sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_NOWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_NOWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         union sctp_sockstore store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, aparam_length;
 154
 155 #if defined(INET) || defined(INET6)
 156         uint16_t param_length;
 157
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162
 163 #ifdef INET
 164         struct sockaddr_in *sin;
 165         struct sctp_ipv4addr_param *v4addr;
 166
 167 #endif
 168 #ifdef INET6
 169         struct sockaddr_in6 *sin6;
 170         struct sctp_ipv6addr_param *v6addr;
 171
 172 #endif
 173
 174         aparam_length = ntohs(aph->ph.param_length);
 175         ph = (struct sctp_paramhdr *)(aph + 1);
 176         param_type = ntohs(ph->param_type);
 177 #if defined(INET) || defined(INET6)
 178         param_length = ntohs(ph->param_length);
 179 #endif
 180         sa = &store.sa;
 181         switch (param_type) {
 182 #ifdef INET
 183         case SCTP_IPV4_ADDRESS:
 184                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 185                         /* invalid param size */
 186                         return (NULL);
 187                 }
 188                 v4addr = (struct sctp_ipv4addr_param *)ph;
 189                 sin = &store.sin;
 190                 bzero(sin, sizeof(*sin));
 191                 sin->sin_family = AF_INET;
 192                 sin->sin_len = sizeof(struct sockaddr_in);
 193                 sin->sin_port = stcb->rport;
 194                 sin->sin_addr.s_addr = v4addr->addr;
 195                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 196                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 197                         bad_address = 1;
 198                 }
 199                 if (sin->sin_addr.s_addr == INADDR_ANY)
 200                         zero_address = 1;
 201                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 202                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 203                 break;
 204 #endif
 205 #ifdef INET6
 206         case SCTP_IPV6_ADDRESS:
 207                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 208                         /* invalid param size */
 209                         return (NULL);
 210                 }
 211                 v6addr = (struct sctp_ipv6addr_param *)ph;
 212                 sin6 = &store.sin6;
 213                 bzero(sin6, sizeof(*sin6));
 214                 sin6->sin6_family = AF_INET6;
 215                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 216                 sin6->sin6_port = stcb->rport;
 217                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 218                     sizeof(struct in6_addr));
 219                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 220                         bad_address = 1;
 221                 }
 222                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 223                         zero_address = 1;
 224                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 225                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 226                 break;
 227 #endif
 228         default:
 229                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 230                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 231                     aparam_length);
 232                 return (m_reply);
 233         }                       /* end switch */
 234
 235         /* if 0.0.0.0/::0, add the source address instead */
 236         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 237                 sa = src;
 238                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 239                     "process_asconf_add_ip: using source addr ");
 240                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 241         }
 242         /* add the address */
 243         if (bad_address) {
 244                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 245                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 246                     aparam_length);
 247         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 248             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 249                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 250                     "process_asconf_add_ip: error adding address\n");
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 253                     aparam_length);
 254         } else {
 255                 /* notify upper layer */
 256                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 257                 if (response_required) {
 258                         m_reply =
 259                             sctp_asconf_success_response(aph->correlation_id);
 260                 }
 261                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 262                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 263                     stcb, net);
 264                 if (send_hb) {
 265                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 266                 }
 267         }
 268         return (m_reply);
 269 }
 270
 271 static int
 272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 273 {
 274         struct sctp_nets *src_net, *net;
 275
 276         /* make sure the source address exists as a destination net */
 277         src_net = sctp_findnet(stcb, src);
 278         if (src_net == NULL) {
 279                 /* not found */
 280                 return (-1);
 281         }
 282         /* delete all destination addresses except the source */
 283         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 284                 if (net != src_net) {
 285                         /* delete this address */
 286                         sctp_remove_net(stcb, net);
 287                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 288                             "asconf_del_remote_addrs_except: deleting ");
 289                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 290                             (struct sockaddr *)&net->ro._l_addr);
 291                         /* notify upper layer */
 292                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 293                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 294                 }
 295         }
 296         return (0);
 297 }
 298
 299 static struct mbuf *
 300 sctp_process_asconf_delete_ip(struct sockaddr *src,
 301     struct sctp_asconf_paramhdr *aph,
 302     struct sctp_tcb *stcb, int response_required)
 303 {
 304         struct mbuf *m_reply = NULL;
 305         union sctp_sockstore store;
 306         struct sctp_paramhdr *ph;
 307         uint16_t param_type, aparam_length;
 308
 309 #if defined(INET) || defined(INET6)
 310         uint16_t param_length;
 311
 312 #endif
 313         struct sockaddr *sa;
 314         int zero_address = 0;
 315         int result;
 316
 317 #ifdef INET
 318         struct sockaddr_in *sin;
 319         struct sctp_ipv4addr_param *v4addr;
 320
 321 #endif
 322 #ifdef INET6
 323         struct sockaddr_in6 *sin6;
 324         struct sctp_ipv6addr_param *v6addr;
 325
 326 #endif
 327
 328         aparam_length = ntohs(aph->ph.param_length);
 329         ph = (struct sctp_paramhdr *)(aph + 1);
 330         param_type = ntohs(ph->param_type);
 331 #if defined(INET) || defined(INET6)
 332         param_length = ntohs(ph->param_length);
 333 #endif
 334         sa = &store.sa;
 335         switch (param_type) {
 336 #ifdef INET
 337         case SCTP_IPV4_ADDRESS:
 338                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 339                         /* invalid param size */
 340                         return (NULL);
 341                 }
 342                 v4addr = (struct sctp_ipv4addr_param *)ph;
 343                 sin = &store.sin;
 344                 bzero(sin, sizeof(*sin));
 345                 sin->sin_family = AF_INET;
 346                 sin->sin_len = sizeof(struct sockaddr_in);
 347                 sin->sin_port = stcb->rport;
 348                 sin->sin_addr.s_addr = v4addr->addr;
 349                 if (sin->sin_addr.s_addr == INADDR_ANY)
 350                         zero_address = 1;
 351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 352                     "process_asconf_delete_ip: deleting ");
 353                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 354                 break;
 355 #endif
 356 #ifdef INET6
 357         case SCTP_IPV6_ADDRESS:
 358                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 359                         /* invalid param size */
 360                         return (NULL);
 361                 }
 362                 v6addr = (struct sctp_ipv6addr_param *)ph;
 363                 sin6 = &store.sin6;
 364                 bzero(sin6, sizeof(*sin6));
 365                 sin6->sin6_family = AF_INET6;
 366                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 367                 sin6->sin6_port = stcb->rport;
 368                 memcpy(&sin6->sin6_addr, v6addr->addr,
 369                     sizeof(struct in6_addr));
 370                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 371                         zero_address = 1;
 372                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 373                     "process_asconf_delete_ip: deleting ");
 374                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 375                 break;
 376 #endif
 377         default:
 378                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 379                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 380                     aparam_length);
 381                 return (m_reply);
 382         }
 383
 384         /* make sure the source address is not being deleted */
 385         if (sctp_cmpaddr(sa, src)) {
 386                 /* trying to delete the source address! */
 387                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 388                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 389                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 390                     aparam_length);
 391                 return (m_reply);
 392         }
 393         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 394         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 395                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 396
 397                 if (result) {
 398                         /* src address did not exist? */
 399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 400                         /* what error to reply with?? */
 401                         m_reply =
 402                             sctp_asconf_error_response(aph->correlation_id,
 403                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 404                             aparam_length);
 405                 } else if (response_required) {
 406                         m_reply =
 407                             sctp_asconf_success_response(aph->correlation_id);
 408                 }
 409                 return (m_reply);
 410         }
 411         /* delete the address */
 412         result = sctp_del_remote_addr(stcb, sa);
 413         /*
 414          * note if result == -2, the address doesn't exist in the asoc but
 415          * since it's being deleted anyways, we just ack the delete -- but
 416          * this probably means something has already gone awry
 417          */
 418         if (result == -1) {
 419                 /* only one address in the asoc */
 420                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 421                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 422                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 423                     aparam_length);
 424         } else {
 425                 if (response_required) {
 426                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 427                 }
 428                 /* notify upper layer */
 429                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 430         }
 431         return (m_reply);
 432 }
 433
 434 static struct mbuf *
 435 sctp_process_asconf_set_primary(struct sockaddr *src,
 436     struct sctp_asconf_paramhdr *aph,
 437     struct sctp_tcb *stcb, int response_required)
 438 {
 439         struct mbuf *m_reply = NULL;
 440         union sctp_sockstore store;
 441         struct sctp_paramhdr *ph;
 442         uint16_t param_type, aparam_length;
 443
 444 #if defined(INET) || defined(INET6)
 445         uint16_t param_length;
 446
 447 #endif
 448         struct sockaddr *sa;
 449         int zero_address = 0;
 450
 451 #ifdef INET
 452         struct sockaddr_in *sin;
 453         struct sctp_ipv4addr_param *v4addr;
 454
 455 #endif
 456 #ifdef INET6
 457         struct sockaddr_in6 *sin6;
 458         struct sctp_ipv6addr_param *v6addr;
 459
 460 #endif
 461
 462         aparam_length = ntohs(aph->ph.param_length);
 463         ph = (struct sctp_paramhdr *)(aph + 1);
 464         param_type = ntohs(ph->param_type);
 465 #if defined(INET) || defined(INET6)
 466         param_length = ntohs(ph->param_length);
 467 #endif
 468         sa = &store.sa;
 469         switch (param_type) {
 470 #ifdef INET
 471         case SCTP_IPV4_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v4addr = (struct sctp_ipv4addr_param *)ph;
 477                 sin = &store.sin;
 478                 bzero(sin, sizeof(*sin));
 479                 sin->sin_family = AF_INET;
