct sockaddr_in6 *sin6;
2875         struct sctp_ipv6addr_param *a6p;
2876         struct sctp_ipv6addr_param addr6_store;
2877         struct sockaddr_in6 sin6_tmp;
2878 #endif
2879
2880         switch (sa->sa_family) {
2881 #ifdef INET
2882         case AF_INET:
2883                 break;
2884 #endif
2885 #ifdef INET6
2886         case AF_INET6:
2887                 break;
2888 #endif
2889         default:
2890                 return (0);
2891         }
2892
2893         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2894         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2895         /* convert to upper bound */
2896         length += offset;
2897
2898         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2899                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2900                     "find_initack_addr: invalid offset?\n");
2901                 return (0);
2902         }
2903         /* go through the addresses in the init-ack */
2904         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2905             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2906         while (ph != NULL) {
2907                 ptype = ntohs(ph->param_type);
2908                 plen = ntohs(ph->param_length);
2909                 switch (ptype) {
2910 #ifdef INET6
2911                 case SCTP_IPV6_ADDRESS:
2912                         if (sa->sa_family == AF_INET6) {
2913                                 /* get the entire IPv6 address param */
2914                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2915                                         break;
2916                                 }
2917                                 /* get the entire IPv6 address param */
2918                                 a6p = (struct sctp_ipv6addr_param *)
2919                                     sctp_m_getptr(m, offset,
2920                                     sizeof(struct sctp_ipv6addr_param),
2921                                     (uint8_t *)&addr6_store);
2922                                 if (a6p == NULL) {
2923                                         return (0);
2924                                 }
2925                                 sin6 = (struct sockaddr_in6 *)sa;
2926                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2927                                         /* create a copy and clear scope */
2928                                         memcpy(&sin6_tmp, sin6,
2929                                             sizeof(struct sockaddr_in6));
2930                                         sin6 = &sin6_tmp;
2931                                         in6_clearscope(&sin6->sin6_addr);
2932                                 }
2933                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2934                                     sizeof(struct in6_addr)) == 0) {
2935                                         /* found it */
2936                                         return (1);
2937                                 }
2938                         }
2939                         break;
2940 #endif                          /* INET6 */
2941 #ifdef INET
2942                 case SCTP_IPV4_ADDRESS:
2943                         if (sa->sa_family == AF_INET) {
2944                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2945                                         break;
2946                                 }
2947                                 /* get the entire IPv4 address param */
2948                                 a4p = (struct sctp_ipv4addr_param *)
2949                                     sctp_m_getptr(m, offset,
2950                                     sizeof(struct sctp_ipv4addr_param),
2951                                     (uint8_t *)&addr4_store);
2952                                 if (a4p == NULL) {
2953                                         return (0);
2954                                 }
2955                                 sin = (struct sockaddr_in *)sa;
2956                                 if (sin->sin_addr.s_addr == a4p->addr) {
2957                                         /* found it */
2958                                         return (1);
2959                                 }
2960                         }
2961                         break;
2962 #endif
2963                 default:
2964                         break;
2965                 }
2966                 /* get next parameter */
2967                 offset += SCTP_SIZE32(plen);
2968                 if (offset + sizeof(struct sctp_paramhdr) > length) {
2969                         return (0);
2970                 }
2971                 ph = (struct sctp_paramhdr *)
2972                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2973                     (uint8_t *)&tmp_param);
2974         }                       /* while */
2975         /* not found! */
2976         return (0);
2977 }
2978
2979 /*
2980  * makes sure that the current endpoint local addr list is consistent with
2981  * the new association (eg. subset bound, asconf allowed) adds addresses as
2982  * necessary
2983  */
2984 static void
2985 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2986     int length, struct sockaddr *init_addr)
2987 {
2988         struct sctp_laddr *laddr;
2989
2990         /* go through the endpoint list */
2991         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2992                 /* be paranoid and validate the laddr */
2993                 if (laddr->ifa == NULL) {
2994                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2995                             "check_addr_list_ep: laddr->ifa is NULL");
2996                         continue;
2997                 }
2998                 if (laddr->ifa == NULL) {
2999                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3000                         continue;
3001                 }
3002                 /* do i have it implicitly? */
3003                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3004                         continue;
3005                 }
3006                 /* check to see if in the init-ack */
3007                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3008                         /* try to add it */
3009                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3010                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3011                 }
3012         }
3013 }
3014
3015 /*
3016  * makes sure that the current kernel address list is consistent with the new
3017  * association (with all addrs bound) adds addresses as necessary
3018  */
3019 static void
3020 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3021     int length, struct sockaddr *init_addr,
3022     uint16_t local_scope, uint16_t site_scope,
3023     uint16_t ipv4_scope, uint16_t loopback_scope)
3024 {
3025         struct sctp_vrf *vrf = NULL;
3026         struct sctp_ifn *sctp_ifn;
3027         struct sctp_ifa *sctp_ifa;
3028         uint32_t vrf_id;
3029 #ifdef INET
3030         struct sockaddr_in *sin;
3031 #endif
3032 #ifdef INET6
3033         struct sockaddr_in6 *sin6;
