sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51 #ifdef SCTP_DEBUG
  52 #endif                          /* SCTP_DEBUG */
  53
  54
  55 static void
  56 sctp_asconf_get_source_ip(struct mbuf *m, struct sockaddr *sa)
  57 {
  58         struct ip *iph;
  59
  60 #ifdef INET
  61         struct sockaddr_in *sin;
  62
  63 #endif
  64 #ifdef INET6
  65         struct sockaddr_in6 *sin6;
  66
  67 #endif
  68
  69         iph = mtod(m, struct ip *);
  70         switch (iph->ip_v) {
  71 #ifdef INET
  72         case IPVERSION:
  73                 {
  74                         /* IPv4 source */
  75                         sin = (struct sockaddr_in *)sa;
  76                         bzero(sin, sizeof(*sin));
  77                         sin->sin_family = AF_INET;
  78                         sin->sin_len = sizeof(struct sockaddr_in);
  79                         sin->sin_port = 0;
  80                         sin->sin_addr.s_addr = iph->ip_src.s_addr;
  81                         break;
  82                 }
  83 #endif
  84 #ifdef INET6
  85         case (IPV6_VERSION >> 4):
  86                 {
  87                         /* IPv6 source */
  88                         struct ip6_hdr *ip6;
  89
  90                         sin6 = (struct sockaddr_in6 *)sa;
  91                         bzero(sin6, sizeof(*sin6));
  92                         sin6->sin6_family = AF_INET6;
  93                         sin6->sin6_len = sizeof(struct sockaddr_in6);
  94                         sin6->sin6_port = 0;
  95                         ip6 = mtod(m, struct ip6_hdr *);
  96                         sin6->sin6_addr = ip6->ip6_src;
  97                         break;
  98                 }
  99 #endif                          /* INET6 */
 100         default:
 101                 break;
 102         }
 103         return;
 104 }
 105
 106 /*
 107  * draft-ietf-tsvwg-addip-sctp
 108  *
 109  * An ASCONF parameter queue exists per asoc which holds the pending address
 110  * operations.  Lists are updated upon receipt of ASCONF-ACK.
 111  *
 112  * A restricted_addrs list exists per assoc to hold local addresses that are
 113  * not (yet) usable by the assoc as a source address.  These addresses are
 114  * either pending an ASCONF operation (and exist on the ASCONF parameter
 115  * queue), or they are permanently restricted (the peer has returned an
 116  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
 117  *
 118  * Deleted addresses are always immediately removed from the lists as they will
 119  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
 120  * only if allowed.
 121  */
 122
 123 /*
 124  * ASCONF parameter processing.
 125  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
 126  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
 127  * FIX: allocating this many mbufs on the fly is pretty inefficient...
 128  */
 129 static struct mbuf *
 130 sctp_asconf_success_response(uint32_t id)
 131 {
 132         struct mbuf *m_reply = NULL;
 133         struct sctp_asconf_paramhdr *aph;
 134
 135         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
 136             0, M_DONTWAIT, 1, MT_DATA);
 137         if (m_reply == NULL) {
 138                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 139                     "asconf_success_response: couldn't get mbuf!\n");
 140                 return (NULL);
 141         }
 142         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 143         aph->correlation_id = id;
 144         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
 145         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
 146         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 147         aph->ph.param_length = htons(aph->ph.param_length);
 148
 149         return (m_reply);
 150 }
 151
 152 static struct mbuf *
 153 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 154     uint16_t tlv_length)
 155 {
 156         struct mbuf *m_reply = NULL;
 157         struct sctp_asconf_paramhdr *aph;
 158         struct sctp_error_cause *error;
 159         uint8_t *tlv;
 160
 161         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 162             tlv_length +
 163             sizeof(struct sctp_error_cause)),
 164             0, M_DONTWAIT, 1, MT_DATA);
 165         if (m_reply == NULL) {
 166                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 167                     "asconf_error_response: couldn't get mbuf!\n");
 168                 return (NULL);
 169         }
 170         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 171         error = (struct sctp_error_cause *)(aph + 1);
 172
 173         aph->correlation_id = id;
 174         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 175         error->code = htons(cause);
 176         error->length = tlv_length + sizeof(struct sctp_error_cause);
 177         aph->ph.param_length = error->length +
 178             sizeof(struct sctp_asconf_paramhdr);
 179
 180         if (aph->ph.param_length > MLEN) {
 181                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 182                     "asconf_error_response: tlv_length (%xh) too big\n",
 183                     tlv_length);
 184                 sctp_m_freem(m_reply);  /* discard */
 185                 return (NULL);
 186         }
 187         if (error_tlv != NULL) {
 188                 tlv = (uint8_t *) (error + 1);
 189                 memcpy(tlv, error_tlv, tlv_length);
 190         }
 191         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 192         error->length = htons(error->length);
 193         aph->ph.param_length = htons(aph->ph.param_length);
 194
 195         return (m_reply);
 196 }
 197
 198 static struct mbuf *
 199 sctp_process_asconf_add_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 200     struct sctp_tcb *stcb, int send_hb, int response_required)
 201 {
 202         struct sctp_nets *net;
 203         struct mbuf *m_reply = NULL;
 204         struct sockaddr_storage sa_source, sa_store;
 205         struct sctp_paramhdr *ph;
 206         uint16_t param_type, param_length, aparam_length;
 207         struct sockaddr *sa;
 208         int zero_address = 0;
 209         int bad_address = 0;
 210
 211 #ifdef INET
 212         struct sockaddr_in *sin;
 213         struct sctp_ipv4addr_param *v4addr;
 214
 215 #endif
 216 #ifdef INET6
 217         struct sockaddr_in6 *sin6;
 218         struct sctp_ipv6addr_param *v6addr;
 219
 220 #endif
 221
 222         aparam_length = ntohs(aph->ph.param_length);
 223         ph = (struct sctp_paramhdr *)(aph + 1);
 224         param_type = ntohs(ph->param_type);
 225         param_length = ntohs(ph->param_length);
 226
 227         sa = (struct sockaddr *)&sa_store;
 228         switch (param_type) {
 229 #ifdef INET
 230         case SCTP_IPV4_ADDRESS:
 231                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 232                         /* invalid param size */
 233                         return (NULL);
 234                 }
 235                 v4addr = (struct sctp_ipv4addr_param *)ph;
 236                 sin = (struct sockaddr_in *)&sa_store;
 237                 bzero(sin, sizeof(*sin));
 238                 sin->sin_family = AF_INET;
 239                 sin->sin_len = sizeof(struct sockaddr_in);
 240                 sin->sin_port = stcb->rport;
 241                 sin->sin_addr.s_addr = v4addr->addr;
 242                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 243                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 244                         bad_address = 1;
 245                 }
 246                 if (sin->sin_addr.s_addr == INADDR_ANY)
 247                         zero_address = 1;
 248                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 249                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 250                 break;
 251 #endif
 252 #ifdef INET6
 253         case SCTP_IPV6_ADDRESS:
 254                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 255                         /* invalid param size */
 256                         return (NULL);
 257                 }
 258                 v6addr = (struct sctp_ipv6addr_param *)ph;
 259                 sin6 = (struct sockaddr_in6 *)&sa_store;
 260                 bzero(sin6, sizeof(*sin6));
 261                 sin6->sin6_family = AF_INET6;
 262                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 263                 sin6->sin6_port = stcb->rport;
 264                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 265                     sizeof(struct in6_addr));
 266                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 267                         bad_address = 1;
 268                 }
 269                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 270                         zero_address = 1;
 271                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 272                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 273                 break;
 274 #endif
 275         default:
 276                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 277                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 278                     aparam_length);
 279                 return (m_reply);
 280         }                       /* end switch */
 281
 282         /* if 0.0.0.0/::0, add the source address instead */
 283         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 284                 sa = (struct sockaddr *)&sa_source;
 285                 sctp_asconf_get_source_ip(m, sa);
 286                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 287                     "process_asconf_add_ip: using source addr ");
 288                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 289         }
 290         /* add the address */
 291         if (bad_address) {
 292                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 293                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 294                     aparam_length);
 295         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 296             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 297                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 298                     "process_asconf_add_ip: error adding address\n");
 299                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 300                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 301                     aparam_length);
 302         } else {
 303                 /* notify upper layer */
 304                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 305                 if (response_required) {
 306                         m_reply =
 307                             sctp_asconf_success_response(aph->correlation_id);
 308                 }
 309                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 310                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 311                     stcb, net);
 312                 if (send_hb) {
 313                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 314                 }
 315         }
 316         return (m_reply);
 317 }
 318
 319 static int
 320 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 321 {
 322         struct sctp_nets *src_net, *net;
 323
 324         /* make sure the source address exists as a destination net */
 325         src_net = sctp_findnet(stcb, src);
 326         if (src_net == NULL) {
 327                 /* not found */
 328                 return (-1);
 329         }
 330         /* delete all destination addresses except the source */
 331         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 332                 if (net != src_net) {
 333                         /* delete this address */
 334                         sctp_remove_net(stcb, net);
 335                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 336                             "asconf_del_remote_addrs_except: deleting ");
 337                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 338                             (struct sockaddr *)&net->ro._l_addr);
 339                         /* notify upper layer */
 340                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 341                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 342                 }
 343         }
 344         return (0);
 345 }
 346
 347 static struct mbuf *
 348 sctp_process_asconf_delete_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 349     struct sctp_tcb *stcb, int response_required)
 350 {
 351         struct mbuf *m_reply = NULL;
 352         struct sockaddr_storage sa_source, sa_store;
 353         struct sctp_paramhdr *ph;
 354         uint16_t param_type, param_length, aparam_length;
 355         struct sockaddr *sa;
 356         int zero_address = 0;
 357         int result;
 358
 359 #ifdef INET
 360         struct sockaddr_in *sin;
 361         struct sctp_ipv4addr_param *v4addr;
 362
 363 #endif
 364 #ifdef INET6
 365         struct sockaddr_in6 *sin6;
 366         struct sctp_ipv6addr_param *v6addr;
 367
 368 #endif
 369
 370         /* get the source IP address for src and 0.0.0.0/::0 delete checks */
 371         sctp_asconf_get_source_ip(m, (struct sockaddr *)&sa_source);
 372
 373         aparam_length = ntohs(aph->ph.param_length);
 374         ph = (struct sctp_paramhdr *)(aph + 1);
 375         param_type = ntohs(ph->param_type);
 376         param_length = ntohs(ph->param_length);
 377
 378         sa = (struct sockaddr *)&sa_store;
 379         switch (param_type) {
 380 #ifdef INET
 381         case SCTP_IPV4_ADDRESS:
 382                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 383                         /* invalid param size */
 384                         return (NULL);
 385                 }
 386                 v4addr = (struct sctp_ipv4addr_param *)ph;
 387                 sin = (struct sockaddr_in *)&sa_store;
 388                 bzero(sin, sizeof(*sin));
 389                 sin->sin_family = AF_INET;
 390                 sin->sin_len = sizeof(struct sockaddr_in);
 391                 sin->sin_port = stcb->rport;
 392                 sin->sin_addr.s_addr = v4addr->addr;
 393                 if (sin->sin_addr.s_addr == INADDR_ANY)
 394                         zero_address = 1;
 395                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 396                     "process_asconf_delete_ip: deleting ");
 397                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 398                 break;
 399 #endif
 400 #ifdef INET6
 401         case SCTP_IPV6_ADDRESS:
 402                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 403                         /* invalid param size */
 404                         return (NULL);
 405                 }
 406                 v6addr = (struct sctp_ipv6addr_param *)ph;
 407                 sin6 = (struct sockaddr_in6 *)&sa_store;
 408                 bzero(sin6, sizeof(*sin6));
 409                 sin6->sin6_family = AF_INET6;
 410                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 411                 sin6->sin6_port = stcb->rport;
 412                 memcpy(&sin6->sin6_addr, v6addr->addr,
 413                     sizeof(struct in6_addr));
 414                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 415                         zero_address = 1;
 416                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 417                     "process_asconf_delete_ip: deleting ");
 418                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 419                 break;
 420 #endif
 421         default:
 422                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 423                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 424                     aparam_length);
 425                 return (m_reply);
 426         }
 427
 428         /* make sure the source address is not being deleted */
 429         if (sctp_cmpaddr(sa, (struct sockaddr *)&sa_source)) {
 430                 /* trying to delete the source address! */
 431                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 432                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 433                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 434                     aparam_length);
 435                 return (m_reply);
 436         }
 437         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 438         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 439                 result = sctp_asconf_del_remote_addrs_except(stcb,
 440                     (struct sockaddr *)&sa_source);
 441
 442                 if (result) {
 443                         /* src address did not exist? */
 444                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 445                         /* what error to reply with?? */
 446                         m_reply =
 447                             sctp_asconf_error_response(aph->correlation_id,
 448                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 449                             aparam_length);