 480                 sin->sin_len = sizeof(struct sockaddr_in);
 481                 sin->sin_addr.s_addr = v4addr->addr;
 482                 if (sin->sin_addr.s_addr == INADDR_ANY)
 483                         zero_address = 1;
 484                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 485                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 486                 break;
 487 #endif
 488 #ifdef INET6
 489         case SCTP_IPV6_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 491                         /* invalid param size */
 492                         return (NULL);
 493                 }
 494                 v6addr = (struct sctp_ipv6addr_param *)ph;
 495                 sin6 = &store.sin6;
 496                 bzero(sin6, sizeof(*sin6));
 497                 sin6->sin6_family = AF_INET6;
 498                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 499                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 500                     sizeof(struct in6_addr));
 501                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 502                         zero_address = 1;
 503                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 504                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 505                 break;
 506 #endif
 507         default:
 508                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 509                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 510                     aparam_length);
 511                 return (m_reply);
 512         }
 513
 514         /* if 0.0.0.0/::0, use the source address instead */
 515         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 516                 sa = src;
 517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 518                     "process_asconf_set_primary: using source addr ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 520         }
 521         /* set the primary address */
 522         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 523                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 524                     "process_asconf_set_primary: primary address set\n");
 525                 /* notify upper layer */
 526                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 527                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 528                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 529                     (stcb->asoc.alternate)) {
 530                         sctp_free_remote_addr(stcb->asoc.alternate);
 531                         stcb->asoc.alternate = NULL;
 532                 }
 533                 if (response_required) {
 534                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 535                 }
 536                 /*
 537                  * Mobility adaptation. Ideally, when the reception of SET
 538                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 539                  * destination, unacknowledged DATA are retransmitted
 540                  * immediately to the new primary destination for seamless
 541                  * handover. If the destination is UNCONFIRMED and marked to
 542                  * REQ_PRIM, The retransmission occur when reception of the
 543                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 544                  * sctp_input.c) Also, when change of the primary
 545                  * destination, it is better that all subsequent new DATA
 546                  * containing already queued DATA are transmitted to the new
 547                  * primary destination. (by micchie)
 548                  */
 549                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 550                     SCTP_MOBILITY_BASE) ||
 551                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 552                     SCTP_MOBILITY_FASTHANDOFF)) &&
 553                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 554                     SCTP_MOBILITY_PRIM_DELETED) &&
 555                     (stcb->asoc.primary_destination->dest_state &
 556                     SCTP_ADDR_UNCONFIRMED) == 0) {
 557
 558                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 559                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 560                             SCTP_MOBILITY_FASTHANDOFF)) {
 561                                 sctp_assoc_immediate_retrans(stcb,
 562                                     stcb->asoc.primary_destination);
 563                         }
 564                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 565                             SCTP_MOBILITY_BASE)) {
 566                                 sctp_move_chunks_from_net(stcb,
 567                                     stcb->asoc.deleted_primary);
 568                         }
 569                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 570                             stcb->asoc.deleted_primary);
 571                 }
 572         } else {
 573                 /* couldn't set the requested primary address! */
 574                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 575                     "process_asconf_set_primary: set primary failed!\n");
 576                 /* must have been an invalid address, so report */
 577                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 578                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 579                     aparam_length);
 580         }
 581
 582         return (m_reply);
 583 }
 584
 585 /*
 586  * handles an ASCONF chunk.
 587  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 588  */
 589 void
 590 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 591     struct sockaddr *src,
 592     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 593     int first)
 594 {
 595         struct sctp_association *asoc;
 596         uint32_t serial_num;
 597         struct mbuf *n, *m_ack, *m_result, *m_tail;
 598         struct sctp_asconf_ack_chunk *ack_cp;
 599         struct sctp_asconf_paramhdr *aph;
 600         struct sctp_ipv6addr_param *p_addr;
 601         unsigned int asconf_limit, cnt;
 602         int error = 0;          /* did an error occur? */
 603
 604         /* asconf param buffer */
 605         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 606         struct sctp_asconf_ack *ack, *ack_next;
 607
 608         /* verify minimum length */
 609         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 611                     "handle_asconf: chunk too small = %xh\n",
 612                     ntohs(cp->ch.chunk_length));
 613                 return;
 614         }
 615         asoc = &stcb->asoc;
 616         serial_num = ntohl(cp->serial_number);
 617
 618         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 619                 /* got a duplicate ASCONF */
 620                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 621                     "handle_asconf: got duplicate serial number = %xh\n",
 622                     serial_num);
 623                 return;
 624         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 625                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 626                     serial_num, asoc->asconf_seq_in + 1);
 627                 return;
 628         }
 629         /* it's the expected "next" sequence number, so process it */
 630         asoc->asconf_seq_in = serial_num;       /* update sequence */
 631         /* get length of all the param's in the ASCONF */
 632         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 633         SCTPDBG(SCTP_DEBUG_ASCONF1,
 634             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 635             asconf_limit, serial_num);
 636
 637         if (first) {
 638                 /* delete old cache */
 639                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 640
 641                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 642                         if (ack->serial_number == serial_num)
 643                                 break;
 644                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 645                             ack->serial_number, serial_num);
 646                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 647                         if (ack->data != NULL) {
 648                                 sctp_m_freem(ack->data);
 649                         }
 650                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 651                 }
 652         }
 653         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 654             M_NOWAIT, 1, MT_DATA);
 655         if (m_ack == NULL) {
 656                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 657                     "handle_asconf: couldn't get mbuf!\n");
 658                 return;
 659         }
 660         m_tail = m_ack;         /* current reply chain's tail */
 661
 662         /* fill in ASCONF-ACK header */
 663         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 664         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 665         ack_cp->ch.chunk_flags = 0;
 666         ack_cp->serial_number = htonl(serial_num);
 667         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 668         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 669         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 670
 671         /* skip the lookup address parameter */
 672         offset += sizeof(struct sctp_asconf_chunk);
 673         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 674         if (p_addr == NULL) {
 675                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 676                     "handle_asconf: couldn't get lookup addr!\n");
 677                 /* respond with a missing/invalid mandatory parameter error */
 678                 return;
 679         }
 680         /* param_length is already validated in process_control... */
 681         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 682         /* get pointer to first asconf param in ASCONF */
 683         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 684         if (aph == NULL) {
 685                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 686                 goto send_reply;
 687         }
 688         /* process through all parameters */
 689         cnt = 0;
 690         while (aph != NULL) {
 691                 unsigned int param_length, param_type;
 692
 693                 param_type = ntohs(aph->ph.param_type);
 694                 param_length = ntohs(aph->ph.param_length);
 695                 if (offset + param_length > asconf_limit) {
 696                         /* parameter goes beyond end of chunk! */
 697                         sctp_m_freem(m_ack);
 698                         return;
 699                 }
 700                 m_result = NULL;
 701
 702                 if (param_length > sizeof(aparam_buf)) {
 703                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 704                         sctp_m_freem(m_ack);
 705                         return;
 706                 }
 707                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 708                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 709                         sctp_m_freem(m_ack);
 710                 }
 711                 /* get the entire parameter */
 712                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 713                 if (aph == NULL) {
 714                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 715                         sctp_m_freem(m_ack);
 716                         return;
 717                 }
 718                 switch (param_type) {
 719                 case SCTP_ADD_IP_ADDRESS:
 720                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 721                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 722                         cnt++;
 723                         break;
 724                 case SCTP_DEL_IP_ADDRESS:
 725                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 726                             error);
 727                         break;
 728                 case SCTP_ERROR_CAUSE_IND:
 729                         /* not valid in an ASCONF chunk */
 730                         break;
 731                 case SCTP_SET_PRIM_ADDR:
 732                         m_result = sctp_process_asconf_set_primary(src, aph,
 733                             stcb, error);
 734                         break;
 735                 case SCTP_NAT_VTAGS:
 736                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 737                         break;
 738                 case SCTP_SUCCESS_REPORT:
 739                         /* not valid in an ASCONF chunk */
 740                         break;
 741                 case SCTP_ULP_ADAPTATION:
 742                         /* FIX */
 743                         break;
 744                 default:
 745                         if ((param_type & 0x8000) == 0) {
 746                                 /* Been told to STOP at this param */
 747                                 asconf_limit = offset;
 748                                 /*
 749                                  * FIX FIX - We need to call
 750                                  * sctp_arethere_unrecognized_parameters()
 751                                  * to get a operr and send it for any
 752                                  * param's with the 0x4000 bit set OR do it
 753                                  * here ourselves... note we still must STOP
 754                                  * if the 0x8000 bit is clear.