3034 #endif
3035
3036         if (stcb) {
3037                 vrf_id = stcb->asoc.vrf_id;
3038         } else {
3039                 return;
3040         }
3041         SCTP_IPI_ADDR_RLOCK();
3042         vrf = sctp_find_vrf(vrf_id);
3043         if (vrf == NULL) {
3044                 SCTP_IPI_ADDR_RUNLOCK();
3045                 return;
3046         }
3047         /* go through all our known interfaces */
3048         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3049                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3050                         /* skip loopback interface */
3051                         continue;
3052                 }
3053                 /* go through each interface address */
3054                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3055                         /* do i have it implicitly? */
3056                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3057                                 continue;
3058                         }
3059                         switch (sctp_ifa->address.sa.sa_family) {
3060 #ifdef INET
3061                         case AF_INET:
3062                                 sin = &sctp_ifa->address.sin;
3063                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3064                                     &sin->sin_addr) != 0) {
3065                                         continue;
3066                                 }
3067                                 if ((ipv4_scope == 0) &&
3068                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3069                                         /* private address not in scope */
3070                                         continue;
3071                                 }
3072                                 break;
3073 #endif
3074 #ifdef INET6
3075                         case AF_INET6:
3076                                 sin6 = &sctp_ifa->address.sin6;
3077                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3078                                     &sin6->sin6_addr) != 0) {
3079                                         continue;
3080                                 }
3081                                 if ((local_scope == 0) &&
3082                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3083                                         continue;
3084                                 }
3085                                 if ((site_scope == 0) &&
3086                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3087                                         continue;
3088                                 }
3089                                 break;
3090 #endif
3091                         default:
3092                                 break;
3093                         }
3094                         /* check to see if in the init-ack */
3095                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3096                                 /* try to add it */
3097                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3098                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3099                                     SCTP_ADDR_LOCKED);
3100                         }
3101                 }               /* end foreach ifa */
3102         }                       /* end foreach ifn */
3103         SCTP_IPI_ADDR_RUNLOCK();
3104 }
3105
3106 /*
3107  * validates an init-ack chunk (from a cookie-echo) with current addresses
3108  * adds addresses from the init-ack into our local address list, if needed
3109  * queues asconf adds/deletes addresses as needed and makes appropriate list
3110  * changes for source address selection m, offset: points to the start of the
3111  * address list in an init-ack chunk length: total length of the address
3112  * params only init_addr: address where my INIT-ACK was sent from
3113  */
3114 void
3115 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3116     int length, struct sockaddr *init_addr,
3117     uint16_t local_scope, uint16_t site_scope,
3118     uint16_t ipv4_scope, uint16_t loopback_scope)
3119 {
3120         /* process the local addresses in the initack */
3121         sctp_process_initack_addresses(stcb, m, offset, length);
3122
3123         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3124                 /* bound all case */
3125                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3126                     local_scope, site_scope, ipv4_scope, loopback_scope);
3127         } else {
3128                 /* subset bound case */
3129                 if (sctp_is_feature_on(stcb->sctp_ep,
3130                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3131                         /* asconf's allowed */
3132                         sctp_check_address_list_ep(stcb, m, offset, length,
3133                             init_addr);
3134                 }
3135                 /* else, no asconfs allowed, so what we sent is what we get */
3136         }
3137 }
3138
3139 /*
3140  * sctp_bindx() support
3141  */
3142 uint32_t
3143 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3144     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3145 {
3146         struct sctp_ifa *ifa;
3147         struct sctp_laddr *laddr, *nladdr;
3148
3149         if (sa->sa_len == 0) {
3150                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3151                 return (EINVAL);
3152         }
3153         if (sctp_ifap) {
3154                 ifa = sctp_ifap;
3155         } else if (type == SCTP_ADD_IP_ADDRESS) {
3156                 /* For an add the address MUST be on the system */
3157                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3158         } else if (type == SCTP_DEL_IP_ADDRESS) {
3159                 /* For a delete we need to find it in the inp */
3160                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3161         } else {
3162                 ifa = NULL;
3163         }
3164         if (ifa != NULL) {
3165                 if (type == SCTP_ADD_IP_ADDRESS) {
3166                         sctp_add_local_addr_ep(inp, ifa, type);
3167                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3168                         if (inp->laddr_count < 2) {
3169                                 /* can't delete the last local address */
3170                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3171                                 return (EINVAL);
3172                         }
3173                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3174                             sctp_nxt_addr) {
3175                                 if (ifa == laddr->ifa) {
3176                                         /* Mark in the delete */
3177                                         laddr->action = type;
3178                                 }
3179                         }
3180                 }
3181                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3182                         /*
3183                          * There is no need to start the iterator if the inp
3184                          * has no associations.