 450                 } else if (response_required) {
 451                         m_reply =
 452                             sctp_asconf_success_response(aph->correlation_id);
 453                 }
 454                 return (m_reply);
 455         }
 456         /* delete the address */
 457         result = sctp_del_remote_addr(stcb, sa);
 458         /*
 459          * note if result == -2, the address doesn't exist in the asoc but
 460          * since it's being deleted anyways, we just ack the delete -- but
 461          * this probably means something has already gone awry
 462          */
 463         if (result == -1) {
 464                 /* only one address in the asoc */
 465                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 466                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 467                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 468                     aparam_length);
 469         } else {
 470                 if (response_required) {
 471                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 472                 }
 473                 /* notify upper layer */
 474                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 475         }
 476         return (m_reply);
 477 }
 478
 479 static struct mbuf *
 480 sctp_process_asconf_set_primary(struct mbuf *m,
 481     struct sctp_asconf_paramhdr *aph,
 482     struct sctp_tcb *stcb, int response_required)
 483 {
 484         struct mbuf *m_reply = NULL;
 485         struct sockaddr_storage sa_source, sa_store;
 486         struct sctp_paramhdr *ph;
 487         uint16_t param_type, param_length, aparam_length;
 488         struct sockaddr *sa;
 489         int zero_address = 0;
 490
 491 #ifdef INET
 492         struct sockaddr_in *sin;
 493         struct sctp_ipv4addr_param *v4addr;
 494
 495 #endif
 496 #ifdef INET6
 497         struct sockaddr_in6 *sin6;
 498         struct sctp_ipv6addr_param *v6addr;
 499
 500 #endif
 501
 502         aparam_length = ntohs(aph->ph.param_length);
 503         ph = (struct sctp_paramhdr *)(aph + 1);
 504         param_type = ntohs(ph->param_type);
 505         param_length = ntohs(ph->param_length);
 506
 507         sa = (struct sockaddr *)&sa_store;
 508         switch (param_type) {
 509 #ifdef INET
 510         case SCTP_IPV4_ADDRESS:
 511                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 512                         /* invalid param size */
 513                         return (NULL);
 514                 }
 515                 v4addr = (struct sctp_ipv4addr_param *)ph;
 516                 sin = (struct sockaddr_in *)&sa_store;
 517                 bzero(sin, sizeof(*sin));
 518                 sin->sin_family = AF_INET;
 519                 sin->sin_len = sizeof(struct sockaddr_in);
 520                 sin->sin_addr.s_addr = v4addr->addr;
 521                 if (sin->sin_addr.s_addr == INADDR_ANY)
 522                         zero_address = 1;
 523                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 524                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 525                 break;
 526 #endif
 527 #ifdef INET6
 528         case SCTP_IPV6_ADDRESS:
 529                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 530                         /* invalid param size */
 531                         return (NULL);
 532                 }
 533                 v6addr = (struct sctp_ipv6addr_param *)ph;
 534                 sin6 = (struct sockaddr_in6 *)&sa_store;
 535                 bzero(sin6, sizeof(*sin6));
 536                 sin6->sin6_family = AF_INET6;
 537                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 538                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 539                     sizeof(struct in6_addr));
 540                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 541                         zero_address = 1;
 542                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 543                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 544                 break;
 545 #endif
 546         default:
 547                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 548                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 549                     aparam_length);
 550                 return (m_reply);
 551         }
 552
 553         /* if 0.0.0.0/::0, use the source address instead */
 554         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 555                 sa = (struct sockaddr *)&sa_source;
 556                 sctp_asconf_get_source_ip(m, sa);
 557                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 558                     "process_asconf_set_primary: using source addr ");
 559                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 560         }
 561         /* set the primary address */
 562         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 563                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 564                     "process_asconf_set_primary: primary address set\n");
 565                 /* notify upper layer */
 566                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 567                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 568                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 569                     (stcb->asoc.alternate)) {
 570                         sctp_free_remote_addr(stcb->asoc.alternate);
 571                         stcb->asoc.alternate = NULL;
 572                 }
 573                 if (response_required) {
 574                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 575                 }
 576                 /*
 577                  * Mobility adaptation. Ideally, when the reception of SET
 578                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 579                  * destination, unacknowledged DATA are retransmitted
 580                  * immediately to the new primary destination for seamless
 581                  * handover. If the destination is UNCONFIRMED and marked to
 582                  * REQ_PRIM, The retransmission occur when reception of the
 583                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 584                  * sctp_input.c) Also, when change of the primary
 585                  * destination, it is better that all subsequent new DATA
 586                  * containing already queued DATA are transmitted to the new
 587                  * primary destination. (by micchie)
 588                  */
 589                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 590                     SCTP_MOBILITY_BASE) ||
 591                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 592                     SCTP_MOBILITY_FASTHANDOFF)) &&
 593                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 594                     SCTP_MOBILITY_PRIM_DELETED) &&
 595                     (stcb->asoc.primary_destination->dest_state &
 596                     SCTP_ADDR_UNCONFIRMED) == 0) {
 597
 598                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 599                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 600                             SCTP_MOBILITY_FASTHANDOFF)) {
 601                                 sctp_assoc_immediate_retrans(stcb,
 602                                     stcb->asoc.primary_destination);
 603                         }
 604                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 605                             SCTP_MOBILITY_BASE)) {
 606                                 sctp_move_chunks_from_net(stcb,
 607                                     stcb->asoc.deleted_primary);
 608                         }
 609                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 610                             stcb->asoc.deleted_primary);
 611                 }
 612         } else {
 613                 /* couldn't set the requested primary address! */
 614                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 615                     "process_asconf_set_primary: set primary failed!\n");
 616                 /* must have been an invalid address, so report */
 617                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 618                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 619                     aparam_length);
 620         }
 621
 622         return (m_reply);
 623 }
 624
 625 /*
 626  * handles an ASCONF chunk.
 627  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 628  */
 629 void
 630 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 631     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 632     int first)
 633 {
 634         struct sctp_association *asoc;
 635         uint32_t serial_num;
 636         struct mbuf *n, *m_ack, *m_result, *m_tail;
 637         struct sctp_asconf_ack_chunk *ack_cp;
 638         struct sctp_asconf_paramhdr *aph, *ack_aph;
 639         struct sctp_ipv6addr_param *p_addr;
 640         unsigned int asconf_limit, cnt;
 641         int error = 0;          /* did an error occur? */
 642
 643         /* asconf param buffer */
 644         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 645         struct sctp_asconf_ack *ack, *ack_next;
 646
 647         /* verify minimum length */
 648         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 649                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 650                     "handle_asconf: chunk too small = %xh\n",
 651                     ntohs(cp->ch.chunk_length));
 652                 return;
 653         }
 654         asoc = &stcb->asoc;
 655         serial_num = ntohl(cp->serial_number);
 656
 657         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 658                 /* got a duplicate ASCONF */
 659                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 660                     "handle_asconf: got duplicate serial number = %xh\n",
 661                     serial_num);
 662                 return;
 663         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 664                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 665                     serial_num, asoc->asconf_seq_in + 1);
 666                 return;
 667         }
 668         /* it's the expected "next" sequence number, so process it */
 669         asoc->asconf_seq_in = serial_num;       /* update sequence */
 670         /* get length of all the param's in the ASCONF */
 671         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 672         SCTPDBG(SCTP_DEBUG_ASCONF1,
 673             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 674             asconf_limit, serial_num);
 675
 676         if (first) {
 677                 /* delete old cache */
 678                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 679
 680                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 681                         if (ack->serial_number == serial_num)
 682                                 break;
 683                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 684                             ack->serial_number, serial_num);
 685                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 686                         if (ack->data != NULL) {
 687                                 sctp_m_freem(ack->data);
 688                         }
 689                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 690                 }
 691         }
 692         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 693             M_DONTWAIT, 1, MT_DATA);
 694         if (m_ack == NULL) {
 695                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 696                     "handle_asconf: couldn't get mbuf!\n");
 697                 return;
 698         }
 699         m_tail = m_ack;         /* current reply chain's tail */
 700
 701         /* fill in ASCONF-ACK header */
 702         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 703         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 704         ack_cp->ch.chunk_flags = 0;
 705         ack_cp->serial_number = htonl(serial_num);
 706         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 707         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 708         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 709
 710         /* skip the lookup address parameter */
 711         offset += sizeof(struct sctp_asconf_chunk);
 712         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 713         if (p_addr == NULL) {
 714                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 715                     "handle_asconf: couldn't get lookup addr!\n");
 716                 /* respond with a missing/invalid mandatory parameter error */
 717                 return;
 718         }
 719         /* param_length is already validated in process_control... */
 720         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 721
 722         /* get pointer to first asconf param in ASCONF-ACK */
 723         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 724         if (ack_aph == NULL) {
 725                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 726                 return;
 727         }
 728         /* get pointer to first asconf param in ASCONF */
 729         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 730         if (aph == NULL) {
 731                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 732                 goto send_reply;
 733         }
 734         /* process through all parameters */
 735         cnt = 0;
 736         while (aph != NULL) {
 737                 unsigned int param_length, param_type;
 738
 739                 param_type = ntohs(aph->ph.param_type);
 740                 param_length = ntohs(aph->ph.param_length);
 741                 if (offset + param_length > asconf_limit) {
 742                         /* parameter goes beyond end of chunk! */
 743                         sctp_m_freem(m_ack);
 744                         return;
 745                 }
 746                 m_result = NULL;
 747
 748                 if (param_length > sizeof(aparam_buf)) {
 749                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 750                         sctp_m_freem(m_ack);
 751                         return;
 752                 }
 753                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 754                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 755                         sctp_m_freem(m_ack);
 756                 }
 757                 /* get the entire parameter */
 758                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 759                 if (aph == NULL) {
 760                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 761                         sctp_m_freem(m_ack);
 762                         return;
 763                 }
 764                 switch (param_type) {
 765                 case SCTP_ADD_IP_ADDRESS:
 766                         asoc->peer_supports_asconf = 1;
 767                         m_result = sctp_process_asconf_add_ip(m, aph, stcb,
 768                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 769                         cnt++;
 770                         break;
 771                 case SCTP_DEL_IP_ADDRESS:
 772                         asoc->peer_supports_asconf = 1;
 773                         m_result = sctp_process_asconf_delete_ip(m, aph, stcb,
 774                             error);
 775                         break;
 776                 case SCTP_ERROR_CAUSE_IND:
 777                         /* not valid in an ASCONF chunk */
 778                         break;
 779                 case SCTP_SET_PRIM_ADDR:
 780                         asoc->peer_supports_asconf = 1;
 781                         m_result = sctp_process_asconf_set_primary(m, aph,
 782                             stcb, error);
 783                         break;
 784                 case SCTP_NAT_VTAGS:
 785                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 786                         break;
 787                 case SCTP_SUCCESS_REPORT:
 788                         /* not valid in an ASCONF chunk */
 789                         break;
 790                 case SCTP_ULP_ADAPTATION:
 791                         /* FIX */
 792                         break;
 793                 default:
 794                         if ((param_type & 0x8000) == 0) {
 795                                 /* Been told to STOP at this param */
 796                                 asconf_limit = offset;
 797                                 /*
 798                                  * FIX FIX - We need to call
 799                                  * sctp_arethere_unrecognized_parameters()
 800                                  * to get a operr and send it for any
 801                                  * param's with the 0x4000 bit set OR do it
 802                                  * here ourselves... note we still must STOP
 803                                  * if the 0x8000 bit is clear.