 755                                  */
 756                         }
 757                         /* unknown/invalid param type */
 758                         break;
 759                 }               /* switch */
 760
 761                 /* add any (error) result to the reply mbuf chain */
 762                 if (m_result != NULL) {
 763                         SCTP_BUF_NEXT(m_tail) = m_result;
 764                         m_tail = m_result;
 765                         /* update lengths, make sure it's aligned too */
 766                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 767                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 768                         /* set flag to force success reports */
 769                         error = 1;
 770                 }
 771                 offset += SCTP_SIZE32(param_length);
 772                 /* update remaining ASCONF message length to process */
 773                 if (offset >= asconf_limit) {
 774                         /* no more data in the mbuf chain */
 775                         break;
 776                 }
 777                 /* get pointer to next asconf param */
 778                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 779                     sizeof(struct sctp_asconf_paramhdr),
 780                     (uint8_t *) & aparam_buf);
 781                 if (aph == NULL) {
 782                         /* can't get an asconf paramhdr */
 783                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 784                         /* FIX ME - add error here... */
 785                 }
 786         }
 787
 788 send_reply:
 789         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 790         /* save the ASCONF-ACK reply */
 791         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 792             struct sctp_asconf_ack);
 793         if (ack == NULL) {
 794                 sctp_m_freem(m_ack);
 795                 return;
 796         }
 797         ack->serial_number = serial_num;
 798         ack->last_sent_to = NULL;
 799         ack->data = m_ack;
 800         ack->len = 0;
 801         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 802                 ack->len += SCTP_BUF_LEN(n);
 803         }
 804         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 805
 806         /* see if last_control_chunk_from is set properly (use IP src addr) */
 807         if (stcb->asoc.last_control_chunk_from == NULL) {
 808                 /*
 809                  * this could happen if the source address was just newly
 810                  * added
 811                  */
 812                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 813                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 814                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 815                 /* look up the from address */
 816                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 817 #ifdef SCTP_DEBUG
 818                 if (stcb->asoc.last_control_chunk_from == NULL) {
 819                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 820                 }
 821 #endif
 822         }
 823 }
 824
 825 /*
 826  * does the address match? returns 0 if not, 1 if so
 827  */
 828 static uint32_t
 829 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 830 {
 831         switch (sa->sa_family) {
 832 #ifdef INET6
 833         case AF_INET6:
 834                 {
 835                         /* XXX scopeid */
 836                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 837
 838                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 839                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 840                             sizeof(struct in6_addr)) == 0)) {
 841                                 return (1);
 842                         }
 843                         break;
 844                 }
 845 #endif
 846 #ifdef INET
 847         case AF_INET:
 848                 {
 849                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 850
 851                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 852                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 853                             sizeof(struct in_addr)) == 0)) {
 854                                 return (1);
 855                         }
 856                         break;
 857                 }
 858 #endif
 859         default:
 860                 break;
 861         }
 862         return (0);
 863 }
 864
 865 /*
 866  * does the address match? returns 0 if not, 1 if so
 867  */
 868 static uint32_t
 869 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 870 {
 871 #if defined(INET) || defined(INET6)
 872         uint16_t param_type, param_length;
 873
 874         param_type = ntohs(ph->param_type);
 875         param_length = ntohs(ph->param_length);
 876 #endif
 877         switch (sa->sa_family) {
 878 #ifdef INET6
 879         case AF_INET6:
 880                 {
 881                         /* XXX scopeid */
 882                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 883                         struct sctp_ipv6addr_param *v6addr;
 884
 885                         v6addr = (struct sctp_ipv6addr_param *)ph;
 886                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 887                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 888                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 889                             sizeof(struct in6_addr)) == 0)) {
 890                                 return (1);
 891                         }
 892                         break;
 893                 }
 894 #endif
 895 #ifdef INET
 896         case AF_INET:
 897                 {
 898                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 899                         struct sctp_ipv4addr_param *v4addr;
 900
 901                         v4addr = (struct sctp_ipv4addr_param *)ph;
 902                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 903                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 904                             (memcmp(&v4addr->addr, &sin->sin_addr,
 905                             sizeof(struct in_addr)) == 0)) {
 906                                 return (1);
 907                         }
 908                         break;
 909                 }
 910 #endif
 911         default:
 912                 break;
 913         }
 914         return (0);
 915 }
 916
 917 /*
 918  * Cleanup for non-responded/OP ERR'd ASCONF
 919  */
 920 void
 921 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 922 {
 923         /*
 924          * clear out any existing asconfs going out
 925          */
 926         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 927             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 928         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 929         /* remove the old ASCONF on our outbound queue */
 930         sctp_toss_old_asconf(stcb);
 931 }
 932
 933 /*
 934  * cleanup any cached source addresses that may be topologically
 935  * incorrect after a new address has been added to this interface.
 936  */
 937 static void
 938 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 939 {
 940         struct sctp_nets *net;
 941
 942         /*
 943          * Ideally, we want to only clear cached routes and source addresses
 944          * that are topologically incorrect.  But since there is no easy way
 945          * to know whether the newly added address on the ifn would cause a
 946          * routing change (i.e. a new egress interface would be chosen)
 947          * without doing a new routing lookup and source address selection,
 948          * we will (for now) just flush any cached route using a different
 949          * ifn (and cached source addrs) and let output re-choose them
 950          * during the next send on that net.
 951          */
 952         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 953                 /*
 954                  * clear any cached route (and cached source address) if the
 955                  * route's interface is NOT the same as the address change.
 956                  * If it's the same interface, just clear the cached source
 957                  * address.
 958                  */
 959                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 960                     ((ifn == NULL) ||
 961                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 962                         /* clear any cached route */
 963                         RTFREE(net->ro.ro_rt);
 964                         net->ro.ro_rt = NULL;
 965                 }
 966                 /* clear any cached source address */
 967                 if (net->src_addr_selected) {
 968                         sctp_free_ifa(net->ro._s_addr);
 969                         net->ro._s_addr = NULL;
 970                         net->src_addr_selected = 0;
 971                 }
 972         }
 973 }
 974
 975
 976 void
 977 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 978 {
 979         int error;
 980
 981         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 982                 return;
 983         }
 984         if (stcb->asoc.deleted_primary == NULL) {
 985                 return;
 986         }
 987         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 988                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 989                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 990                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 991                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 992                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 993                     stcb->asoc.deleted_primary,
 994                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
 995                 stcb->asoc.num_send_timers_up--;
 996                 if (stcb->asoc.num_send_timers_up < 0) {
 997                         stcb->asoc.num_send_timers_up = 0;
 998                 }
 999                 SCTP_TCB_LOCK_ASSERT(stcb);
1000                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1001                     stcb->asoc.deleted_primary);
1002                 if (error) {
1003                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1004                         return;
1005                 }
1006                 SCTP_TCB_LOCK_ASSERT(stcb);
1007 #ifdef SCTP_AUDITING_ENABLED
1008                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1009 #endif
1010                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1011                 if ((stcb->asoc.num_send_timers_up == 0) &&
1012                     (stcb->asoc.sent_queue_cnt > 0)) {
1013                         struct sctp_tmit_chunk *chk;
1014
1015                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1016                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1017                             stcb, chk->whoTo);
1018                 }
1019         }
1020         return;
1021 }
1022
1023 static int
1024     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1025
1026 void
1027 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1028 {
1029         struct sctp_tmit_chunk *chk;
1030
1031         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1032         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1033             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1034         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1035         net->error_count = 0;
1036         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1037                 if (chk->whoTo == net) {
1038                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1039                                 chk->sent = SCTP_DATAGRAM_RESEND;
1040                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1041                                 sctp_flight_size_decrease(chk);
1042                                 sctp_total_flight_decrease(stcb, chk);
1043                                 net->marked_retrans++;
1044                                 stcb->asoc.marked_retrans++;
1045                         }
1046                 }
1047         }
1048         if (net->marked_retrans) {
1049                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1050         }
1051 }
1052
1053 static void
1054 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1055 {
1056         struct sctp_nets *net;
1057         int addrnum, changed;
1058
1059         /*
1060          * If number of local valid addresses is 1, the valid address is
1061          * probably newly added address. Several valid addresses in this
1062          * association.  A source address may not be changed.  Additionally,
1063          * they can be configured on a same interface as "alias" addresses.
1064          * (by micchie)
1065          */
1066         addrnum = sctp_local_addr_count(stcb);
1067         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1068             addrnum);
1069         if (addrnum == 1) {
1070                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1071                         /* clear any cached route and source address */
1072                         if (net->ro.ro_rt) {
1073                                 RTFREE(net->ro.ro_rt);
1074                                 net->ro.ro_rt = NULL;
1075                         }
1076                         if (net->src_addr_selected) {
1077                                 sctp_free_ifa(net->ro._s_addr);
1078                                 net->ro._s_addr = NULL;
1079                                 net->src_addr_selected = 0;
1080                         }
1081                         /* Retransmit unacknowledged DATA chunks immediately */
1082                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1083                             SCTP_MOBILITY_FASTHANDOFF)) {
1084                                 sctp_net_immediate_retrans(stcb, net);
1085                         }
1086                         /* also, SET PRIMARY is maybe already sent */
1087                 }
1088                 return;
1089         }
1090         /* Multiple local addresses exsist in the association.  */
1091         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1092                 /* clear any cached route and source address */
1093                 if (net->ro.ro_rt) {
1094                         RTFREE(net->ro.ro_rt);
1095                         net->ro.ro_rt = NULL;
1096                 }
1097                 if (net->src_addr_selected) {
1098                         sctp_free_ifa(net->ro._s_addr);
1099                         net->ro._s_addr = NULL;
1100                         net->src_addr_selected = 0;
1101                 }
1102                 /*
1103                  * Check if the nexthop is corresponding to the new address.
1104                  * If the new address is corresponding to the current
1105                  * nexthop, the path will be changed. If the new address is
1106                  * NOT corresponding to the current nexthop, the path will
1107                  * not be changed.
1108                  */
1109                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1110                     stcb->sctp_ep->def_vrf_id);
1111                 if (net->ro.ro_rt == NULL)
1112                         continue;
1113
1114                 changed = 0;
1115                 switch (net->ro._l_addr.sa.sa_family) {
1116 #ifdef INET
1117                 case AF_INET:
1118                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1119                                 changed = 1;
1120                         }
1121                         break;
1122 #endif
1123 #ifdef INET6
1124                 case AF_INET6:
1125                         if (sctp_v6src_match_nexthop(
1126                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1127                                 changed = 1;
1128                         }
1129                         break;
1130 #endif
1131                 default:
1132                         break;
1133                 }
1134                 /*
1135                  * if the newly added address does not relate routing
1136                  * information, we skip.