3185                          */
3186                         if (type == SCTP_DEL_IP_ADDRESS) {
3187                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3188                                         if (laddr->ifa == ifa) {
3189                                                 sctp_del_local_addr_ep(inp, ifa);
3190                                         }
3191                                 }
3192                         }
3193                 } else {
3194                         struct sctp_asconf_iterator *asc;
3195                         struct sctp_laddr *wi;
3196                         int ret;
3197
3198                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3199                             sizeof(struct sctp_asconf_iterator),
3200                             SCTP_M_ASC_IT);
3201                         if (asc == NULL) {
3202                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3203                                 return (ENOMEM);
3204                         }
3205                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3206                         if (wi == NULL) {
3207                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3208                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3209                                 return (ENOMEM);
3210                         }
3211                         LIST_INIT(&asc->list_of_work);
3212                         asc->cnt = 1;
3213                         SCTP_INCR_LADDR_COUNT();
3214                         wi->ifa = ifa;
3215                         wi->action = type;
3216                         atomic_add_int(&ifa->refcount, 1);
3217                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3218                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3219                             sctp_asconf_iterator_stcb,
3220                             sctp_asconf_iterator_ep_end,
3221                             SCTP_PCB_ANY_FLAGS,
3222                             SCTP_PCB_ANY_FEATURES,
3223                             SCTP_ASOC_ANY_STATE,
3224                             (void *)asc, 0,
3225                             sctp_asconf_iterator_end, inp, 0);
3226                         if (ret) {
3227                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3228                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3229                                 sctp_asconf_iterator_end(asc, 0);
3230                                 return (EFAULT);
3231                         }
3232                 }
3233                 return (0);
3234         } else {
3235                 /* invalid address! */
3236                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3237                 return (EADDRNOTAVAIL);
3238         }
3239 }
3240
3241 void
3242 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3243     struct sctp_nets *net)
3244 {
3245         struct sctp_asconf_addr *aa;
3246         struct sctp_ifa *sctp_ifap;
3247         struct sctp_asconf_tag_param *vtag;
3248 #ifdef INET
3249         struct sockaddr_in *to;
3250 #endif
3251 #ifdef INET6
3252         struct sockaddr_in6 *to6;
3253 #endif
3254         if (net == NULL) {
3255                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3256                 return;
3257         }
3258         if (stcb == NULL) {
3259                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3260                 return;
3261         }
3262         /*
3263          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3264          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3265          */
3266         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3267             SCTP_M_ASC_ADDR);
3268         if (aa == NULL) {
3269                 /* didn't get memory */
3270                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3271                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3272                 return;
3273         }
3274         aa->special_del = 0;
3275         /* fill in asconf address parameter fields */
3276         /* top level elements are "networked" during send */
3277         aa->ifa = NULL;
3278         aa->sent = 0;           /* clear sent flag */
3279         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3280         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3281         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3282         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3283         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3284         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3285
3286         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3287             SCTP_M_ASC_ADDR);
3288         if (aa == NULL) {
3289                 /* didn't get memory */
3290                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3291                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3292                 return;
3293         }
3294         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3295         /* fill in asconf address parameter fields */
3296         /* ADD(0.0.0.0) */
3297         switch (net->ro._l_addr.sa.sa_family) {
3298 #ifdef INET
3299         case AF_INET:
3300                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3301                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3302                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3303                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3304                 /* No need to add an address, we are using 0.0.0.0 */
3305                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3306                 break;
3307 #endif
3308 #ifdef INET6
3309         case AF_INET6:
3310                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3311                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3312                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3313                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3314                 /* No need to add an address, we are using 0.0.0.0 */
3315                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3316                 break;
3317 #endif
3318         default:
3319                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3320                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3321                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3322                 return;
3323         }
3324         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3325             SCTP_M_ASC_ADDR);
3326         if (aa == NULL) {
3327                 /* didn't get memory */
3328                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3329                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3330                 return;