 804                                  */
 805                         }
 806                         /* unknown/invalid param type */
 807                         break;
 808                 }               /* switch */
 809
 810                 /* add any (error) result to the reply mbuf chain */
 811                 if (m_result != NULL) {
 812                         SCTP_BUF_NEXT(m_tail) = m_result;
 813                         m_tail = m_result;
 814                         /* update lengths, make sure it's aligned too */
 815                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 816                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 817                         /* set flag to force success reports */
 818                         error = 1;
 819                 }
 820                 offset += SCTP_SIZE32(param_length);
 821                 /* update remaining ASCONF message length to process */
 822                 if (offset >= asconf_limit) {
 823                         /* no more data in the mbuf chain */
 824                         break;
 825                 }
 826                 /* get pointer to next asconf param */
 827                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 828                     sizeof(struct sctp_asconf_paramhdr),
 829                     (uint8_t *) & aparam_buf);
 830                 if (aph == NULL) {
 831                         /* can't get an asconf paramhdr */
 832                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 833                         /* FIX ME - add error here... */
 834                 }
 835         }
 836
 837 send_reply:
 838         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 839         /* save the ASCONF-ACK reply */
 840         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 841             struct sctp_asconf_ack);
 842         if (ack == NULL) {
 843                 sctp_m_freem(m_ack);
 844                 return;
 845         }
 846         ack->serial_number = serial_num;
 847         ack->last_sent_to = NULL;
 848         ack->data = m_ack;
 849         ack->len = 0;
 850         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 851                 ack->len += SCTP_BUF_LEN(n);
 852         }
 853         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 854
 855         /* see if last_control_chunk_from is set properly (use IP src addr) */
 856         if (stcb->asoc.last_control_chunk_from == NULL) {
 857                 /*
 858                  * this could happen if the source address was just newly
 859                  * added
 860                  */
 861                 struct ip *iph;
 862                 struct sctphdr *sh;
 863                 struct sockaddr_storage from_store;
 864                 struct sockaddr *from = (struct sockaddr *)&from_store;
 865
 866                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 867                 /* pullup already done, IP options already stripped */
 868                 iph = mtod(m, struct ip *);
 869                 switch (iph->ip_v) {
 870 #ifdef INET
 871                 case IPVERSION:
 872                         {
 873                                 struct sockaddr_in *from4;
 874
 875                                 sh = (struct sctphdr *)((caddr_t)iph + sizeof(*iph));
 876                                 from4 = (struct sockaddr_in *)&from_store;
 877                                 bzero(from4, sizeof(*from4));
 878                                 from4->sin_family = AF_INET;
 879                                 from4->sin_len = sizeof(struct sockaddr_in);
 880                                 from4->sin_addr.s_addr = iph->ip_src.s_addr;
 881                                 from4->sin_port = sh->src_port;
 882                                 break;
 883                         }
 884 #endif
 885 #ifdef INET6
 886                 case IPV6_VERSION >> 4:
 887                         {
 888                                 struct ip6_hdr *ip6;
 889                                 struct sockaddr_in6 *from6;
 890
 891                                 ip6 = mtod(m, struct ip6_hdr *);
 892                                 sh = (struct sctphdr *)((caddr_t)ip6 + sizeof(*ip6));
 893                                 from6 = (struct sockaddr_in6 *)&from_store;
 894                                 bzero(from6, sizeof(*from6));
 895                                 from6->sin6_family = AF_INET6;
 896                                 from6->sin6_len = sizeof(struct sockaddr_in6);
 897                                 from6->sin6_addr = ip6->ip6_src;
 898                                 from6->sin6_port = sh->src_port;
 899                                 /*
 900                                  * Get the scopes in properly to the sin6
 901                                  * addr's
 902                                  */
 903                                 /* we probably don't need these operations */
 904                                 (void)sa6_recoverscope(from6);
 905                                 sa6_embedscope(from6,
 906                                     MODULE_GLOBAL(ip6_use_defzone));
 907
 908                                 break;
 909                         }
 910 #endif
 911                 default:
 912                         /* unknown address type */
 913                         from = NULL;
 914                 }
 915                 if (from != NULL) {
 916                         SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 917                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, from);
 918                         /* look up the from address */
 919                         stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, from);
 920 #ifdef SCTP_DEBUG
 921                         if (stcb->asoc.last_control_chunk_from == NULL)
 922                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 923 #endif
 924                 }
 925         }
 926 }
 927
 928 /*
 929  * does the address match? returns 0 if not, 1 if so
 930  */
 931 static uint32_t
 932 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 933 {
 934         switch (sa->sa_family) {
 935 #ifdef INET6
 936         case AF_INET6:
 937                 {
 938                         /* XXX scopeid */
 939                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 940
 941                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 942                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 943                             sizeof(struct in6_addr)) == 0)) {
 944                                 return (1);
 945                         }
 946                         break;
 947                 }
 948 #endif
 949 #ifdef INET
 950         case AF_INET:
 951                 {
 952                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 953
 954                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 955                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 956                             sizeof(struct in_addr)) == 0)) {
 957                                 return (1);
 958                         }
 959                         break;
 960                 }
 961 #endif
 962         default:
 963                 break;
 964         }
 965         return (0);
 966 }
 967
 968 /*
 969  * does the address match? returns 0 if not, 1 if so
 970  */
 971 static uint32_t
 972 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 973 {
 974         uint16_t param_type, param_length;
 975
 976         param_type = ntohs(ph->param_type);
 977         param_length = ntohs(ph->param_length);
 978         switch (sa->sa_family) {
 979 #ifdef INET6
 980         case AF_INET6:
 981                 {
 982                         /* XXX scopeid */
 983                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 984                         struct sctp_ipv6addr_param *v6addr;
 985
 986                         v6addr = (struct sctp_ipv6addr_param *)ph;
 987                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 988                             param_length == sizeof(struct sctp_ipv6addr_param) &&
 989                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 990                             sizeof(struct in6_addr)) == 0)) {
 991                                 return (1);
 992                         }
 993                         break;
 994                 }
 995 #endif
 996 #ifdef INET
 997         case AF_INET:
 998                 {
 999                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1000                         struct sctp_ipv4addr_param *v4addr;
1001
1002                         v4addr = (struct sctp_ipv4addr_param *)ph;
1003                         if ((param_type == SCTP_IPV4_ADDRESS) &&
1004                             param_length == sizeof(struct sctp_ipv4addr_param) &&
1005                             (memcmp(&v4addr->addr, &sin->sin_addr,
1006                             sizeof(struct in_addr)) == 0)) {
1007                                 return (1);
1008                         }
1009                         break;
1010                 }
1011 #endif
1012         default:
1013                 break;
1014         }
1015         return (0);
1016 }
1017
1018 /*
1019  * Cleanup for non-responded/OP ERR'd ASCONF
1020  */
1021 void
1022 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
1023 {
1024         /* mark peer as ASCONF incapable */
1025         stcb->asoc.peer_supports_asconf = 0;
1026         /*
1027          * clear out any existing asconfs going out
1028          */
1029         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1030             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
1031         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
1032         /* remove the old ASCONF on our outbound queue */
1033         sctp_toss_old_asconf(stcb);
1034 }
1035
1036 /*
1037  * cleanup any cached source addresses that may be topologically
1038  * incorrect after a new address has been added to this interface.
1039  */
1040 static void
1041 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
1042 {
1043         struct sctp_nets *net;
1044
1045         /*
1046          * Ideally, we want to only clear cached routes and source addresses
1047          * that are topologically incorrect.  But since there is no easy way
1048          * to know whether the newly added address on the ifn would cause a
1049          * routing change (i.e. a new egress interface would be chosen)
1050          * without doing a new routing lookup and source address selection,
1051          * we will (for now) just flush any cached route using a different
1052          * ifn (and cached source addrs) and let output re-choose them
1053          * during the next send on that net.
1054          */
1055         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1056                 /*
1057                  * clear any cached route (and cached source address) if the
1058                  * route's interface is NOT the same as the address change.
1059                  * If it's the same interface, just clear the cached source
1060                  * address.
1061                  */
1062                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
1063                     ((ifn == NULL) ||
1064                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
1065                         /* clear any cached route */
1066                         RTFREE(net->ro.ro_rt);
1067                         net->ro.ro_rt = NULL;
1068                 }
1069                 /* clear any cached source address */
1070                 if (net->src_addr_selected) {
1071                         sctp_free_ifa(net->ro._s_addr);
1072                         net->ro._s_addr = NULL;
1073                         net->src_addr_selected = 0;
1074                 }
1075         }
1076 }
1077
1078
1079 void
1080 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
1081 {
1082         int error;
1083
1084         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1085                 return;
1086         }
1087         if (stcb->asoc.deleted_primary == NULL) {
1088                 return;
1089         }
1090         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1091                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1092                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1093                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1094                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1095                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1096                     stcb->asoc.deleted_primary,
1097                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1098                 stcb->asoc.num_send_timers_up--;
1099                 if (stcb->asoc.num_send_timers_up < 0) {
1100                         stcb->asoc.num_send_timers_up = 0;
1101                 }
1102                 SCTP_TCB_LOCK_ASSERT(stcb);
1103                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1104                     stcb->asoc.deleted_primary);
1105                 if (error) {
1106                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1107                         return;
1108                 }
1109                 SCTP_TCB_LOCK_ASSERT(stcb);
1110 #ifdef SCTP_AUDITING_ENABLED
1111                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1112 #endif
1113                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1114                 if ((stcb->asoc.num_send_timers_up == 0) &&
1115                     (stcb->asoc.sent_queue_cnt > 0)) {
1116                         struct sctp_tmit_chunk *chk;
1117
1118                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1119                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1120                             stcb, chk->whoTo);
1121                 }
1122         }
1123         return;
1124 }
1125
1126 static int
1127     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1128
1129 void
1130 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1131 {
1132         struct sctp_tmit_chunk *chk;
1133
1134         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1135         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1136             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1137         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1138         net->error_count = 0;
1139         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1140                 if (chk->whoTo == net) {
1141                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1142                                 chk->sent = SCTP_DATAGRAM_RESEND;
1143                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1144                                 sctp_flight_size_decrease(chk);
1145                                 sctp_total_flight_decrease(stcb, chk);
1146                                 net->marked_retrans++;
1147                                 stcb->asoc.marked_retrans++;
1148                         }
1149                 }
1150         }
1151         if (net->marked_retrans) {
1152                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1153         }
1154 }
1155
1156 static void
1157 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1158 {
1159         struct sctp_nets *net;
1160         int addrnum, changed;
1161
1162         /*
1163          * If number of local valid addresses is 1, the valid address is
1164          * probably newly added address. Several valid addresses in this
1165          * association.  A source address may not be changed.  Additionally,
1166          * they can be configured on a same interface as "alias" addresses.
1167          * (by micchie)
1168          */
1169         addrnum = sctp_local_addr_count(stcb);
1170         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1171             addrnum);
1172         if (addrnum == 1) {
1173                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1174                         /* clear any cached route and source address */
1175                         if (net->ro.ro_rt) {
1176                                 RTFREE(net->ro.ro_rt);
1177                                 net->ro.ro_rt = NULL;
1178                         }
1179                         if (net->src_addr_selected) {
1180                                 sctp_free_ifa(net->ro._s_addr);
1181                                 net->ro._s_addr = NULL;
1182                                 net->src_addr_selected = 0;
1183                         }
1184                         /* Retransmit unacknowledged DATA chunks immediately */
1185                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1186                             SCTP_MOBILITY_FASTHANDOFF)) {
1187                                 sctp_net_immediate_retrans(stcb, net);
1188                         }
1189                         /* also, SET PRIMARY is maybe already sent */
1190                 }
1191                 return;
1192         }
1193         /* Multiple local addresses exsist in the association.  */
1194         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1195                 /* clear any cached route and source address */
1196                 if (net->ro.ro_rt) {
1197                         RTFREE(net->ro.ro_rt);
1198                         net->ro.ro_rt = NULL;
1199                 }
1200                 if (net->src_addr_selected) {
1201                         sctp_free_ifa(net->ro._s_addr);
1202                         net->ro._s_addr = NULL;
1203                         net->src_addr_selected = 0;
1204                 }
1205                 /*
1206                  * Check if the nexthop is corresponding to the new address.
1207                  * If the new address is corresponding to the current
1208                  * nexthop, the path will be changed. If the new address is
1209                  * NOT corresponding to the current nexthop, the path will
1210                  * not be changed.
1211                  */
1212                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1213                     stcb->sctp_ep->def_vrf_id);
1214                 if (net->ro.ro_rt == NULL)
1215                         continue;
1216
1217                 changed = 0;
1218                 switch (net->ro._l_addr.sa.sa_family) {
1219 #ifdef INET
1220                 case AF_INET:
1221                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1222                                 changed = 1;
1223                         }
1224                         break;
1225 #endif
1226 #ifdef INET6
1227                 case AF_INET6:
1228                         if (sctp_v6src_match_nexthop(
1229                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1230                                 changed = 1;
1231                         }
1232                         break;
1233 #endif
1234                 default:
1235                         break;
1236                 }
1237                 /*
1238                  * if the newly added address does not relate routing
1239                  * information, we skip.
1240                  */
1241                 if (changed == 0)
1242                         continue;
1243                 /* Retransmit unacknowledged DATA chunks immediately */
1244                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1245                     SCTP_MOBILITY_FASTHANDOFF)) {
1246                         sctp_net_immediate_retrans(stcb, net);
1247                 }
1248                 /* Send SET PRIMARY for this new address */
1249                 if (net == stcb->asoc.primary_destination) {
1250                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1251                             SCTP_SET_PRIM_ADDR);
1252                 }
1253         }
1254 }
1255
1256 /*
1257  * process an ADD/DELETE IP ack from peer.
1258  * addr: corresponding sctp_ifa to the address being added/deleted.
1259  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1260  * flag: 1=success, 0=failure.
1261  */
1262 static void
1263 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1264 {
1265         /*
1266          * do the necessary asoc list work- if we get a failure indication,
1267          * leave the address on the assoc's restricted list.  If we get a
1268          * success indication, remove the address from the restricted list.
1269          */
1270         /*
1271          * Note: this will only occur for ADD_IP_ADDRESS, since
1272          * DEL_IP_ADDRESS is never actually added to the list...
1273          */
1274         if (flag) {
1275                 /* success case, so remove from the restricted list */
1276                 sctp_del_local_addr_restricted(stcb, addr);
1277
1278                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1279                     SCTP_MOBILITY_BASE) ||
1280                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1281                     SCTP_MOBILITY_FASTHANDOFF)) {
1282                         sctp_path_check_and_react(stcb, addr);
1283                         return;
1284                 }
1285                 /* clear any cached/topologically incorrect source addresses */
1286                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1287         }
1288         /* else, leave it on the list */
1289 }
1290
1291 /*
1292  * add an asconf add/delete/set primary IP address parameter to the queue.
1293  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1294  * returns 0 if queued, -1 if not queued/removed.
1295  * NOTE: if adding, but a delete for the same address is already scheduled
1296  * (and not yet sent out), simply remove it from queue.  Same for deleting
1297  * an address already scheduled for add.  If a duplicate operation is found,
1298  * ignore the new one.