1137                  */
1138                 if (changed == 0)
1139                         continue;
1140                 /* Retransmit unacknowledged DATA chunks immediately */
1141                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1142                     SCTP_MOBILITY_FASTHANDOFF)) {
1143                         sctp_net_immediate_retrans(stcb, net);
1144                 }
1145                 /* Send SET PRIMARY for this new address */
1146                 if (net == stcb->asoc.primary_destination) {
1147                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1148                             SCTP_SET_PRIM_ADDR);
1149                 }
1150         }
1151 }
1152
1153 /*
1154  * process an ADD/DELETE IP ack from peer.
1155  * addr: corresponding sctp_ifa to the address being added/deleted.
1156  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1157  * flag: 1=success, 0=failure.
1158  */
1159 static void
1160 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1161 {
1162         /*
1163          * do the necessary asoc list work- if we get a failure indication,
1164          * leave the address on the assoc's restricted list.  If we get a
1165          * success indication, remove the address from the restricted list.
1166          */
1167         /*
1168          * Note: this will only occur for ADD_IP_ADDRESS, since
1169          * DEL_IP_ADDRESS is never actually added to the list...
1170          */
1171         if (flag) {
1172                 /* success case, so remove from the restricted list */
1173                 sctp_del_local_addr_restricted(stcb, addr);
1174
1175                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1176                     SCTP_MOBILITY_BASE) ||
1177                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1178                     SCTP_MOBILITY_FASTHANDOFF)) {
1179                         sctp_path_check_and_react(stcb, addr);
1180                         return;
1181                 }
1182                 /* clear any cached/topologically incorrect source addresses */
1183                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1184         }
1185         /* else, leave it on the list */
1186 }
1187
1188 /*
1189  * add an asconf add/delete/set primary IP address parameter to the queue.
1190  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1191  * returns 0 if queued, -1 if not queued/removed.
1192  * NOTE: if adding, but a delete for the same address is already scheduled
1193  * (and not yet sent out), simply remove it from queue.  Same for deleting
1194  * an address already scheduled for add.  If a duplicate operation is found,
1195  * ignore the new one.
1196  */
1197 static int
1198 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1199     uint16_t type)
1200 {
1201         struct sctp_asconf_addr *aa, *aa_next;
1202
1203         /* make sure the request isn't already in the queue */
1204         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1205                 /* address match? */
1206                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1207                         continue;
1208                 /*
1209                  * is the request already in queue but not sent? pass the
1210                  * request already sent in order to resolve the following
1211                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1212                  * can't remove the ADD request already sent 3. arrival of
1213                  * ADD
1214                  */
1215                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1216                         return (-1);
1217                 }
1218                 /* is the negative request already in queue, and not sent */
1219                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1220                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1221                         /* add requested, delete already queued */
1222                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1223                         /* remove the ifa from the restricted list */
1224                         sctp_del_local_addr_restricted(stcb, ifa);
1225                         /* free the asconf param */
1226                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1227                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1228                         return (-1);
1229                 }
1230                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1231                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1232                         /* delete requested, add already queued */
1233                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1234                         /* remove the aa->ifa from the restricted list */
1235                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1236                         /* free the asconf param */
1237                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1238                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1239                         return (-1);
1240                 }
1241         }                       /* for each aa */
1242
1243         /* adding new request to the queue */
1244         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1245             SCTP_M_ASC_ADDR);
1246         if (aa == NULL) {
1247                 /* didn't get memory */
1248                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1249                 return (-1);
1250         }
1251         aa->special_del = 0;
1252         /* fill in asconf address parameter fields */
1253         /* top level elements are "networked" during send */
1254         aa->ap.aph.ph.param_type = type;
1255         aa->ifa = ifa;
1256         atomic_add_int(&ifa->refcount, 1);
1257         /* correlation_id filled in during send routine later... */
1258         switch (ifa->address.sa.sa_family) {
1259 #ifdef INET6
1260         case AF_INET6:
1261                 {
1262                         struct sockaddr_in6 *sin6;
1263
1264                         sin6 = &ifa->address.sin6;
1265                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1266                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1267                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1268                             sizeof(struct sctp_ipv6addr_param);
1269                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1270                             sizeof(struct in6_addr));
1271                         break;
1272                 }
1273 #endif
1274 #ifdef INET
1275         case AF_INET:
1276                 {
1277                         struct sockaddr_in *sin;
1278
1279                         sin = &ifa->address.sin;
1280                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1281                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1282                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1283                             sizeof(struct sctp_ipv4addr_param);
1284                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1285                             sizeof(struct in_addr));
1286                         break;
1287                 }
1288 #endif
1289         default:
1290                 /* invalid family! */
1291                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1292                 sctp_free_ifa(ifa);
1293                 return (-1);
1294         }
1295         aa->sent = 0;           /* clear sent flag */
1296
1297         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1298 #ifdef SCTP_DEBUG
1299         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1300                 if (type == SCTP_ADD_IP_ADDRESS) {
1301                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1302                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1303                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1304                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1306                 } else {
1307                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1308                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1309                 }
1310         }
1311 #endif
1312
1313         return (0);
1314 }
1315
1316
1317 /*
1318  * add an asconf operation for the given ifa and type.
1319  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1320  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1321  * advisable.
1322  */
1323 static int
1324 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1325     uint16_t type)
1326 {
1327         uint32_t status;
1328         int pending_delete_queued = 0;
1329
1330         /* see if peer supports ASCONF */
1331         if (stcb->asoc.asconf_supported == 0) {
1332                 return (-1);
1333         }
1334         /*
1335          * if this is deleting the last address from the assoc, mark it as
1336          * pending.
1337          */
1338         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1339             (sctp_local_addr_count(stcb) < 2)) {
1340                 /* set the pending delete info only */
1341                 stcb->asoc.asconf_del_pending = 1;
1342                 stcb->asoc.asconf_addr_del_pending = ifa;
1343                 atomic_add_int(&ifa->refcount, 1);
1344                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1345                     "asconf_queue_add: mark delete last address pending\n");
1346                 return (-1);
1347         }
1348         /* queue an asconf parameter */
1349         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1350
1351         /*
1352          * if this is an add, and there is a delete also pending (i.e. the
1353          * last local address is being changed), queue the pending delete
1354          * too.
1355          */
1356         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1357                 /* queue in the pending delete */
1358                 if (sctp_asconf_queue_mgmt(stcb,
1359                     stcb->asoc.asconf_addr_del_pending,
1360                     SCTP_DEL_IP_ADDRESS) == 0) {
1361                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1362                         pending_delete_queued = 1;
1363                         /* clear out the pending delete info */
1364                         stcb->asoc.asconf_del_pending = 0;
1365                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1366                         stcb->asoc.asconf_addr_del_pending = NULL;
1367                 }
1368         }
1369         if (pending_delete_queued) {
1370                 struct sctp_nets *net;
1371
1372                 /*
1373                  * since we know that the only/last address is now being
1374                  * changed in this case, reset the cwnd/rto on all nets to
1375                  * start as a new address and path.  Also clear the error
1376                  * counts to give the assoc the best chance to complete the
1377                  * address change.
1378                  */
1379                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1380                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1381                             net);
1382                         net->RTO = 0;
1383                         net->error_count = 0;
1384                 }
1385                 stcb->asoc.overall_error_count = 0;
1386                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1387                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1388                             stcb->asoc.overall_error_count,
1389                             0,
1390                             SCTP_FROM_SCTP_ASCONF,
1391                             __LINE__);
1392                 }
1393                 /* queue in an advisory set primary too */
1394                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1395                 /* let caller know we should send this out immediately */
1396                 status = 1;
1397         }
1398         return (status);
1399 }
1400
1401 /*-
1402  * add an asconf delete IP address parameter to the queue by sockaddr and
1403  * possibly with no sctp_ifa available.  This is only called by the routine
1404  * that checks the addresses in an INIT-ACK against the current address list.
1405  * returns 0 if completed, non-zero if not completed.
1406  * NOTE: if an add is already scheduled (and not yet sent out), simply
1407  * remove it from queue.  If a duplicate operation is found, ignore the
1408  * new one.