3331         }
3332         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3333         /* fill in asconf address parameter fields */
3334         /* ADD(0.0.0.0) */
3335         switch (net->ro._l_addr.sa.sa_family) {
3336 #ifdef INET
3337         case AF_INET:
3338                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3339                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3340                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3341                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3342                 /* No need to add an address, we are using 0.0.0.0 */
3343                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3344                 break;
3345 #endif
3346 #ifdef INET6
3347         case AF_INET6:
3348                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3349                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3350                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3351                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3352                 /* No need to add an address, we are using 0.0.0.0 */
3353                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3354                 break;
3355 #endif
3356         default:
3357                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3358                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3359                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3360                 return;
3361         }
3362         /* Now we must hunt the addresses and add all global addresses */
3363         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3364                 struct sctp_vrf *vrf = NULL;
3365                 struct sctp_ifn *sctp_ifnp;
3366                 uint32_t vrf_id;
3367
3368                 vrf_id = stcb->sctp_ep->def_vrf_id;
3369                 vrf = sctp_find_vrf(vrf_id);
3370                 if (vrf == NULL) {
3371                         goto skip_rest;
3372                 }
3373                 SCTP_IPI_ADDR_RLOCK();
3374                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3375                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3376                                 switch (sctp_ifap->address.sa.sa_family) {
3377 #ifdef INET
3378                                 case AF_INET:
3379                                         to = &sctp_ifap->address.sin;
3380                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3381                                             &to->sin_addr) != 0) {
3382                                                 continue;
3383                                         }
3384                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3385                                                 continue;
3386                                         }
3387                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3388                                                 continue;
3389                                         }
3390                                         break;
3391 #endif
3392 #ifdef INET6
3393                                 case AF_INET6:
3394                                         to6 = &sctp_ifap->address.sin6;
3395                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3396                                             &to6->sin6_addr) != 0) {
3397                                                 continue;
3398                                         }
3399                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3400                                                 continue;
3401                                         }
3402                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3403                                                 continue;
3404                                         }
3405                                         break;
3406 #endif
3407                                 default:
3408                                         continue;
3409                                 }
3410                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3411                         }
3412                 }
3413                 SCTP_IPI_ADDR_RUNLOCK();
3414         } else {
3415                 struct sctp_laddr *laddr;
3416
3417                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3418                         if (laddr->ifa == NULL) {
3419                                 continue;
3420                         }
3421                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3422                                 /*
3423                                  * Address being deleted by the system, dont
3424                                  * list.
3425                                  */
3426                                 continue;
3427                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3428                                 /*
3429                                  * Address being deleted on this ep don't
3430                                  * list.
3431                                  */
3432                                 continue;
3433                         }
3434                         sctp_ifap = laddr->ifa;
3435                         switch (sctp_ifap->address.sa.sa_family) {
3436 #ifdef INET
3437                         case AF_INET:
3438                                 to = &sctp_ifap->address.sin;
3439                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3440                                         continue;
3441                                 }
3442                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3443                                         continue;
3444                                 }
3445                                 break;
3446 #endif
3447 #ifdef INET6
3448                         case AF_INET6:
3449                                 to6 = &sctp_ifap->address.sin6;
3450                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3451                                         continue;
3452                                 }
3453                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3454                                         continue;
3455                                 }
3456                                 break;
3457 #endif
3458                         default:
3459                                 continue;
3460                         }
3461                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3462                 }
3463         }
3464 skip_rest:
3465         /* Now we must send the asconf into the queue */
3466         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3467 }