1299  */
1300 static int
1301 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1302     uint16_t type)
1303 {
1304         struct sctp_asconf_addr *aa, *aa_next;
1305         struct sockaddr *sa;
1306
1307         /* make sure the request isn't already in the queue */
1308         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1309                 /* address match? */
1310                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1311                         continue;
1312                 /*
1313                  * is the request already in queue but not sent? pass the
1314                  * request already sent in order to resolve the following
1315                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1316                  * can't remove the ADD request already sent 3. arrival of
1317                  * ADD
1318                  */
1319                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1320                         return (-1);
1321                 }
1322                 /* is the negative request already in queue, and not sent */
1323                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1324                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1325                         /* add requested, delete already queued */
1326                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1327                         /* remove the ifa from the restricted list */
1328                         sctp_del_local_addr_restricted(stcb, ifa);
1329                         /* free the asconf param */
1330                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1331                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1332                         return (-1);
1333                 }
1334                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1335                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1336                         /* delete requested, add already queued */
1337                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1338                         /* remove the aa->ifa from the restricted list */
1339                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1340                         /* free the asconf param */
1341                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1342                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1343                         return (-1);
1344                 }
1345         }                       /* for each aa */
1346
1347         /* adding new request to the queue */
1348         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1349             SCTP_M_ASC_ADDR);
1350         if (aa == NULL) {
1351                 /* didn't get memory */
1352                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1353                 return (-1);
1354         }
1355         aa->special_del = 0;
1356         /* fill in asconf address parameter fields */
1357         /* top level elements are "networked" during send */
1358         aa->ap.aph.ph.param_type = type;
1359         aa->ifa = ifa;
1360         atomic_add_int(&ifa->refcount, 1);
1361         /* correlation_id filled in during send routine later... */
1362         switch (ifa->address.sa.sa_family) {
1363 #ifdef INET6
1364         case AF_INET6:
1365                 {
1366                         struct sockaddr_in6 *sin6;
1367
1368                         sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1369                         sa = (struct sockaddr *)sin6;
1370                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1371                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1372                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1373                             sizeof(struct sctp_ipv6addr_param);
1374                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1375                             sizeof(struct in6_addr));
1376                         break;
1377                 }
1378 #endif
1379 #ifdef INET
1380         case AF_INET:
1381                 {
1382                         struct sockaddr_in *sin;
1383
1384                         sin = (struct sockaddr_in *)&ifa->address.sa;
1385                         sa = (struct sockaddr *)sin;
1386                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1387                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1388                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1389                             sizeof(struct sctp_ipv4addr_param);
1390                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1391                             sizeof(struct in_addr));
1392                         break;
1393                 }
1394 #endif
1395         default:
1396                 /* invalid family! */
1397                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1398                 sctp_free_ifa(ifa);
1399                 return (-1);
1400         }
1401         aa->sent = 0;           /* clear sent flag */
1402
1403         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1404 #ifdef SCTP_DEBUG
1405         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1406                 if (type == SCTP_ADD_IP_ADDRESS) {
1407                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1408                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1409                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1410                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1411                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1412                 } else {
1413                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1414                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1415                 }
1416         }
1417 #endif
1418
1419         return (0);
1420 }
1421
1422
1423 /*
1424  * add an asconf operation for the given ifa and type.
1425  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1426  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1427  * advisable.
1428  */
1429 static int
1430 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1431     uint16_t type)
1432 {
1433         uint32_t status;
1434         int pending_delete_queued = 0;
1435
1436         /* see if peer supports ASCONF */
1437         if (stcb->asoc.peer_supports_asconf == 0) {
1438                 return (-1);
1439         }
1440         /*
1441          * if this is deleting the last address from the assoc, mark it as
1442          * pending.
1443          */
1444         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1445             (sctp_local_addr_count(stcb) < 2)) {
1446                 /* set the pending delete info only */
1447                 stcb->asoc.asconf_del_pending = 1;
1448                 stcb->asoc.asconf_addr_del_pending = ifa;
1449                 atomic_add_int(&ifa->refcount, 1);
1450                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1451                     "asconf_queue_add: mark delete last address pending\n");
1452                 return (-1);
1453         }
1454         /* queue an asconf parameter */
1455         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1456
1457         /*
1458          * if this is an add, and there is a delete also pending (i.e. the
1459          * last local address is being changed), queue the pending delete
1460          * too.
1461          */
1462         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1463                 /* queue in the pending delete */
1464                 if (sctp_asconf_queue_mgmt(stcb,
1465                     stcb->asoc.asconf_addr_del_pending,
1466                     SCTP_DEL_IP_ADDRESS) == 0) {
1467                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1468                         pending_delete_queued = 1;
1469                         /* clear out the pending delete info */
1470                         stcb->asoc.asconf_del_pending = 0;
1471                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1472                         stcb->asoc.asconf_addr_del_pending = NULL;
1473                 }
1474         }
1475         if (pending_delete_queued) {
1476                 struct sctp_nets *net;
1477
1478                 /*
1479                  * since we know that the only/last address is now being
1480                  * changed in this case, reset the cwnd/rto on all nets to
1481                  * start as a new address and path.  Also clear the error
1482                  * counts to give the assoc the best chance to complete the
1483                  * address change.
1484                  */
1485                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1486                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1487                             net);
1488                         net->RTO = 0;
1489                         net->error_count = 0;
1490                 }
1491                 stcb->asoc.overall_error_count = 0;
1492                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1493                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1494                             stcb->asoc.overall_error_count,
1495                             0,
1496                             SCTP_FROM_SCTP_ASCONF,
1497                             __LINE__);
1498                 }
1499                 /* queue in an advisory set primary too */
1500                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1501                 /* let caller know we should send this out immediately */
1502                 status = 1;
1503         }
1504         return (status);
1505 }
1506
1507 /*-
1508  * add an asconf delete IP address parameter to the queue by sockaddr and
1509  * possibly with no sctp_ifa available.  This is only called by the routine
1510  * that checks the addresses in an INIT-ACK against the current address list.
1511  * returns 0 if completed, non-zero if not completed.
1512  * NOTE: if an add is already scheduled (and not yet sent out), simply
1513  * remove it from queue.  If a duplicate operation is found, ignore the
1514  * new one.
1515  */
1516 static int
1517 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1518 {
1519         struct sctp_ifa *ifa;
1520         struct sctp_asconf_addr *aa, *aa_next;
1521         uint32_t vrf_id;
1522
1523         if (stcb == NULL) {
1524                 return (-1);
1525         }
1526         /* see if peer supports ASCONF */
1527         if (stcb->asoc.peer_supports_asconf == 0) {
1528                 return (-1);
1529         }
1530         /* make sure the request isn't already in the queue */
1531         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1532                 /* address match? */
1533                 if (sctp_asconf_addr_match(aa, sa) == 0)
1534                         continue;
1535                 /* is the request already in queue (sent or not) */
1536                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1537                         return (-1);
1538                 }
1539                 /* is the negative request already in queue, and not sent */
1540                 if (aa->sent == 1)
1541                         continue;
1542                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1543                         /* add already queued, so remove existing entry */
1544                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1545                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1546                         /* free the entry */
1547                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1548                         return (-1);
1549                 }
1550         }                       /* for each aa */
1551
1552         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1553         if (stcb) {
1554                 vrf_id = stcb->asoc.vrf_id;
1555         } else {
1556                 vrf_id = SCTP_DEFAULT_VRFID;
1557         }
1558         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1559
1560         /* adding new request to the queue */
1561         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1562             SCTP_M_ASC_ADDR);
1563         if (aa == NULL) {
1564                 /* didn't get memory */
1565                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1566                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1567                 return (-1);
1568         }
1569         aa->special_del = 0;
1570         /* fill in asconf address parameter fields */
1571         /* top level elements are "networked" during send */
1572         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1573         aa->ifa = ifa;
1574         if (ifa)
1575                 atomic_add_int(&ifa->refcount, 1);
1576         /* correlation_id filled in during send routine later... */
1577         switch (sa->sa_family) {
1578 #ifdef INET6
1579         case AF_INET6:
1580                 {
1581                         /* IPv6 address */
1582                         struct sockaddr_in6 *sin6;
1583
1584                         sin6 = (struct sockaddr_in6 *)sa;
1585                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1586                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1587                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1588                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1589                             sizeof(struct in6_addr));
1590                         break;
1591                 }
1592 #endif
1593 #ifdef INET
1594         case AF_INET:
1595                 {
1596                         /* IPv4 address */
1597                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1598
1599                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1600                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1601                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1602                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1603                             sizeof(struct in_addr));
1604                         break;
1605                 }
1606 #endif
1607         default:
1608                 /* invalid family! */
1609                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1610                 if (ifa)
1611                         sctp_free_ifa(ifa);
1612                 return (-1);
1613         }
1614         aa->sent = 0;           /* clear sent flag */
1615
1616         /* delete goes to the back of the queue */
1617         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1618
1619         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1620         return (0);
1621 }
1622
1623 /*
1624  * find a specific asconf param on our "sent" queue
1625  */
1626 static struct sctp_asconf_addr *
1627 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1628 {
1629         struct sctp_asconf_addr *aa;
1630
1631         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1632                 if (aa->ap.aph.correlation_id == correlation_id &&
1633                     aa->sent == 1) {
1634                         /* found it */
1635                         return (aa);
1636                 }
1637         }
1638         /* didn't find it */
1639         return (NULL);
1640 }
1641
1642 /*
1643  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1644  * notifications based on the error response
1645  */
1646 static void
1647 sctp_asconf_process_error(struct sctp_tcb *stcb,
1648     struct sctp_asconf_paramhdr *aph)
1649 {
1650         struct sctp_error_cause *eh;
1651         struct sctp_paramhdr *ph;
1652         uint16_t param_type;
1653         uint16_t error_code;
1654
1655         eh = (struct sctp_error_cause *)(aph + 1);
1656         ph = (struct sctp_paramhdr *)(eh + 1);
1657         /* validate lengths */
1658         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1659             htons(aph->ph.param_length)) {
1660                 /* invalid error cause length */
1661                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1662                     "asconf_process_error: cause element too long\n");
1663                 return;
1664         }
1665         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1666             htons(eh->length)) {
1667                 /* invalid included TLV length */
1668                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1669                     "asconf_process_error: included TLV too long\n");
1670                 return;
1671         }
1672         /* which error code ? */
1673         error_code = ntohs(eh->code);
1674         param_type = ntohs(aph->ph.param_type);
1675         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1676         switch (error_code) {
1677         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1678                 /* we allow ourselves to "try again" for this error */
1679                 break;
1680         default:
1681                 /* peer can't handle it... */
1682                 switch (param_type) {
1683                 case SCTP_ADD_IP_ADDRESS:
1684                 case SCTP_DEL_IP_ADDRESS:
1685                         stcb->asoc.peer_supports_asconf = 0;
1686                         break;
1687                 case SCTP_SET_PRIM_ADDR:
1688                         stcb->asoc.peer_supports_asconf = 0;
1689                         break;
1690                 default:
1691                         break;
1692                 }
1693         }
1694 }
1695
1696 /*
1697  * process an asconf queue param.
1698  * aparam: parameter to process, will be removed from the queue.
1699  * flag: 1=success case, 0=failure case
1700  */
1701 static void
1702 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1703     struct sctp_asconf_addr *aparam, uint32_t flag)
1704 {
1705         uint16_t param_type;
1706
1707         /* process this param */
1708         param_type = aparam->ap.aph.ph.param_type;
1709         switch (param_type) {
1710         case SCTP_ADD_IP_ADDRESS:
1711                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1712                     "process_param_ack: added IP address\n");
1713                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1714                 break;
1715         case SCTP_DEL_IP_ADDRESS:
1716                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1717                     "process_param_ack: deleted IP address\n");
1718                 /* nothing really to do... lists already updated */
1719                 break;
1720         case SCTP_SET_PRIM_ADDR:
1721                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1722                     "process_param_ack: set primary IP address\n");
1723                 /* nothing to do... peer may start using this addr */
1724                 if (flag == 0)
1725                         stcb->asoc.peer_supports_asconf = 0;
1726                 break;
1727         default:
1728                 /* should NEVER happen */
1729                 break;
1730         }
1731
1732         /* remove the param and free it */
1733         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1734         if (aparam->ifa)
1735                 sctp_free_ifa(aparam->ifa);
1736         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1737 }
1738
1739 /*
1740  * cleanup from a bad asconf ack parameter
1741  */
1742 static void
1743 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1744 {
1745         /* assume peer doesn't really know how to do asconfs */
1746         stcb->asoc.peer_supports_asconf = 0;
1747         /* XXX we could free the pending queue here */
1748 }
1749
1750 void
1751 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1752     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1753     struct sctp_nets *net, int *abort_no_unlock)
1754 {
1755         struct sctp_association *asoc;
1756         uint32_t serial_num;
1757         uint16_t ack_length;
1758         struct sctp_asconf_paramhdr *aph;
1759         struct sctp_asconf_addr *aa, *aa_next;
1760         uint32_t last_error_id = 0;     /* last error correlation id */
1761         uint32_t id;
1762         struct sctp_asconf_addr *ap;
1763
1764         /* asconf param buffer */
1765         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1766
1767         /* verify minimum length */
1768         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1769                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1770                     "handle_asconf_ack: chunk too small = %xh\n",
1771                     ntohs(cp->ch.chunk_length));
1772                 return;
1773         }
1774         asoc = &stcb->asoc;
1775         serial_num = ntohl(cp->serial_number);
1776
1777         /*
1778          * NOTE: we may want to handle this differently- currently, we will
1779          * abort when we get an ack for the expected serial number + 1 (eg.