1409  */
1410 static int
1411 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1412 {
1413         struct sctp_ifa *ifa;
1414         struct sctp_asconf_addr *aa, *aa_next;
1415
1416         if (stcb == NULL) {
1417                 return (-1);
1418         }
1419         /* see if peer supports ASCONF */
1420         if (stcb->asoc.asconf_supported == 0) {
1421                 return (-1);
1422         }
1423         /* make sure the request isn't already in the queue */
1424         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1425                 /* address match? */
1426                 if (sctp_asconf_addr_match(aa, sa) == 0)
1427                         continue;
1428                 /* is the request already in queue (sent or not) */
1429                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1430                         return (-1);
1431                 }
1432                 /* is the negative request already in queue, and not sent */
1433                 if (aa->sent == 1)
1434                         continue;
1435                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1436                         /* add already queued, so remove existing entry */
1437                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1438                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1439                         /* free the entry */
1440                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1441                         return (-1);
1442                 }
1443         }                       /* for each aa */
1444
1445         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1446         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1447
1448         /* adding new request to the queue */
1449         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1450             SCTP_M_ASC_ADDR);
1451         if (aa == NULL) {
1452                 /* didn't get memory */
1453                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1454                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1455                 return (-1);
1456         }
1457         aa->special_del = 0;
1458         /* fill in asconf address parameter fields */
1459         /* top level elements are "networked" during send */
1460         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1461         aa->ifa = ifa;
1462         if (ifa)
1463                 atomic_add_int(&ifa->refcount, 1);
1464         /* correlation_id filled in during send routine later... */
1465         switch (sa->sa_family) {
1466 #ifdef INET6
1467         case AF_INET6:
1468                 {
1469                         /* IPv6 address */
1470                         struct sockaddr_in6 *sin6;
1471
1472                         sin6 = (struct sockaddr_in6 *)sa;
1473                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1474                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1475                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1476                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1477                             sizeof(struct in6_addr));
1478                         break;
1479                 }
1480 #endif
1481 #ifdef INET
1482         case AF_INET:
1483                 {
1484                         /* IPv4 address */
1485                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1486
1487                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1488                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1489                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1490                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1491                             sizeof(struct in_addr));
1492                         break;
1493                 }
1494 #endif
1495         default:
1496                 /* invalid family! */
1497                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1498                 if (ifa)
1499                         sctp_free_ifa(ifa);
1500                 return (-1);
1501         }
1502         aa->sent = 0;           /* clear sent flag */
1503
1504         /* delete goes to the back of the queue */
1505         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1506
1507         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1508         return (0);
1509 }
1510
1511 /*
1512  * find a specific asconf param on our "sent" queue
1513  */
1514 static struct sctp_asconf_addr *
1515 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1516 {
1517         struct sctp_asconf_addr *aa;
1518
1519         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1520                 if (aa->ap.aph.correlation_id == correlation_id &&
1521                     aa->sent == 1) {
1522                         /* found it */
1523                         return (aa);
1524                 }
1525         }
1526         /* didn't find it */
1527         return (NULL);
1528 }
1529
1530 /*
1531  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1532  * notifications based on the error response
1533  */
1534 static void
1535 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1536     struct sctp_asconf_paramhdr *aph)
1537 {
1538         struct sctp_error_cause *eh;
1539         struct sctp_paramhdr *ph;
1540         uint16_t param_type;
1541         uint16_t error_code;
1542
1543         eh = (struct sctp_error_cause *)(aph + 1);
1544         ph = (struct sctp_paramhdr *)(eh + 1);
1545         /* validate lengths */
1546         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1547             htons(aph->ph.param_length)) {
1548                 /* invalid error cause length */
1549                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1550                     "asconf_process_error: cause element too long\n");
1551                 return;
1552         }
1553         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1554             htons(eh->length)) {
1555                 /* invalid included TLV length */
1556                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1557                     "asconf_process_error: included TLV too long\n");
1558                 return;
1559         }
1560         /* which error code ? */
1561         error_code = ntohs(eh->code);
1562         param_type = ntohs(aph->ph.param_type);
1563         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1564         switch (error_code) {
1565         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1566                 /* we allow ourselves to "try again" for this error */
1567                 break;
1568         default:
1569                 /* peer can't handle it... */
1570                 switch (param_type) {
1571                 case SCTP_ADD_IP_ADDRESS:
1572                 case SCTP_DEL_IP_ADDRESS:
1573                 case SCTP_SET_PRIM_ADDR:
1574                         break;
1575                 default:
1576                         break;
1577                 }
1578         }
1579 }
1580
1581 /*
1582  * process an asconf queue param.
1583  * aparam: parameter to process, will be removed from the queue.
1584  * flag: 1=success case, 0=failure case
1585  */
1586 static void
1587 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1588     struct sctp_asconf_addr *aparam, uint32_t flag)
1589 {
1590         uint16_t param_type;
1591
1592         /* process this param */
1593         param_type = aparam->ap.aph.ph.param_type;
1594         switch (param_type) {
1595         case SCTP_ADD_IP_ADDRESS:
1596                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1597                     "process_param_ack: added IP address\n");
1598                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1599                 break;
1600         case SCTP_DEL_IP_ADDRESS:
1601                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1602                     "process_param_ack: deleted IP address\n");
1603                 /* nothing really to do... lists already updated */
1604                 break;
1605         case SCTP_SET_PRIM_ADDR:
1606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1607                     "process_param_ack: set primary IP address\n");
1608                 /* nothing to do... peer may start using this addr */
1609                 break;
1610         default:
1611                 /* should NEVER happen */
1612                 break;
1613         }
1614
1615         /* remove the param and free it */
1616         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1617         if (aparam->ifa)
1618                 sctp_free_ifa(aparam->ifa);
1619         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1620 }
1621
1622 /*
1623  * cleanup from a bad asconf ack parameter
1624  */
1625 static void
1626 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1627 {
1628         /* assume peer doesn't really know how to do asconfs */
1629         /* XXX we could free the pending queue here */
1630
1631 }
1632
1633 void
1634 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1635     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1636     struct sctp_nets *net, int *abort_no_unlock)
1637 {
1638         struct sctp_association *asoc;
1639         uint32_t serial_num;
1640         uint16_t ack_length;
1641         struct sctp_asconf_paramhdr *aph;
1642         struct sctp_asconf_addr *aa, *aa_next;
1643         uint32_t last_error_id = 0;     /* last error correlation id */
1644         uint32_t id;
1645         struct sctp_asconf_addr *ap;
1646
1647         /* asconf param buffer */
1648         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1649
1650         /* verify minimum length */
1651         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1652                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1653                     "handle_asconf_ack: chunk too small = %xh\n",
1654                     ntohs(cp->ch.chunk_length));
1655                 return;
1656         }
1657         asoc = &stcb->asoc;
1658         serial_num = ntohl(cp->serial_number);
1659
1660         /*
1661          * NOTE: we may want to handle this differently- currently, we will
1662          * abort when we get an ack for the expected serial number + 1 (eg.
1663          * we didn't send it), process an ack normally if it is the expected
1664          * serial number, and re-send the previous ack for *ALL* other
1665          * serial numbers
1666          */
1667
1668         /*
1669          * if the serial number is the next expected, but I didn't send it,
1670          * abort the asoc, since someone probably just hijacked us...
1671          */
1672         if (serial_num == (asoc->asconf_seq_out + 1)) {
1673                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1674                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1675                 *abort_no_unlock = 1;
1676                 return;
1677         }
1678         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1679                 /* got a duplicate/unexpected ASCONF-ACK */
1680                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1681                     serial_num, asoc->asconf_seq_out_acked + 1);
1682                 return;
1683         }
1684         if (serial_num == asoc->asconf_seq_out - 1) {
1685                 /* stop our timer */
1686                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1687                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1688         }
1689         /* process the ASCONF-ACK contents */
1690         ack_length = ntohs(cp->ch.chunk_length) -
1691             sizeof(struct sctp_asconf_ack_chunk);
1692         offset += sizeof(struct sctp_asconf_ack_chunk);
1693         /* process through all parameters */
1694         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1695                 unsigned int param_length, param_type;
1696
1697                 /* get pointer to next asconf parameter */
1698                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1699                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1700                 if (aph == NULL) {
1701                         /* can't get an asconf paramhdr */
1702                         sctp_asconf_ack_clear(stcb);
1703                         return;
1704                 }
1705                 param_type = ntohs(aph->ph.param_type);
1706                 param_length = ntohs(aph->ph.param_length);
1707                 if (param_length > ack_length) {
1708                         sctp_asconf_ack_clear(stcb);
1709                         return;
1710                 }
1711                 if (param_length < sizeof(struct sctp_paramhdr)) {
1712                         sctp_asconf_ack_clear(stcb);
1713                         return;
1714                 }
1715                 /* get the complete parameter... */
1716                 if (param_length > sizeof(aparam_buf)) {
1717                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1718                             "param length (%u) larger than buffer size!\n", param_length);
1719                         sctp_asconf_ack_clear(stcb);
1720                         return;
1721                 }
1722                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1723                 if (aph == NULL) {
1724                         sctp_asconf_ack_clear(stcb);
1725                         return;
1726                 }
1727                 /* correlation_id is transparent to peer, no ntohl needed */
1728                 id = aph->correlation_id;
1729
1730                 switch (param_type) {
1731                 case SCTP_ERROR_CAUSE_IND:
1732                         last_error_id = id;
1733                         /* find the corresponding asconf param in our queue */
1734                         ap = sctp_asconf_find_param(stcb, id);
1735                         if (ap == NULL) {
1736                                 /* hmm... can't find this in our queue! */
1737                                 break;
1738                         }
1739                         /* process the parameter, failed flag */
1740                         sctp_asconf_process_param_ack(stcb, ap, 0);
1741                         /* process the error response */
1742                         sctp_asconf_process_error(stcb, aph);
1743                         break;
1744                 case SCTP_SUCCESS_REPORT:
1745                         /* find the corresponding asconf param in our queue */
1746                         ap = sctp_asconf_find_param(stcb, id);
1747                         if (ap == NULL) {
1748                                 /* hmm... can't find this in our queue! */
1749                                 break;
1750                         }
1751                         /* process the parameter, success flag */
1752                         sctp_asconf_process_param_ack(stcb, ap, 1);
1753                         break;
1754                 default:
1755                         break;
1756                 }               /* switch */
1757
1758                 /* update remaining ASCONF-ACK message length to process */
1759                 ack_length -= SCTP_SIZE32(param_length);
1760                 if (ack_length <= 0) {
1761                         /* no more data in the mbuf chain */
1762                         break;
1763                 }
1764                 offset += SCTP_SIZE32(param_length);
1765         }                       /* while */
1766
1767         /*
1768          * if there are any "sent" params still on the queue, these are
1769          * implicitly "success", or "failed" (if we got an error back) ...