1780          * we didn't send it), process an ack normally if it is the expected
1781          * serial number, and re-send the previous ack for *ALL* other
1782          * serial numbers
1783          */
1784
1785         /*
1786          * if the serial number is the next expected, but I didn't send it,
1787          * abort the asoc, since someone probably just hijacked us...
1788          */
1789         if (serial_num == (asoc->asconf_seq_out + 1)) {
1790                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1791                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1792                 *abort_no_unlock = 1;
1793                 return;
1794         }
1795         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1796                 /* got a duplicate/unexpected ASCONF-ACK */
1797                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1798                     serial_num, asoc->asconf_seq_out_acked + 1);
1799                 return;
1800         }
1801         if (serial_num == asoc->asconf_seq_out - 1) {
1802                 /* stop our timer */
1803                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1804                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1805         }
1806         /* process the ASCONF-ACK contents */
1807         ack_length = ntohs(cp->ch.chunk_length) -
1808             sizeof(struct sctp_asconf_ack_chunk);
1809         offset += sizeof(struct sctp_asconf_ack_chunk);
1810         /* process through all parameters */
1811         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1812                 unsigned int param_length, param_type;
1813
1814                 /* get pointer to next asconf parameter */
1815                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1816                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1817                 if (aph == NULL) {
1818                         /* can't get an asconf paramhdr */
1819                         sctp_asconf_ack_clear(stcb);
1820                         return;
1821                 }
1822                 param_type = ntohs(aph->ph.param_type);
1823                 param_length = ntohs(aph->ph.param_length);
1824                 if (param_length > ack_length) {
1825                         sctp_asconf_ack_clear(stcb);
1826                         return;
1827                 }
1828                 if (param_length < sizeof(struct sctp_paramhdr)) {
1829                         sctp_asconf_ack_clear(stcb);
1830                         return;
1831                 }
1832                 /* get the complete parameter... */
1833                 if (param_length > sizeof(aparam_buf)) {
1834                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1835                             "param length (%u) larger than buffer size!\n", param_length);
1836                         sctp_asconf_ack_clear(stcb);
1837                         return;
1838                 }
1839                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1840                 if (aph == NULL) {
1841                         sctp_asconf_ack_clear(stcb);
1842                         return;
1843                 }
1844                 /* correlation_id is transparent to peer, no ntohl needed */
1845                 id = aph->correlation_id;
1846
1847                 switch (param_type) {
1848                 case SCTP_ERROR_CAUSE_IND:
1849                         last_error_id = id;
1850                         /* find the corresponding asconf param in our queue */
1851                         ap = sctp_asconf_find_param(stcb, id);
1852                         if (ap == NULL) {
1853                                 /* hmm... can't find this in our queue! */
1854                                 break;
1855                         }
1856                         /* process the parameter, failed flag */
1857                         sctp_asconf_process_param_ack(stcb, ap, 0);
1858                         /* process the error response */
1859                         sctp_asconf_process_error(stcb, aph);
1860                         break;
1861                 case SCTP_SUCCESS_REPORT:
1862                         /* find the corresponding asconf param in our queue */
1863                         ap = sctp_asconf_find_param(stcb, id);
1864                         if (ap == NULL) {
1865                                 /* hmm... can't find this in our queue! */
1866                                 break;
1867                         }
1868                         /* process the parameter, success flag */
1869                         sctp_asconf_process_param_ack(stcb, ap, 1);
1870                         break;
1871                 default:
1872                         break;
1873                 }               /* switch */
1874
1875                 /* update remaining ASCONF-ACK message length to process */
1876                 ack_length -= SCTP_SIZE32(param_length);
1877                 if (ack_length <= 0) {
1878                         /* no more data in the mbuf chain */
1879                         break;
1880                 }
1881                 offset += SCTP_SIZE32(param_length);
1882         }                       /* while */
1883
1884         /*
1885          * if there are any "sent" params still on the queue, these are
1886          * implicitly "success", or "failed" (if we got an error back) ...
1887          * so process these appropriately
1888          *
1889          * we assume that the correlation_id's are monotonically increasing
1890          * beginning from 1 and that we don't have *that* many outstanding
1891          * at any given time
1892          */
1893         if (last_error_id == 0)
1894                 last_error_id--;/* set to "max" value */
1895         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1896                 if (aa->sent == 1) {
1897                         /*
1898                          * implicitly successful or failed if correlation_id
1899                          * < last_error_id, then success else, failure
1900                          */
1901                         if (aa->ap.aph.correlation_id < last_error_id)
1902                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1903                         else
1904                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1905                 } else {
1906                         /*
1907                          * since we always process in order (FIFO queue) if
1908                          * we reach one that hasn't been sent, the rest
1909                          * should not have been sent either. so, we're
1910                          * done...
1911                          */
1912                         break;
1913                 }
1914         }
1915
1916         /* update the next sequence number to use */
1917         asoc->asconf_seq_out_acked++;
1918         /* remove the old ASCONF on our outbound queue */
1919         sctp_toss_old_asconf(stcb);
1920         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1921 #ifdef SCTP_TIMER_BASED_ASCONF
1922                 /* we have more params, so restart our timer */
1923                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1924                     stcb, net);
1925 #else
1926                 /* we have more params, so send out more */
1927                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1928 #endif
1929         }
1930 }
1931
1932 #ifdef INET6
1933 static uint32_t
1934 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1935 {
1936         struct sockaddr_in6 *sin6, *net6;
1937         struct sctp_nets *net;
1938
1939         if (sa->sa_family != AF_INET6) {
1940                 /* wrong family */
1941                 return (0);
1942         }
1943         sin6 = (struct sockaddr_in6 *)sa;
1944         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1945                 /* not link local address */
1946                 return (0);
1947         }
1948         /* hunt through our destination nets list for this scope_id */
1949         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1950                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1951                     AF_INET6)
1952                         continue;
1953                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1954                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1955                         continue;
1956                 if (sctp_is_same_scope(sin6, net6)) {
1957                         /* found one */
1958                         return (1);
1959                 }
1960         }
1961         /* didn't find one */
1962         return (0);
1963 }
1964
1965 #endif
1966
1967 /*
1968  * address management functions
1969  */
1970 static void
1971 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1972     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1973 {
1974         int status;
1975
1976
1977         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1978             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1979                 /* subset bound, no ASCONF allowed case, so ignore */
1980                 return;
1981         }
1982         /*
1983          * note: we know this is not the subset bound, no ASCONF case eg.
1984          * this is boundall or subset bound w/ASCONF allowed
1985          */
1986
1987         /* first, make sure it's a good address family */
1988         switch (ifa->address.sa.sa_family) {
1989 #ifdef INET6
1990         case AF_INET6:
1991                 break;
1992 #endif
1993 #ifdef INET
1994         case AF_INET:
1995                 break;
1996 #endif
1997         default:
1998                 return;
1999         }
2000 #ifdef INET6
2001         /* make sure we're "allowed" to add this type of addr */
2002         if (ifa->address.sa.sa_family == AF_INET6) {
2003                 /* invalid if we're not a v6 endpoint */
2004                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
2005                         return;
2006                 /* is the v6 addr really valid ? */
2007                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2008                         return;
2009                 }
2010         }
2011 #endif
2012         /* put this address on the "pending/do not use yet" list */
2013         sctp_add_local_addr_restricted(stcb, ifa);
2014         /*
2015          * check address scope if address is out of scope, don't queue
2016          * anything... note: this would leave the address on both inp and
2017          * asoc lists
2018          */
2019         switch (ifa->address.sa.sa_family) {
2020 #ifdef INET6
2021         case AF_INET6:
2022                 {
2023                         struct sockaddr_in6 *sin6;
2024
2025                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2026                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2027                                 /* we skip unspecifed addresses */
2028                                 return;
2029                         }
2030                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2031                                 if (stcb->asoc.local_scope == 0) {
2032                                         return;
2033                                 }
2034                                 /* is it the right link local scope? */
2035                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2036                                         return;
2037                                 }
2038                         }
2039                         if (stcb->asoc.site_scope == 0 &&
2040                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
2041                                 return;
2042                         }
2043                         break;
2044                 }
2045 #endif
2046 #ifdef INET
2047         case AF_INET:
2048                 {
2049                         struct sockaddr_in *sin;
2050                         struct in6pcb *inp6;
2051
2052                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2053                         /* invalid if we are a v6 only endpoint */
2054                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2055                             SCTP_IPV6_V6ONLY(inp6))
2056                                 return;
2057
2058                         sin = (struct sockaddr_in *)&ifa->address.sa;
2059                         if (sin->sin_addr.s_addr == 0) {
2060                                 /* we skip unspecifed addresses */
2061                                 return;
2062                         }
2063                         if (stcb->asoc.ipv4_local_scope == 0 &&
2064                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2065                                 return;
2066                         }
2067                         break;
2068                 }
2069 #endif
2070         default:
2071                 /* else, not AF_INET or AF_INET6, so skip */
2072                 return;
2073         }
2074
2075         /* queue an asconf for this address add/delete */
2076         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
2077                 /* does the peer do asconf? */
2078                 if (stcb->asoc.peer_supports_asconf) {
2079                         /* queue an asconf for this addr */
2080                         status = sctp_asconf_queue_add(stcb, ifa, type);
2081
2082                         /*
2083                          * if queued ok, and in the open state, send out the
2084                          * ASCONF.  If in the non-open state, these will be
2085                          * sent when the state goes open.
2086                          */
2087                         if (status == 0 &&
2088                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2089 #ifdef SCTP_TIMER_BASED_ASCONF
2090                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2091                                     stcb, stcb->asoc.primary_destination);
2092 #else
2093                                 sctp_send_asconf(stcb, NULL, addr_locked);
2094 #endif
2095                         }
2096                 }
2097         }
2098 }
2099
2100
2101 int
2102 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2103 {
2104         struct sctp_asconf_iterator *asc;
2105         struct sctp_ifa *ifa;
2106         struct sctp_laddr *l;
2107         int cnt_invalid = 0;
2108
2109         asc = (struct sctp_asconf_iterator *)ptr;
2110         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2111                 ifa = l->ifa;
2112                 switch (ifa->address.sa.sa_family) {
2113 #ifdef INET6
2114                 case AF_INET6:
2115                         /* invalid if we're not a v6 endpoint */
2116                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2117                                 cnt_invalid++;
2118                                 if (asc->cnt == cnt_invalid)
2119                                         return (1);
2120                         }
2121                         break;
2122 #endif
2123 #ifdef INET
2124                 case AF_INET:
2125                         {
2126                                 /* invalid if we are a v6 only endpoint */
2127                                 struct in6pcb *inp6;
2128
2129                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2130                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2131                                     SCTP_IPV6_V6ONLY(inp6)) {
2132                                         cnt_invalid++;
2133                                         if (asc->cnt == cnt_invalid)
2134                                                 return (1);
2135                                 }
2136                                 break;
2137                         }
2138 #endif
2139                 default:
2140                         /* invalid address family */
2141                         cnt_invalid++;
2142                         if (asc->cnt == cnt_invalid)
2143                                 return (1);
2144                 }
2145         }
2146         return (0);
2147 }
2148
2149 static int
2150 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2151 {
2152         struct sctp_ifa *ifa;
2153         struct sctp_asconf_iterator *asc;
2154         struct sctp_laddr *laddr, *nladdr, *l;
2155
2156         /* Only for specific case not bound all */
2157         asc = (struct sctp_asconf_iterator *)ptr;
2158         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2159                 ifa = l->ifa;
2160                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2161                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2162                             sctp_nxt_addr) {
2163                                 if (laddr->ifa == ifa) {
2164                                         laddr->action = 0;
2165                                         break;
2166                                 }
2167                         }
2168                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2169                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2170                                 /* remove only after all guys are done */
2171                                 if (laddr->ifa == ifa) {
2172                                         sctp_del_local_addr_ep(inp, ifa);
2173                                 }
2174                         }
2175                 }
2176         }
2177         return (0);
2178 }
2179
2180 void
2181 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2182     void *ptr, uint32_t val SCTP_UNUSED)
2183 {
2184         struct sctp_asconf_iterator *asc;
2185         struct sctp_ifa *ifa;
2186         struct sctp_laddr *l;
2187         int cnt_invalid = 0;
2188         int type, status;
2189         int num_queued = 0;
2190
2191         asc = (struct sctp_asconf_iterator *)ptr;
2192         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2193                 ifa = l->ifa;
2194                 type = l->action;
2195
2196                 /* address's vrf_id must be the vrf_id of the assoc */
2197                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2198                         continue;
2199                 }
2200                 /* Same checks again for assoc */
2201                 switch (ifa->address.sa.sa_family) {
2202 #ifdef INET6
2203                 case AF_INET6:
2204                         {
2205                                 /* invalid if we're not a v6 endpoint */
2206                                 struct sockaddr_in6 *sin6;
2207
2208                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2209                                         cnt_invalid++;
2210                                         if (asc->cnt == cnt_invalid)
2211                                                 return;
2212                                         else
2213                                                 continue;
2214                                 }
2215                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2216                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2217                                         /* we skip unspecifed addresses */
2218                                         continue;
2219                                 }
2220                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2221                                         if (stcb->asoc.local_scope == 0) {
2222                                                 continue;
2223                                         }
2224                                         /* is it the right link local scope? */
2225                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2226                                                 continue;
2227                                         }
2228                                 }
2229                                 break;
2230                         }
2231 #endif
2232 #ifdef INET
2233                 case AF_INET:
2234                         {
2235                                 /* invalid if we are a v6 only endpoint */
2236                                 struct in6pcb *inp6;
2237                                 struct sockaddr_in *sin;
2238
2239                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2240                                 /* invalid if we are a v6 only endpoint */
2241                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2242                                     SCTP_IPV6_V6ONLY(inp6))
2243                                         continue;
2244
2245                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2246                                 if (sin->sin_addr.s_addr == 0) {
2247                                         /* we skip unspecifed addresses */
2248                                         continue;
2249                                 }
2250                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2251                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2252                                         continue;
2253                                 }
2254                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2255                                     SCTP_IPV6_V6ONLY(inp6)) {
2256                                         cnt_invalid++;
2257                                         if (asc->cnt == cnt_invalid)
2258                                                 return;
2259                                         else
2260                                                 continue;
2261                                 }
2262                                 break;
2263                         }
2264 #endif
2265                 default:
2266                         /* invalid address family */
2267                         cnt_invalid++;
2268                         if (asc->cnt == cnt_invalid)
2269                                 return;
2270                         else
2271                                 continue;
2272                         break;
2273                 }
2274
2275                 if (type == SCTP_ADD_IP_ADDRESS) {
2276                         /* prevent this address from being used as a source */
2277                         sctp_add_local_addr_restricted(stcb, ifa);
2278                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2279                         struct sctp_nets *net;
2280
2281                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2282                                 sctp_rtentry_t *rt;
2283
2284                                 /* delete this address if cached */
2285                                 if (net->ro._s_addr == ifa) {
2286                                         sctp_free_ifa(net->ro._s_addr);
2287                                         net->ro._s_addr = NULL;
2288                                         net->src_addr_selected = 0;
2289                                         rt = net->ro.ro_rt;
2290                                         if (rt) {
2291                                                 RTFREE(rt);
2292                                                 net->ro.ro_rt = NULL;
2293                                         }
2294                                         /*
2295                                          * Now we deleted our src address,
2296                                          * should we not also now reset the
2297                                          * cwnd/rto to start as if its a new
2298                                          * address?
2299                                          */
2300                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2301                                         net->RTO = 0;
2302
2303                                 }
2304                         }
2305                 } else if (type == SCTP_SET_PRIM_ADDR) {
2306                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2307                                 /* must validate the ifa is in the ep */
2308                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2309                                         continue;
2310                                 }
2311                         } else {
2312                                 /* Need to check scopes for this guy */
2313                                 if (sctp_is_address_in_scope(ifa,
2314                                     stcb->asoc.ipv4_addr_legal,
2315                                     stcb->asoc.ipv6_addr_legal,
2316                                     stcb->asoc.loopback_scope,
2317                                     stcb->asoc.ipv4_local_scope,
2318                                     stcb->asoc.local_scope,
2319                                     stcb->asoc.site_scope, 0) == 0) {
2320                                         continue;
2321                                 }
2322                         }
2323                 }
2324                 /* queue an asconf for this address add/delete */
2325                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2326                     stcb->asoc.peer_supports_asconf) {
2327                         /* queue an asconf for this addr */
2328                         status = sctp_asconf_queue_add(stcb, ifa, type);
2329                         /*
2330                          * if queued ok, and in the open state, update the
2331                          * count of queued params.  If in the non-open
2332                          * state, these get sent when the assoc goes open.
2333                          */
2334                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2335                                 if (status >= 0) {
2336                                         num_queued++;
2337                                 }
2338                         }
2339                 }
2340         }
2341         /*
2342          * If we have queued params in the open state, send out an ASCONF.
2343          */
2344         if (num_queued > 0) {
2345                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2346         }
2347 }
2348
2349 void
2350 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2351 {
2352         struct sctp_asconf_iterator *asc;
2353         struct sctp_ifa *ifa;
2354         struct sctp_laddr *l, *nl;
2355
2356         asc = (struct sctp_asconf_iterator *)ptr;
2357         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2358                 ifa = l->ifa;
2359                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2360                         /* Clear the defer use flag */
2361                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2362                 }
2363                 sctp_free_ifa(ifa);
2364                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2365                 SCTP_DECR_LADDR_COUNT();
2366         }
2367         SCTP_FREE(asc, SCTP_M_ASC_IT);
2368 }
2369
2370 /*
2371  * sa is the sockaddr to ask the peer to set primary to.
2372  * returns: 0 = completed, -1 = error
2373  */
2374 int32_t
2375 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2376 {
2377         uint32_t vrf_id;
2378         struct sctp_ifa *ifa;
2379
2380         /* find the ifa for the desired set primary */
2381         vrf_id = stcb->asoc.vrf_id;
2382         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2383         if (ifa == NULL) {
2384                 /* Invalid address */
2385                 return (-1);
2386         }
2387         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2388         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2389                 /* set primary queuing succeeded */
2390                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2391                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2392                     stcb);
2393                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2394                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2395 #ifdef SCTP_TIMER_BASED_ASCONF
2396                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2397                             stcb->sctp_ep, stcb,
2398                             stcb->asoc.primary_destination);
2399 #else
2400                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2401 #endif
2402                 }
2403         } else {
2404                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2405                     stcb);
2406                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2407                 return (-1);
2408         }
2409         return (0);
2410 }
2411
2412 void
2413 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2414 {
2415         struct sctp_inpcb *inp;
2416
2417         /* go through all our PCB's */
2418         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2419                 struct sctp_tcb *stcb;
2420
2421                 /* process for all associations for this endpoint */
2422                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2423                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2424                         if (!sctp_asconf_queue_add(stcb, ifa,
2425                             SCTP_SET_PRIM_ADDR)) {
2426                                 /* set primary queuing succeeded */
2427                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2428                                     stcb);
2429                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2430                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2431 #ifdef SCTP_TIMER_BASED_ASCONF
2432                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2433                                             stcb->sctp_ep, stcb,
2434                                             stcb->asoc.primary_destination);
2435 #else
2436                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2437 #endif
2438                                 }
2439                         }
2440                 }               /* for each stcb */
2441         }                       /* for each inp */
2442 }
2443
2444 int
2445 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2446 {
2447         struct sctp_tmit_chunk *chk, *nchk;
2448         unsigned int offset, asconf_limit;
2449         struct sctp_asconf_chunk *acp;
2450         struct sctp_asconf_paramhdr *aph;
2451         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2452         struct sctp_paramhdr *ph;
2453         int add_cnt, del_cnt;
2454         uint16_t last_param_type;
2455
2456         add_cnt = del_cnt = 0;
2457         last_param_type = 0;
2458         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2459                 if (chk->data == NULL) {
2460                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2461                         continue;
2462                 }
2463                 offset = 0;
2464                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2465                 offset += sizeof(struct sctp_asconf_chunk);
2466                 asconf_limit = ntohs(acp->ch.chunk_length);
2467                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2468                 if (ph == NULL) {
2469                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2470                         continue;
2471                 }
2472                 offset += ntohs(ph->param_length);
2473
2474                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2475                 if (aph == NULL) {
2476                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2477                         continue;
2478                 }
2479                 while (aph != NULL) {
2480                         unsigned int param_length, param_type;
2481
2482                         param_type = ntohs(aph->ph.param_type);
2483                         param_length = ntohs(aph->ph.param_length);
2484                         if (offset + param_length > asconf_limit) {
2485                                 /* parameter goes beyond end of chunk! */
2486                                 break;
2487                         }
2488                         if (param_length > sizeof(aparam_buf)) {
2489                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2490                                 break;
2491                         }
2492                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2493                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2494                                 break;
2495                         }
2496                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2497                         if (aph == NULL) {
2498                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2499                                 break;
2500                         }
2501                         ph = (struct sctp_paramhdr *)(aph + 1);
2502                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2503                                 switch (param_type) {
2504                                 case SCTP_ADD_IP_ADDRESS:
2505                                         add_cnt++;
2506                                         break;
2507                                 case SCTP_DEL_IP_ADDRESS:
2508                                         del_cnt++;
2509                                         break;
2510                                 default:
2511                                         break;
2512                                 }
2513                                 last_param_type = param_type;
2514                         }
2515                         offset += SCTP_SIZE32(param_length);
2516                         if (offset >= asconf_limit) {
2517                                 /* no more data in the mbuf chain */
2518                                 break;
2519                         }
2520                         /* get pointer to next asconf param */
2521                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2522                 }
2523         }
2524
2525         /*
2526          * we want to find the sequences which consist of ADD -> DEL -> ADD
2527          * or DEL -> ADD
2528          */
2529         if (add_cnt > del_cnt ||
2530             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2531                 return (1);
2532         }
2533         return (0);
2534 }
2535
2536 static struct sockaddr *
2537 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2538 {
2539         struct sctp_vrf *vrf = NULL;
2540         struct sctp_ifn *sctp_ifn;
2541         struct sctp_ifa *sctp_ifa;
2542
2543         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2544                 SCTP_IPI_ADDR_RLOCK();
2545         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2546         if (vrf == NULL) {
2547                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2548                         SCTP_IPI_ADDR_RUNLOCK();
2549                 return (NULL);
2550         }
2551         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2552                 if (stcb->asoc.loopback_scope == 0 &&
2553                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2554                         /* Skip if loopback_scope not set */
2555                         continue;
2556                 }
2557                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2558                         switch (sctp_ifa->address.sa.sa_family) {
2559 #ifdef INET
2560                         case AF_INET:
2561                                 if (stcb->asoc.ipv4_addr_legal) {
2562                                         struct sockaddr_in *sin;
2563
2564                                         sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2565                                         if (sin->sin_addr.s_addr == 0) {
2566                                                 /* skip unspecifed addresses */
2567                                                 continue;
2568                                         }
2569                                         if (stcb->asoc.ipv4_local_scope == 0 &&
2570                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2571                                                 continue;
2572
2573                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2574                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2575                                                 continue;
2576                                         /*
2577                                          * found a valid local v4 address to
2578                                          * use
2579                                          */
2580                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2581                                                 SCTP_IPI_ADDR_RUNLOCK();
2582                                         return (&sctp_ifa->address.sa);
2583                                 }
2584                                 break;
2585 #endif
2586 #ifdef INET6
2587                         case AF_INET6:
2588                                 if (stcb->asoc.ipv6_addr_legal) {
2589                                         struct sockaddr_in6 *sin6;
2590
2591                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2592                                                 continue;
2593                                         }
2594                                         sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2595                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2596                                                 /*
2597                                                  * we skip unspecifed
2598                                                  * addresses
2599                                                  */
2600                                                 continue;
2601                                         }
2602                                         if (stcb->asoc.local_scope == 0 &&
2603                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2604                                                 continue;
2605                                         if (stcb->asoc.site_scope == 0 &&
2606                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2607                                                 continue;
2608
2609                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2610                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2611                                                 continue;
2612                                         /*
2613                                          * found a valid local v6 address to
2614                                          * use
2615                                          */
2616                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2617                                                 SCTP_IPI_ADDR_RUNLOCK();
2618                                         return (&sctp_ifa->address.sa);
2619                                 }
2620                                 break;
2621 #endif
2622                         default:
2623                                 break;
2624                         }
2625                 }
2626         }
2627         /* no valid addresses found */
2628         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2629                 SCTP_IPI_ADDR_RUNLOCK();
2630         return (NULL);
2631 }
2632
2633 static struct sockaddr *
2634 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2635 {
2636         struct sctp_laddr *laddr;
2637
2638         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2639                 if (laddr->ifa == NULL) {
2640                         continue;
2641                 }
2642                 /* is the address restricted ? */
2643                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2644                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2645                         continue;
2646
2647                 /* found a valid local address to use */
2648                 return (&laddr->ifa->address.sa);
2649         }
2650         /* no valid addresses found */
2651         return (NULL);
2652 }
2653
2654 /*
2655  * builds an ASCONF chunk from queued ASCONF params.