1770          * so process these appropriately
1771          *
1772          * we assume that the correlation_id's are monotonically increasing
1773          * beginning from 1 and that we don't have *that* many outstanding
1774          * at any given time
1775          */
1776         if (last_error_id == 0)
1777                 last_error_id--;/* set to "max" value */
1778         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1779                 if (aa->sent == 1) {
1780                         /*
1781                          * implicitly successful or failed if correlation_id
1782                          * < last_error_id, then success else, failure
1783                          */
1784                         if (aa->ap.aph.correlation_id < last_error_id)
1785                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1786                         else
1787                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1788                 } else {
1789                         /*
1790                          * since we always process in order (FIFO queue) if
1791                          * we reach one that hasn't been sent, the rest
1792                          * should not have been sent either. so, we're
1793                          * done...
1794                          */
1795                         break;
1796                 }
1797         }
1798
1799         /* update the next sequence number to use */
1800         asoc->asconf_seq_out_acked++;
1801         /* remove the old ASCONF on our outbound queue */
1802         sctp_toss_old_asconf(stcb);
1803         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1804 #ifdef SCTP_TIMER_BASED_ASCONF
1805                 /* we have more params, so restart our timer */
1806                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1807                     stcb, net);
1808 #else
1809                 /* we have more params, so send out more */
1810                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1811 #endif
1812         }
1813 }
1814
1815 #ifdef INET6
1816 static uint32_t
1817 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1818 {
1819         struct sockaddr_in6 *sin6, *net6;
1820         struct sctp_nets *net;
1821
1822         if (sa->sa_family != AF_INET6) {
1823                 /* wrong family */
1824                 return (0);
1825         }
1826         sin6 = (struct sockaddr_in6 *)sa;
1827         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1828                 /* not link local address */
1829                 return (0);
1830         }
1831         /* hunt through our destination nets list for this scope_id */
1832         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1833                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1834                     AF_INET6)
1835                         continue;
1836                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1837                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1838                         continue;
1839                 if (sctp_is_same_scope(sin6, net6)) {
1840                         /* found one */
1841                         return (1);
1842                 }
1843         }
1844         /* didn't find one */
1845         return (0);
1846 }
1847
1848 #endif
1849
1850 /*
1851  * address management functions
1852  */
1853 static void
1854 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1855     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1856 {
1857         int status;
1858
1859         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1860             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1861                 /* subset bound, no ASCONF allowed case, so ignore */
1862                 return;
1863         }
1864         /*
1865          * note: we know this is not the subset bound, no ASCONF case eg.
1866          * this is boundall or subset bound w/ASCONF allowed
1867          */
1868
1869         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1870         switch (ifa->address.sa.sa_family) {
1871 #ifdef INET6
1872         case AF_INET6:
1873                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1874                     &ifa->address.sin6.sin6_addr) != 0) {
1875                         return;
1876                 }
1877                 break;
1878 #endif
1879 #ifdef INET
1880         case AF_INET:
1881                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1882                     &ifa->address.sin.sin_addr) != 0) {
1883                         return;
1884                 }
1885                 break;
1886 #endif
1887         default:
1888                 return;
1889         }
1890 #ifdef INET6
1891         /* make sure we're "allowed" to add this type of addr */
1892         if (ifa->address.sa.sa_family == AF_INET6) {
1893                 /* invalid if we're not a v6 endpoint */
1894                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1895                         return;
1896                 /* is the v6 addr really valid ? */
1897                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1898                         return;
1899                 }
1900         }
1901 #endif
1902         /* put this address on the "pending/do not use yet" list */
1903         sctp_add_local_addr_restricted(stcb, ifa);
1904         /*
1905          * check address scope if address is out of scope, don't queue
1906          * anything... note: this would leave the address on both inp and
1907          * asoc lists
1908          */
1909         switch (ifa->address.sa.sa_family) {
1910 #ifdef INET6
1911         case AF_INET6:
1912                 {
1913                         struct sockaddr_in6 *sin6;
1914
1915                         sin6 = &ifa->address.sin6;
1916                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1917                                 /* we skip unspecifed addresses */
1918                                 return;
1919                         }
1920                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1921                                 if (stcb->asoc.scope.local_scope == 0) {
1922                                         return;
1923                                 }
1924                                 /* is it the right link local scope? */
1925                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1926                                         return;
1927                                 }
1928                         }
1929                         if (stcb->asoc.scope.site_scope == 0 &&
1930                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1931                                 return;
1932                         }
1933                         break;
1934                 }
1935 #endif
1936 #ifdef INET
1937         case AF_INET:
1938                 {
1939                         struct sockaddr_in *sin;
1940                         struct in6pcb *inp6;
1941
1942                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1943                         /* invalid if we are a v6 only endpoint */
1944                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1945                             SCTP_IPV6_V6ONLY(inp6))
1946                                 return;
1947
1948                         sin = &ifa->address.sin;
1949                         if (sin->sin_addr.s_addr == 0) {
1950                                 /* we skip unspecifed addresses */
1951                                 return;
1952                         }
1953                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1954                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1955                                 return;
1956                         }
1957                         break;
1958                 }
1959 #endif
1960         default:
1961                 /* else, not AF_INET or AF_INET6, so skip */
1962                 return;
1963         }
1964
1965         /* queue an asconf for this address add/delete */
1966         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1967                 /* does the peer do asconf? */
1968                 if (stcb->asoc.asconf_supported) {
1969                         /* queue an asconf for this addr */
1970                         status = sctp_asconf_queue_add(stcb, ifa, type);
1971
1972                         /*
1973                          * if queued ok, and in the open state, send out the
1974                          * ASCONF.  If in the non-open state, these will be
1975                          * sent when the state goes open.
1976                          */
1977                         if (status == 0 &&
1978                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1979 #ifdef SCTP_TIMER_BASED_ASCONF
1980                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1981                                     stcb, stcb->asoc.primary_destination);
1982 #else
1983                                 sctp_send_asconf(stcb, NULL, addr_locked);
1984 #endif
1985                         }
1986                 }
1987         }
1988 }
1989
1990
1991 int
1992 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1993 {
1994         struct sctp_asconf_iterator *asc;
1995         struct sctp_ifa *ifa;
1996         struct sctp_laddr *l;
1997         int cnt_invalid = 0;
1998
1999         asc = (struct sctp_asconf_iterator *)ptr;
2000         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2001                 ifa = l->ifa;
2002                 switch (ifa->address.sa.sa_family) {
2003 #ifdef INET6
2004                 case AF_INET6:
2005                         /* invalid if we're not a v6 endpoint */
2006                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2007                                 cnt_invalid++;
2008                                 if (asc->cnt == cnt_invalid)
2009                                         return (1);
2010                         }
2011                         break;
2012 #endif
2013 #ifdef INET
2014                 case AF_INET:
2015                         {
2016                                 /* invalid if we are a v6 only endpoint */
2017                                 struct in6pcb *inp6;
2018
2019                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2020                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2021                                     SCTP_IPV6_V6ONLY(inp6)) {
2022                                         cnt_invalid++;
2023                                         if (asc->cnt == cnt_invalid)
2024                                                 return (1);
2025                                 }
2026                                 break;
2027                         }
2028 #endif
2029                 default:
2030                         /* invalid address family */
2031                         cnt_invalid++;
2032                         if (asc->cnt == cnt_invalid)
2033                                 return (1);
2034                 }
2035         }
2036         return (0);
2037 }
2038
2039 static int
2040 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2041 {
2042         struct sctp_ifa *ifa;
2043         struct sctp_asconf_iterator *asc;
2044         struct sctp_laddr *laddr, *nladdr, *l;
2045
2046         /* Only for specific case not bound all */
2047         asc = (struct sctp_asconf_iterator *)ptr;
2048         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2049                 ifa = l->ifa;
2050                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2051                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2052                             sctp_nxt_addr) {
2053                                 if (laddr->ifa == ifa) {
2054                                         laddr->action = 0;
2055                                         break;
2056                                 }
2057                         }
2058                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2059                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2060                                 /* remove only after all guys are done */
2061                                 if (laddr->ifa == ifa) {
2062                                         sctp_del_local_addr_ep(inp, ifa);
2063                                 }
2064                         }
2065                 }
2066         }
2067         return (0);
2068 }
2069
2070 void
2071 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2072     void *ptr, uint32_t val SCTP_UNUSED)
2073 {
2074         struct sctp_asconf_iterator *asc;
2075         struct sctp_ifa *ifa;
2076         struct sctp_laddr *l;
2077         int cnt_invalid = 0;
2078         int type, status;
2079         int num_queued = 0;
2080
2081         asc = (struct sctp_asconf_iterator *)ptr;
2082         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2083                 ifa = l->ifa;
2084                 type = l->action;
2085
2086                 /* address's vrf_id must be the vrf_id of the assoc */
2087                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2088                         continue;
2089                 }
2090                 /* Same checks again for assoc */
2091                 switch (ifa->address.sa.sa_family) {
2092 #ifdef INET6
2093                 case AF_INET6:
2094                         {
2095                                 /* invalid if we're not a v6 endpoint */
2096                                 struct sockaddr_in6 *sin6;
2097
2098                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2099                                         cnt_invalid++;
2100                                         if (asc->cnt == cnt_invalid)
2101                                                 return;
2102                                         else
2103                                                 continue;
2104                                 }
2105                                 sin6 = &ifa->address.sin6;
2106                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2107                                         /* we skip unspecifed addresses */
2108                                         continue;
2109                                 }
2110                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2111                                     &sin6->sin6_addr) != 0) {
2112                                         continue;
2113                                 }
2114                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2115                                         if (stcb->asoc.scope.local_scope == 0) {
2116                                                 continue;
2117                                         }
2118                                         /* is it the right link local scope? */
2119                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2120                                                 continue;
2121                                         }
2122                                 }
2123                                 break;
2124                         }
2125 #endif
2126 #ifdef INET
2127                 case AF_INET:
2128                         {
2129                                 /* invalid if we are a v6 only endpoint */
2130                                 struct in6pcb *inp6;
2131                                 struct sockaddr_in *sin;
2132
2133                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2134                                 /* invalid if we are a v6 only endpoint */
2135                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2136                                     SCTP_IPV6_V6ONLY(inp6))
2137                                         continue;
2138
2139                                 sin = &ifa->address.sin;
2140                                 if (sin->sin_addr.s_addr == 0) {
2141                                         /* we skip unspecifed addresses */
2142                                         continue;
2143                                 }
2144                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2145                                     &sin->sin_addr) != 0) {
2146                                         continue;
2147                                 }
2148                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2149                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2150                                         continue;
2151                                 }
2152                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2153                                     SCTP_IPV6_V6ONLY(inp6)) {
2154                                         cnt_invalid++;
2155                                         if (asc->cnt == cnt_invalid)
2156                                                 return;
2157                                         else
2158                                                 continue;
2159                                 }
2160                                 break;
2161                         }
2162 #endif
2163                 default:
2164                         /* invalid address family */
2165                         cnt_invalid++;
2166                         if (asc->cnt == cnt_invalid)
2167                                 return;
2168                         else
2169                                 continue;
2170                         break;
2171                 }
2172
2173                 if (type == SCTP_ADD_IP_ADDRESS) {
2174                         /* prevent this address from being used as a source */
2175                         sctp_add_local_addr_restricted(stcb, ifa);
2176                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2177                         struct sctp_nets *net;
2178
2179                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2180                                 sctp_rtentry_t *rt;
2181
2182                                 /* delete this address if cached */
2183                                 if (net->ro._s_addr == ifa) {
2184                                         sctp_free_ifa(net->ro._s_addr);
2185                                         net->ro._s_addr = NULL;
2186                                         net->src_addr_selected = 0;
2187                                         rt = net->ro.ro_rt;
2188                                         if (rt) {
2189                                                 RTFREE(rt);
2190                                                 net->ro.ro_rt = NULL;
2191                                         }
2192                                         /*
2193                                          * Now we deleted our src address,
2194                                          * should we not also now reset the
2195                                          * cwnd/rto to start as if its a new
2196                                          * address?