2656  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2657  */
2658 struct mbuf *
2659 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2660 {
2661         struct mbuf *m_asconf, *m_asconf_chk;
2662         struct sctp_asconf_addr *aa;
2663         struct sctp_asconf_chunk *acp;
2664         struct sctp_asconf_paramhdr *aph;
2665         struct sctp_asconf_addr_param *aap;
2666         uint32_t p_length;
2667         uint32_t correlation_id = 1;    /* 0 is reserved... */
2668         caddr_t ptr, lookup_ptr;
2669         uint8_t lookup_used = 0;
2670
2671         /* are there any asconf params to send? */
2672         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2673                 if (aa->sent == 0)
2674                         break;
2675         }
2676         if (aa == NULL)
2677                 return (NULL);
2678
2679         /*
2680          * get a chunk header mbuf and a cluster for the asconf params since
2681          * it's simpler to fill in the asconf chunk header lookup address on
2682          * the fly
2683          */
2684         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2685         if (m_asconf_chk == NULL) {
2686                 /* no mbuf's */
2687                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2688                     "compose_asconf: couldn't get chunk mbuf!\n");
2689                 return (NULL);
2690         }
2691         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2692         if (m_asconf == NULL) {
2693                 /* no mbuf's */
2694                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2695                     "compose_asconf: couldn't get mbuf!\n");
2696                 sctp_m_freem(m_asconf_chk);
2697                 return (NULL);
2698         }
2699         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2700         SCTP_BUF_LEN(m_asconf) = 0;
2701         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2702         bzero(acp, sizeof(struct sctp_asconf_chunk));
2703         /* save pointers to lookup address and asconf params */
2704         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2705         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2706
2707         /* fill in chunk header info */
2708         acp->ch.chunk_type = SCTP_ASCONF;
2709         acp->ch.chunk_flags = 0;
2710         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2711         stcb->asoc.asconf_seq_out++;
2712
2713         /* add parameters... up to smallest MTU allowed */
2714         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2715                 if (aa->sent)
2716                         continue;
2717                 /* get the parameter length */
2718                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2719                 /* will it fit in current chunk? */
2720                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2721                         /* won't fit, so we're done with this chunk */
2722                         break;
2723                 }
2724                 /* assign (and store) a correlation id */
2725                 aa->ap.aph.correlation_id = correlation_id++;
2726
2727                 /*
2728                  * fill in address if we're doing a delete this is a simple
2729                  * way for us to fill in the correlation address, which
2730                  * should only be used by the peer if we're deleting our
2731                  * source address and adding a new address (e.g. renumbering
2732                  * case)
2733                  */
2734                 if (lookup_used == 0 &&
2735                     (aa->special_del == 0) &&
2736                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2737                         struct sctp_ipv6addr_param *lookup;
2738                         uint16_t p_size, addr_size;
2739
2740                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2741                         lookup->ph.param_type =
2742                             htons(aa->ap.addrp.ph.param_type);
2743                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2744                                 /* copy IPv6 address */
2745                                 p_size = sizeof(struct sctp_ipv6addr_param);
2746                                 addr_size = sizeof(struct in6_addr);
2747                         } else {
2748                                 /* copy IPv4 address */
2749                                 p_size = sizeof(struct sctp_ipv4addr_param);
2750                                 addr_size = sizeof(struct in_addr);
2751                         }
2752                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2753                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2754                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2755                         lookup_used = 1;
2756                 }
2757                 /* copy into current space */
2758                 memcpy(ptr, &aa->ap, p_length);
2759
2760                 /* network elements and update lengths */
2761                 aph = (struct sctp_asconf_paramhdr *)ptr;
2762                 aap = (struct sctp_asconf_addr_param *)ptr;
2763                 /* correlation_id is transparent to peer, no htonl needed */
2764                 aph->ph.param_type = htons(aph->ph.param_type);
2765                 aph->ph.param_length = htons(aph->ph.param_length);
2766                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2767                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2768
2769                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2770                 ptr += SCTP_SIZE32(p_length);
2771
2772                 /*
2773                  * these params are removed off the pending list upon
2774                  * getting an ASCONF-ACK back from the peer, just set flag
2775                  */
2776                 aa->sent = 1;
2777         }
2778         /* check to see if the lookup addr has been populated yet */
2779         if (lookup_used == 0) {
2780                 /* NOTE: if the address param is optional, can skip this... */
2781                 /* add any valid (existing) address... */
2782                 struct sctp_ipv6addr_param *lookup;
2783                 uint16_t p_size, addr_size;
2784                 struct sockaddr *found_addr;
2785                 caddr_t addr_ptr;
2786
2787                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2788                         found_addr = sctp_find_valid_localaddr(stcb,
2789                             addr_locked);
2790                 else
2791                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2792
2793                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2794                 if (found_addr != NULL) {
2795                         switch (found_addr->sa_family) {
2796 #ifdef INET6
2797                         case AF_INET6:
2798                                 /* copy IPv6 address */
2799                                 lookup->ph.param_type =
2800                                     htons(SCTP_IPV6_ADDRESS);
2801                                 p_size = sizeof(struct sctp_ipv6addr_param);
2802                                 addr_size = sizeof(struct in6_addr);
2803                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2804                                     found_addr)->sin6_addr;
2805                                 break;
2806 #endif
2807 #ifdef INET
2808                         case AF_INET:
2809                                 /* copy IPv4 address */
2810                                 lookup->ph.param_type =
2811                                     htons(SCTP_IPV4_ADDRESS);
2812                                 p_size = sizeof(struct sctp_ipv4addr_param);
2813                                 addr_size = sizeof(struct in_addr);
2814                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2815                                     found_addr)->sin_addr;
2816                                 break;
2817 #endif
2818                         default:
2819                                 p_size = 0;
2820                                 addr_size = 0;
2821                                 addr_ptr = NULL;
2822                                 break;
2823                         }
2824                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2825                         memcpy(lookup->addr, addr_ptr, addr_size);
2826                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2827                 } else {
2828                         /* uh oh... don't have any address?? */
2829                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2830                             "compose_asconf: no lookup addr!\n");
2831                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2832                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2833                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2834                         bzero(lookup->addr, sizeof(struct in_addr));
2835                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2836                 }
2837         }
2838         /* chain it all together */
2839         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2840         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2841         acp->ch.chunk_length = ntohs(*retlen);
2842
2843         return (m_asconf_chk);
2844 }
2845
2846 /*
2847  * section to handle address changes before an association is up eg. changes
2848  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2849  */
2850
2851 /*
2852  * processes the (local) addresses in the INIT-ACK chunk
2853  */
2854 static void
2855 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2856     unsigned int offset, unsigned int length)
2857 {
2858         struct sctp_paramhdr tmp_param, *ph;
2859         uint16_t plen, ptype;
2860         struct sctp_ifa *sctp_ifa;
2861         struct sctp_ipv6addr_param addr_store;
2862
2863 #ifdef INET6
2864         struct sockaddr_in6 sin6;
2865
2866 #endif
2867 #ifdef INET
2868         struct sockaddr_in sin;
2869
2870 #endif
2871         struct sockaddr *sa;
2872         uint32_t vrf_id;
2873
2874         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2875         if (stcb == NULL)       /* Un-needed check for SA */
2876                 return;
2877
2878         /* convert to upper bound */
2879         length += offset;
2880
2881         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2882                 return;
2883         }
2884         /* init the addresses */
2885 #ifdef INET6
2886         bzero(&sin6, sizeof(sin6));
2887         sin6.sin6_family = AF_INET6;
2888         sin6.sin6_len = sizeof(sin6);
2889         sin6.sin6_port = stcb->rport;
2890 #endif
2891
2892 #ifdef INET
2893         bzero(&sin, sizeof(sin));
2894         sin.sin_family = AF_INET;
2895         sin.sin_len = sizeof(sin);
2896         sin.sin_port = stcb->rport;
2897 #endif
2898
2899         /* go through the addresses in the init-ack */
2900         ph = (struct sctp_paramhdr *)
2901             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2902             (uint8_t *) & tmp_param);
2903         while (ph != NULL) {
2904                 ptype = ntohs(ph->param_type);
2905                 plen = ntohs(ph->param_length);
2906                 switch (ptype) {
2907 #ifdef INET6
2908                 case SCTP_IPV6_ADDRESS:
2909                         {
2910                                 struct sctp_ipv6addr_param *a6p;
2911
2912                                 /* get the entire IPv6 address param */
2913                                 a6p = (struct sctp_ipv6addr_param *)
2914                                     sctp_m_getptr(m, offset,
2915                                     sizeof(struct sctp_ipv6addr_param),
2916                                     (uint8_t *) & addr_store);
2917                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2918                                     a6p == NULL) {
2919                                         return;
2920                                 }
2921                                 memcpy(&sin6.sin6_addr, a6p->addr,
2922                                     sizeof(struct in6_addr));
2923                                 sa = (struct sockaddr *)&sin6;
2924                                 break;
2925                         }
2926 #endif
2927 #ifdef INET
2928                 case SCTP_IPV4_ADDRESS:
2929                         {
2930                                 struct sctp_ipv4addr_param *a4p;
2931
2932                                 /* get the entire IPv4 address param */
2933                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2934                                     sizeof(struct sctp_ipv4addr_param),
2935                                     (uint8_t *) & addr_store);
2936                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2937                                     a4p == NULL) {
2938                                         return;
2939                                 }
2940                                 sin.sin_addr.s_addr = a4p->addr;
2941                                 sa = (struct sockaddr *)&sin;
2942                                 break;
2943                         }
2944 #endif
2945                 default:
2946                         goto next_addr;
2947                 }
2948
2949                 /* see if this address really (still) exists */
2950                 if (stcb) {
2951                         vrf_id = stcb->asoc.vrf_id;
2952                 } else {
2953                         vrf_id = SCTP_DEFAULT_VRFID;
2954                 }
2955                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2956                     SCTP_ADDR_NOT_LOCKED);
2957                 if (sctp_ifa == NULL) {
2958                         /* address doesn't exist anymore */
2959                         int status;
2960
2961                         /* are ASCONFs allowed ? */
2962                         if ((sctp_is_feature_on(stcb->sctp_ep,
2963                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2964                             stcb->asoc.peer_supports_asconf) {
2965                                 /* queue an ASCONF DEL_IP_ADDRESS */
2966                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2967                                 /*
2968                                  * if queued ok, and in correct state, send
2969                                  * out the ASCONF.
2970                                  */
2971                                 if (status == 0 &&
2972                                     SCTP_GET_STATE(&stcb->asoc) ==
2973                                     SCTP_STATE_OPEN) {
2974 #ifdef SCTP_TIMER_BASED_ASCONF
2975                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2976                                             stcb->sctp_ep, stcb,
2977                                             stcb->asoc.primary_destination);
2978 #else
2979                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2980 #endif
2981                                 }
2982                         }
2983                 }
2984 next_addr:
2985                 /*
2986                  * Sanity check:  Make sure the length isn't 0, otherwise
2987                  * we'll be stuck in this loop for a long time...