2197                                          */
2198                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2199                                         net->RTO = 0;
2200
2201                                 }
2202                         }
2203                 } else if (type == SCTP_SET_PRIM_ADDR) {
2204                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2205                                 /* must validate the ifa is in the ep */
2206                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2207                                         continue;
2208                                 }
2209                         } else {
2210                                 /* Need to check scopes for this guy */
2211                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2212                                         continue;
2213                                 }
2214                         }
2215                 }
2216                 /* queue an asconf for this address add/delete */
2217                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2218                     stcb->asoc.asconf_supported == 1) {
2219                         /* queue an asconf for this addr */
2220                         status = sctp_asconf_queue_add(stcb, ifa, type);
2221                         /*
2222                          * if queued ok, and in the open state, update the
2223                          * count of queued params.  If in the non-open
2224                          * state, these get sent when the assoc goes open.
2225                          */
2226                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2227                                 if (status >= 0) {
2228                                         num_queued++;
2229                                 }
2230                         }
2231                 }
2232         }
2233         /*
2234          * If we have queued params in the open state, send out an ASCONF.
2235          */
2236         if (num_queued > 0) {
2237                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2238         }
2239 }
2240
2241 void
2242 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2243 {
2244         struct sctp_asconf_iterator *asc;
2245         struct sctp_ifa *ifa;
2246         struct sctp_laddr *l, *nl;
2247
2248         asc = (struct sctp_asconf_iterator *)ptr;
2249         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2250                 ifa = l->ifa;
2251                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2252                         /* Clear the defer use flag */
2253                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2254                 }
2255                 sctp_free_ifa(ifa);
2256                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2257                 SCTP_DECR_LADDR_COUNT();
2258         }
2259         SCTP_FREE(asc, SCTP_M_ASC_IT);
2260 }
2261
2262 /*
2263  * sa is the sockaddr to ask the peer to set primary to.
2264  * returns: 0 = completed, -1 = error
2265  */
2266 int32_t
2267 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2268 {
2269         uint32_t vrf_id;
2270         struct sctp_ifa *ifa;
2271
2272         /* find the ifa for the desired set primary */
2273         vrf_id = stcb->asoc.vrf_id;
2274         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2275         if (ifa == NULL) {
2276                 /* Invalid address */
2277                 return (-1);
2278         }
2279         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2280         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2281                 /* set primary queuing succeeded */
2282                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2283                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2284                     (void *)stcb);
2285                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2286                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2287 #ifdef SCTP_TIMER_BASED_ASCONF
2288                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2289                             stcb->sctp_ep, stcb,
2290                             stcb->asoc.primary_destination);
2291 #else
2292                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2293 #endif
2294                 }
2295         } else {
2296                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2297                     (void *)stcb);
2298                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2299                 return (-1);
2300         }
2301         return (0);
2302 }
2303
2304 void
2305 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2306 {
2307         struct sctp_inpcb *inp;
2308
2309         /* go through all our PCB's */
2310         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2311                 struct sctp_tcb *stcb;
2312
2313                 /* process for all associations for this endpoint */
2314                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2315                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2316                         if (!sctp_asconf_queue_add(stcb, ifa,
2317                             SCTP_SET_PRIM_ADDR)) {
2318                                 /* set primary queuing succeeded */
2319                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2320                                     (void *)stcb);
2321                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2322                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2323 #ifdef SCTP_TIMER_BASED_ASCONF
2324                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2325                                             stcb->sctp_ep, stcb,
2326                                             stcb->asoc.primary_destination);
2327 #else
2328                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2329 #endif
2330                                 }
2331                         }
2332                 }               /* for each stcb */
2333         }                       /* for each inp */
2334 }
2335
2336 int
2337 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2338 {
2339         struct sctp_tmit_chunk *chk, *nchk;
2340         unsigned int offset, asconf_limit;
2341         struct sctp_asconf_chunk *acp;
2342         struct sctp_asconf_paramhdr *aph;
2343         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2344         struct sctp_paramhdr *ph;
2345         int add_cnt, del_cnt;
2346         uint16_t last_param_type;
2347
2348         add_cnt = del_cnt = 0;
2349         last_param_type = 0;
2350         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2351                 if (chk->data == NULL) {
2352                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2353                         continue;
2354                 }
2355                 offset = 0;
2356                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2357                 offset += sizeof(struct sctp_asconf_chunk);
2358                 asconf_limit = ntohs(acp->ch.chunk_length);
2359                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2360                 if (ph == NULL) {
2361                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2362                         continue;
2363                 }
2364                 offset += ntohs(ph->param_length);
2365
2366                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2367                 if (aph == NULL) {
2368                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2369                         continue;
2370                 }
2371                 while (aph != NULL) {
2372                         unsigned int param_length, param_type;
2373
2374                         param_type = ntohs(aph->ph.param_type);
2375                         param_length = ntohs(aph->ph.param_length);
2376                         if (offset + param_length > asconf_limit) {
2377                                 /* parameter goes beyond end of chunk! */
2378                                 break;
2379                         }
2380                         if (param_length > sizeof(aparam_buf)) {
2381                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2382                                 break;
2383                         }
2384                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2385                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2386                                 break;
2387                         }
2388                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2389                         if (aph == NULL) {
2390                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2391                                 break;
2392                         }
2393                         ph = (struct sctp_paramhdr *)(aph + 1);
2394                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2395                                 switch (param_type) {
2396                                 case SCTP_ADD_IP_ADDRESS:
2397                                         add_cnt++;
2398                                         break;
2399                                 case SCTP_DEL_IP_ADDRESS:
2400                                         del_cnt++;
2401                                         break;
2402                                 default:
2403                                         break;
2404                                 }
2405                                 last_param_type = param_type;
2406                         }
2407                         offset += SCTP_SIZE32(param_length);
2408                         if (offset >= asconf_limit) {
2409                                 /* no more data in the mbuf chain */
2410                                 break;
2411                         }
2412                         /* get pointer to next asconf param */
2413                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2414                 }
2415         }
2416
2417         /*
2418          * we want to find the sequences which consist of ADD -> DEL -> ADD
2419          * or DEL -> ADD
2420          */
2421         if (add_cnt > del_cnt ||
2422             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2423                 return (1);
2424         }
2425         return (0);
2426 }
2427
2428 static struct sockaddr *
2429 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2430 {
2431         struct sctp_vrf *vrf = NULL;
2432         struct sctp_ifn *sctp_ifn;
2433         struct sctp_ifa *sctp_ifa;
2434
2435         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2436                 SCTP_IPI_ADDR_RLOCK();
2437         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2438         if (vrf == NULL) {
2439                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2440                         SCTP_IPI_ADDR_RUNLOCK();
2441                 return (NULL);
2442         }
2443         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2444                 if (stcb->asoc.scope.loopback_scope == 0 &&
2445                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2446                         /* Skip if loopback_scope not set */
2447                         continue;
2448                 }
2449                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2450                         switch (sctp_ifa->address.sa.sa_family) {
2451 #ifdef INET
2452                         case AF_INET:
2453                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2454                                         struct sockaddr_in *sin;
2455
2456                                         sin = &sctp_ifa->address.sin;
2457                                         if (sin->sin_addr.s_addr == 0) {
2458                                                 /* skip unspecifed addresses */
2459                                                 continue;
2460                                         }
2461                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2462                                             &sin->sin_addr) != 0) {
2463                                                 continue;
2464                                         }
2465                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2466                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2467                                                 continue;
2468
2469                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2470                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2471                                                 continue;
2472                                         /*
2473                                          * found a valid local v4 address to
2474                                          * use
2475                                          */
2476                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2477                                                 SCTP_IPI_ADDR_RUNLOCK();
2478                                         return (&sctp_ifa->address.sa);
2479                                 }
2480                                 break;
2481 #endif
2482 #ifdef INET6
2483                         case AF_INET6:
2484                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2485                                         struct sockaddr_in6 *sin6;
2486
2487                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2488                                                 continue;
2489                                         }
2490                                         sin6 = &sctp_ifa->address.sin6;
2491                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2492                                                 /*
2493                                                  * we skip unspecifed
2494                                                  * addresses
2495                                                  */
2496                                                 continue;
2497                                         }
2498                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2499                                             &sin6->sin6_addr) != 0) {
2500                                                 continue;
2501                                         }
2502                                         if (stcb->asoc.scope.local_scope == 0 &&
2503                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2504                                                 continue;
2505                                         if (stcb->asoc.scope.site_scope == 0 &&
2506                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2507                                                 continue;
2508
2509                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2510                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2511                                                 continue;
2512                                         /*
2513                                          * found a valid local v6 address to
2514                                          * use
2515                                          */
2516                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2517                                                 SCTP_IPI_ADDR_RUNLOCK();
2518                                         return (&sctp_ifa->address.sa);
2519                                 }
2520                                 break;
2521 #endif
2522                         default:
2523                                 break;
2524                         }
2525                 }
2526         }
2527         /* no valid addresses found */
2528         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2529                 SCTP_IPI_ADDR_RUNLOCK();
2530         return (NULL);
2531 }
2532
2533 static struct sockaddr *
2534 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2535 {
2536         struct sctp_laddr *laddr;
2537
2538         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2539                 if (laddr->ifa == NULL) {
2540                         continue;
2541                 }
2542                 /* is the address restricted ? */
2543                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2544                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2545                         continue;
2546
2547                 /* found a valid local address to use */
2548                 return (&laddr->ifa->address.sa);
2549         }
2550         /* no valid addresses found */
2551         return (NULL);
2552 }
2553
2554 /*
2555  * builds an ASCONF chunk from queued ASCONF params.