2988                  */
2989                 if (SCTP_SIZE32(plen) == 0) {
2990                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2991                             plen, ptype);
2992                         return;
2993                 }
2994                 /* get next parameter */
2995                 offset += SCTP_SIZE32(plen);
2996                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2997                         return;
2998                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2999                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
3000         }                       /* while */
3001 }
3002
3003 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
3004 /*
3005  * checks to see if a specific address is in the initack address list returns
3006  * 1 if found, 0 if not
3007  */
3008 static uint32_t
3009 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
3010 {
3011         struct sctp_paramhdr tmp_param, *ph;
3012         uint16_t plen, ptype;
3013         struct sctp_ipv6addr_param addr_store;
3014
3015 #ifdef INET
3016         struct sockaddr_in *sin;
3017         struct sctp_ipv4addr_param *a4p;
3018
3019 #endif
3020 #ifdef INET6
3021         struct sockaddr_in6 *sin6;
3022         struct sctp_ipv6addr_param *a6p;
3023         struct sockaddr_in6 sin6_tmp;
3024
3025 #endif
3026
3027         switch (sa->sa_family) {
3028 #ifdef INET
3029         case AF_INET:
3030                 break;
3031 #endif
3032 #ifdef INET6
3033         case AF_INET6:
3034                 break;
3035 #endif
3036         default:
3037                 return (0);
3038         }
3039
3040         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
3041         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
3042         /* convert to upper bound */
3043         length += offset;
3044
3045         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
3046                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3047                     "find_initack_addr: invalid offset?\n");
3048                 return (0);
3049         }
3050         /* go through the addresses in the init-ack */
3051         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
3052             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
3053         while (ph != NULL) {
3054                 ptype = ntohs(ph->param_type);
3055                 plen = ntohs(ph->param_length);
3056                 switch (ptype) {
3057 #ifdef INET6
3058                 case SCTP_IPV6_ADDRESS:
3059                         if (sa->sa_family == AF_INET6) {
3060                                 /* get the entire IPv6 address param */
3061                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
3062                                         break;
3063                                 }
3064                                 /* get the entire IPv6 address param */
3065                                 a6p = (struct sctp_ipv6addr_param *)
3066                                     sctp_m_getptr(m, offset,
3067                                     sizeof(struct sctp_ipv6addr_param),
3068                                     (uint8_t *) & addr_store);
3069                                 if (a6p == NULL) {
3070                                         return (0);
3071                                 }
3072                                 sin6 = (struct sockaddr_in6 *)sa;
3073                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
3074                                         /* create a copy and clear scope */
3075                                         memcpy(&sin6_tmp, sin6,
3076                                             sizeof(struct sockaddr_in6));
3077                                         sin6 = &sin6_tmp;
3078                                         in6_clearscope(&sin6->sin6_addr);
3079                                 }
3080                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
3081                                     sizeof(struct in6_addr)) == 0) {
3082                                         /* found it */
3083                                         return (1);
3084                                 }
3085                         }
3086                         break;
3087 #endif                          /* INET6 */
3088 #ifdef INET
3089                 case SCTP_IPV4_ADDRESS:
3090                         if (sa->sa_family == AF_INET) {
3091                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
3092                                         break;
3093                                 }
3094                                 /* get the entire IPv4 address param */
3095                                 a4p = (struct sctp_ipv4addr_param *)
3096                                     sctp_m_getptr(m, offset,
3097                                     sizeof(struct sctp_ipv4addr_param),
3098                                     (uint8_t *) & addr_store);
3099                                 if (a4p == NULL) {
3100                                         return (0);
3101                                 }
3102                                 sin = (struct sockaddr_in *)sa;
3103                                 if (sin->sin_addr.s_addr == a4p->addr) {
3104                                         /* found it */
3105                                         return (1);
3106                                 }
3107                         }
3108                         break;
3109 #endif
3110                 default:
3111                         break;
3112                 }
3113                 /* get next parameter */
3114                 offset += SCTP_SIZE32(plen);
3115                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3116                         return (0);
3117                 }
3118                 ph = (struct sctp_paramhdr *)
3119                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3120                     (uint8_t *) & tmp_param);
3121         }                       /* while */
3122         /* not found! */
3123         return (0);
3124 }
3125
3126 /*
3127  * makes sure that the current endpoint local addr list is consistent with
3128  * the new association (eg. subset bound, asconf allowed) adds addresses as
3129  * necessary
3130  */
3131 static void
3132 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3133     int length, struct sockaddr *init_addr)
3134 {
3135         struct sctp_laddr *laddr;
3136
3137         /* go through the endpoint list */
3138         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3139                 /* be paranoid and validate the laddr */
3140                 if (laddr->ifa == NULL) {
3141                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3142                             "check_addr_list_ep: laddr->ifa is NULL");
3143                         continue;
3144                 }
3145                 if (laddr->ifa == NULL) {
3146                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3147                         continue;
3148                 }
3149                 /* do i have it implicitly? */
3150                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3151                         continue;
3152                 }
3153                 /* check to see if in the init-ack */
3154                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3155                         /* try to add it */
3156                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3157                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3158                 }
3159         }
3160 }
3161
3162 /*
3163  * makes sure that the current kernel address list is consistent with the new
3164  * association (with all addrs bound) adds addresses as necessary
3165  */
3166 static void
3167 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3168     int length, struct sockaddr *init_addr,
3169     uint16_t local_scope, uint16_t site_scope,
3170     uint16_t ipv4_scope, uint16_t loopback_scope)
3171 {
3172         struct sctp_vrf *vrf = NULL;
3173         struct sctp_ifn *sctp_ifn;
3174         struct sctp_ifa *sctp_ifa;
3175         uint32_t vrf_id;
3176
3177 #ifdef INET
3178         struct sockaddr_in *sin;
3179
3180 #endif
3181 #ifdef INET6
3182         struct sockaddr_in6 *sin6;
3183
3184 #endif
3185
3186         if (stcb) {
3187                 vrf_id = stcb->asoc.vrf_id;
3188         } else {
3189                 return;
3190         }
3191         SCTP_IPI_ADDR_RLOCK();
3192         vrf = sctp_find_vrf(vrf_id);
3193         if (vrf == NULL) {
3194                 SCTP_IPI_ADDR_RUNLOCK();
3195                 return;
3196         }
3197         /* go through all our known interfaces */
3198         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3199                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3200                         /* skip loopback interface */
3201                         continue;
3202                 }
3203                 /* go through each interface address */
3204                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3205                         /* do i have it implicitly? */
3206                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3207                                 continue;
3208                         }
3209                         switch (sctp_ifa->address.sa.sa_family) {
3210 #ifdef INET
3211                         case AF_INET:
3212                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sin;
3213                                 if ((ipv4_scope == 0) &&
3214                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3215                                         /* private address not in scope */
3216                                         continue;
3217                                 }
3218                                 break;
3219 #endif
3220 #ifdef INET6
3221                         case AF_INET6:
3222                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sin6;
3223                                 if ((local_scope == 0) &&
3224                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3225                                         continue;
3226                                 }
3227                                 if ((site_scope == 0) &&
3228                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3229                                         continue;
3230                                 }
3231                                 break;
3232 #endif
3233                         default:
3234                                 break;
3235                         }
3236                         /* check to see if in the init-ack */
3237                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3238                                 /* try to add it */
3239                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3240                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3241                                     SCTP_ADDR_LOCKED);
3242                         }
3243                 }               /* end foreach ifa */
3244         }                       /* end foreach ifn */
3245         SCTP_IPI_ADDR_RUNLOCK();
3246 }
3247
3248 /*
3249  * validates an init-ack chunk (from a cookie-echo) with current addresses
3250  * adds addresses from the init-ack into our local address list, if needed
3251  * queues asconf adds/deletes addresses as needed and makes appropriate list
3252  * changes for source address selection m, offset: points to the start of the
3253  * address list in an init-ack chunk length: total length of the address
3254  * params only init_addr: address where my INIT-ACK was sent from
3255  */
3256 void
3257 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3258     int length, struct sockaddr *init_addr,
3259     uint16_t local_scope, uint16_t site_scope,
3260     uint16_t ipv4_scope, uint16_t loopback_scope)
3261 {
3262         /* process the local addresses in the initack */
3263         sctp_process_initack_addresses(stcb, m, offset, length);
3264
3265         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3266                 /* bound all case */
3267                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3268                     local_scope, site_scope, ipv4_scope, loopback_scope);
3269         } else {
3270                 /* subset bound case */
3271                 if (sctp_is_feature_on(stcb->sctp_ep,
3272                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3273                         /* asconf's allowed */
3274                         sctp_check_address_list_ep(stcb, m, offset, length,
3275                             init_addr);
3276                 }
3277                 /* else, no asconfs allowed, so what we sent is what we get */
3278         }
3279 }
3280
3281 /*
3282  * sctp_bindx() support
3283  */
3284 uint32_t
3285 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3286     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3287 {
3288         struct sctp_ifa *ifa;
3289         struct sctp_laddr *laddr, *nladdr;
3290
3291         if (sa->sa_len == 0) {
3292                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3293                 return (EINVAL);
3294         }
3295         if (sctp_ifap) {
3296                 ifa = sctp_ifap;
3297         } else if (type == SCTP_ADD_IP_ADDRESS) {
3298                 /* For an add the address MUST be on the system */
3299                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3300         } else if (type == SCTP_DEL_IP_ADDRESS) {
3301                 /* For a delete we need to find it in the inp */
3302                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3303         } else {
3304                 ifa = NULL;
3305         }
3306         if (ifa != NULL) {
3307                 if (type == SCTP_ADD_IP_ADDRESS) {
3308                         sctp_add_local_addr_ep(inp, ifa, type);
3309                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3310                         if (inp->laddr_count < 2) {
3311                                 /* can't delete the last local address */
3312                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3313                                 return (EINVAL);
3314                         }
3315                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3316                             sctp_nxt_addr) {
3317                                 if (ifa == laddr->ifa) {
3318                                         /* Mark in the delete */
3319                                         laddr->action = type;
3320                                 }
3321                         }
3322                 }
3323                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3324                         /*
3325                          * There is no need to start the iterator if the inp
3326                          * has no associations.
3327                          */
3328                         if (type == SCTP_DEL_IP_ADDRESS) {
3329                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3330                                         if (laddr->ifa == ifa) {
3331                                                 sctp_del_local_addr_ep(inp, ifa);
3332                                         }
3333                                 }
3334                         }
3335                 } else {
3336                         struct sctp_asconf_iterator *asc;
3337                         struct sctp_laddr *wi;
3338
3339                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3340                             sizeof(struct sctp_asconf_iterator),
3341                             SCTP_M_ASC_IT);
3342                         if (asc == NULL) {
3343                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3344                                 return (ENOMEM);
3345                         }
3346                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3347                         if (wi == NULL) {
3348                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3349                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3350                                 return (ENOMEM);
3351                         }
3352                         LIST_INIT(&asc->list_of_work);
3353                         asc->cnt = 1;
3354                         SCTP_INCR_LADDR_COUNT();
3355                         wi->ifa = ifa;
3356                         wi->action = type;
3357                         atomic_add_int(&ifa->refcount, 1);
3358                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3359                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3360                             sctp_asconf_iterator_stcb,
3361                             sctp_asconf_iterator_ep_end,
3362                             SCTP_PCB_ANY_FLAGS,
3363                             SCTP_PCB_ANY_FEATURES,
3364                             SCTP_ASOC_ANY_STATE,
3365                             (void *)asc, 0,
3366                             sctp_asconf_iterator_end, inp, 0);
3367                 }
3368                 return (0);
3369         } else {
3370                 /* invalid address! */
3371                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3372                 return (EADDRNOTAVAIL);
3373         }
3374 }
3375
3376 void
3377 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3378     struct sctp_nets *net)
3379 {
3380         struct sctp_asconf_addr *aa;
3381         struct sctp_ifa *sctp_ifap;
3382         struct sctp_asconf_tag_param *vtag;
3383
3384 #ifdef INET
3385         struct sockaddr_in *to;
3386
3387 #endif
3388 #ifdef INET6
3389         struct sockaddr_in6 *to6;
3390
3391 #endif
3392         if (net == NULL) {
3393                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3394                 return;
3395         }
3396         if (stcb == NULL) {
3397                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3398                 return;
3399         }
3400         /*
3401          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3402          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3403          */
3404         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3405             SCTP_M_ASC_ADDR);
3406         if (aa == NULL) {
3407                 /* didn't get memory */
3408                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3409                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3410                 return;
3411         }
3412         aa->special_del = 0;
3413         /* fill in asconf address parameter fields */
3414         /* top level elements are "networked" during send */
3415         aa->ifa = NULL;
3416         aa->sent = 0;           /* clear sent flag */
3417         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3418         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3419         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3420         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3421         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3422         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3423
3424         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3425             SCTP_M_ASC_ADDR);
3426         if (aa == NULL) {
3427                 /* didn't get memory */
3428                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3429                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3430                 return;
3431         }
3432         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3433         /* fill in asconf address parameter fields */
3434         /* ADD(0.0.0.0) */
3435         switch (net->ro._l_addr.sa.sa_family) {
3436 #ifdef INET
3437         case AF_INET:
3438                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3439                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3440                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3441                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3442                 /* No need to add an address, we are using 0.0.0.0 */
3443                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3444                 break;
3445 #endif
3446 #ifdef INET6
3447         case AF_INET6:
3448                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3449                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3450                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3451                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3452                 /* No need to add an address, we are using 0.0.0.0 */
3453                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3454                 break;
3455 #endif
3456         }
3457         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3458             SCTP_M_ASC_ADDR);
3459         if (aa == NULL) {
3460                 /* didn't get memory */
3461                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3462                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3463                 return;
3464         }
3465         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3466         /* fill in asconf address parameter fields */
3467         /* ADD(0.0.0.0) */
3468         switch (net->ro._l_addr.sa.sa_family) {
3469 #ifdef INET
3470         case AF_INET:
3471                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3472                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3473                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3474                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3475                 /* No need to add an address, we are using 0.0.0.0 */
3476                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3477                 break;
3478 #endif
3479 #ifdef INET6
3480         case AF_INET6:
3481                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3482                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3483                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3484                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3485                 /* No need to add an address, we are using 0.0.0.0 */
3486                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3487                 break;
3488 #endif
3489         }
3490         /* Now we must hunt the addresses and add all global addresses */
3491         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3492                 struct sctp_vrf *vrf = NULL;
3493                 struct sctp_ifn *sctp_ifnp;
3494                 uint32_t vrf_id;
3495
3496                 vrf_id = stcb->sctp_ep->def_vrf_id;
3497                 vrf = sctp_find_vrf(vrf_id);
3498                 if (vrf == NULL) {
3499                         goto skip_rest;
3500                 }
3501                 SCTP_IPI_ADDR_RLOCK();
3502                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3503                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3504                                 switch (sctp_ifap->address.sa.sa_family) {
3505 #ifdef INET
3506                                 case AF_INET:
3507                                         to = &sctp_ifap->address.sin;
3508                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3509                                                 continue;
3510                                         }
3511                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3512                                                 continue;
3513                                         }
3514                                         break;
3515 #endif
3516 #ifdef INET6
3517                                 case AF_INET6:
3518                                         to6 = &sctp_ifap->address.sin6;
3519                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3520                                                 continue;
3521                                         }
3522                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3523                                                 continue;
3524                                         }
3525                                         break;
3526 #endif
3527                                 default:
3528                                         continue;
3529                                 }
3530                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3531                         }
3532                 }
3533                 SCTP_IPI_ADDR_RUNLOCK();
3534         } else {
3535                 struct sctp_laddr *laddr;
3536
3537                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3538                         if (laddr->ifa == NULL) {
3539                                 continue;
3540                         }
3541                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3542                                 /*
3543                                  * Address being deleted by the system, dont
3544                                  * list.
3545                                  */
3546                                 continue;
3547                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3548                                 /*
3549                                  * Address being deleted on this ep don't
3550                                  * list.
3551                                  */
3552                                 continue;
3553                         }
3554                         sctp_ifap = laddr->ifa;
3555                         switch (sctp_ifap->address.sa.sa_family) {
3556 #ifdef INET
3557                         case AF_INET:
3558                                 to = &sctp_ifap->address.sin;
3559                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3560                                         continue;
3561                                 }
3562                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3563                                         continue;
3564                                 }
3565                                 break;
3566 #endif
3567 #ifdef INET6
3568                         case AF_INET6:
3569                                 to6 = &sctp_ifap->address.sin6;
3570                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3571                                         continue;
3572                                 }
3573                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3574                                         continue;
3575                                 }
3576                                 break;
3577 #endif
3578                         default:
3579                                 continue;
3580                         }
3581                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3582                 }
3583         }
3584 skip_rest:
3585         /* Now we must send the asconf into the queue */
3586         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3587 }