2556  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2557  */
2558 struct mbuf *
2559 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2560 {
2561         struct mbuf *m_asconf, *m_asconf_chk;
2562         struct sctp_asconf_addr *aa;
2563         struct sctp_asconf_chunk *acp;
2564         struct sctp_asconf_paramhdr *aph;
2565         struct sctp_asconf_addr_param *aap;
2566         uint32_t p_length;
2567         uint32_t correlation_id = 1;    /* 0 is reserved... */
2568         caddr_t ptr, lookup_ptr;
2569         uint8_t lookup_used = 0;
2570
2571         /* are there any asconf params to send? */
2572         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2573                 if (aa->sent == 0)
2574                         break;
2575         }
2576         if (aa == NULL)
2577                 return (NULL);
2578
2579         /*
2580          * get a chunk header mbuf and a cluster for the asconf params since
2581          * it's simpler to fill in the asconf chunk header lookup address on
2582          * the fly
2583          */
2584         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2585         if (m_asconf_chk == NULL) {
2586                 /* no mbuf's */
2587                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2588                     "compose_asconf: couldn't get chunk mbuf!\n");
2589                 return (NULL);
2590         }
2591         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2592         if (m_asconf == NULL) {
2593                 /* no mbuf's */
2594                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2595                     "compose_asconf: couldn't get mbuf!\n");
2596                 sctp_m_freem(m_asconf_chk);
2597                 return (NULL);
2598         }
2599         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2600         SCTP_BUF_LEN(m_asconf) = 0;
2601         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2602         bzero(acp, sizeof(struct sctp_asconf_chunk));
2603         /* save pointers to lookup address and asconf params */
2604         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2605         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2606
2607         /* fill in chunk header info */
2608         acp->ch.chunk_type = SCTP_ASCONF;
2609         acp->ch.chunk_flags = 0;
2610         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2611         stcb->asoc.asconf_seq_out++;
2612
2613         /* add parameters... up to smallest MTU allowed */
2614         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2615                 if (aa->sent)
2616                         continue;
2617                 /* get the parameter length */
2618                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2619                 /* will it fit in current chunk? */
2620                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2621                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2622                         /* won't fit, so we're done with this chunk */
2623                         break;
2624                 }
2625                 /* assign (and store) a correlation id */
2626                 aa->ap.aph.correlation_id = correlation_id++;
2627
2628                 /*
2629                  * fill in address if we're doing a delete this is a simple
2630                  * way for us to fill in the correlation address, which
2631                  * should only be used by the peer if we're deleting our
2632                  * source address and adding a new address (e.g. renumbering
2633                  * case)
2634                  */
2635                 if (lookup_used == 0 &&
2636                     (aa->special_del == 0) &&
2637                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2638                         struct sctp_ipv6addr_param *lookup;
2639                         uint16_t p_size, addr_size;
2640
2641                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2642                         lookup->ph.param_type =
2643                             htons(aa->ap.addrp.ph.param_type);
2644                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2645                                 /* copy IPv6 address */
2646                                 p_size = sizeof(struct sctp_ipv6addr_param);
2647                                 addr_size = sizeof(struct in6_addr);
2648                         } else {
2649                                 /* copy IPv4 address */
2650                                 p_size = sizeof(struct sctp_ipv4addr_param);
2651                                 addr_size = sizeof(struct in_addr);
2652                         }
2653                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2654                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2655                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2656                         lookup_used = 1;
2657                 }
2658                 /* copy into current space */
2659                 memcpy(ptr, &aa->ap, p_length);
2660
2661                 /* network elements and update lengths */
2662                 aph = (struct sctp_asconf_paramhdr *)ptr;
2663                 aap = (struct sctp_asconf_addr_param *)ptr;
2664                 /* correlation_id is transparent to peer, no htonl needed */
2665                 aph->ph.param_type = htons(aph->ph.param_type);
2666                 aph->ph.param_length = htons(aph->ph.param_length);
2667                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2668                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2669
2670                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2671                 ptr += SCTP_SIZE32(p_length);
2672
2673                 /*
2674                  * these params are removed off the pending list upon
2675                  * getting an ASCONF-ACK back from the peer, just set flag
2676                  */
2677                 aa->sent = 1;
2678         }
2679         /* check to see if the lookup addr has been populated yet */
2680         if (lookup_used == 0) {
2681                 /* NOTE: if the address param is optional, can skip this... */
2682                 /* add any valid (existing) address... */
2683                 struct sctp_ipv6addr_param *lookup;
2684                 uint16_t p_size, addr_size;
2685                 struct sockaddr *found_addr;
2686                 caddr_t addr_ptr;
2687
2688                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2689                         found_addr = sctp_find_valid_localaddr(stcb,
2690                             addr_locked);
2691                 else
2692                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2693
2694                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2695                 if (found_addr != NULL) {
2696                         switch (found_addr->sa_family) {
2697 #ifdef INET6
2698                         case AF_INET6:
2699                                 /* copy IPv6 address */
2700                                 lookup->ph.param_type =
2701                                     htons(SCTP_IPV6_ADDRESS);
2702                                 p_size = sizeof(struct sctp_ipv6addr_param);
2703                                 addr_size = sizeof(struct in6_addr);
2704                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2705                                     found_addr)->sin6_addr;
2706                                 break;
2707 #endif
2708 #ifdef INET
2709                         case AF_INET:
2710                                 /* copy IPv4 address */
2711                                 lookup->ph.param_type =
2712                                     htons(SCTP_IPV4_ADDRESS);
2713                                 p_size = sizeof(struct sctp_ipv4addr_param);
2714                                 addr_size = sizeof(struct in_addr);
2715                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2716                                     found_addr)->sin_addr;
2717                                 break;
2718 #endif
2719                         default:
2720                                 p_size = 0;
2721                                 addr_size = 0;
2722                                 addr_ptr = NULL;
2723                                 break;
2724                         }
2725                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2726                         memcpy(lookup->addr, addr_ptr, addr_size);
2727                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2728                 } else {
2729                         /* uh oh... don't have any address?? */
2730                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2731                             "compose_asconf: no lookup addr!\n");
2732                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2733                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2734                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2735                         bzero(lookup->addr, sizeof(struct in_addr));
2736                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2737                 }
2738         }
2739         /* chain it all together */
2740         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2741         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2742         acp->ch.chunk_length = htons(*retlen);
2743
2744         return (m_asconf_chk);
2745 }
2746
2747 /*
2748  * section to handle address changes before an association is up eg. changes
2749  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2750  */
2751
2752 /*
2753  * processes the (local) addresses in the INIT-ACK chunk
2754  */
2755 static void
2756 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2757     unsigned int offset, unsigned int length)
2758 {
2759         struct sctp_paramhdr tmp_param, *ph;
2760         uint16_t plen, ptype;
2761         struct sctp_ifa *sctp_ifa;
2762         union sctp_sockstore store;
2763
2764 #ifdef INET6
2765         struct sctp_ipv6addr_param addr6_store;
2766
2767 #endif
2768 #ifdef INET
2769         struct sctp_ipv4addr_param addr4_store;
2770
2771 #endif
2772
2773         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2774         if (stcb == NULL)       /* Un-needed check for SA */
2775                 return;
2776
2777         /* convert to upper bound */
2778         length += offset;
2779
2780         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2781                 return;
2782         }
2783         /* go through the addresses in the init-ack */
2784         ph = (struct sctp_paramhdr *)
2785             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2786             (uint8_t *) & tmp_param);
2787         while (ph != NULL) {
2788                 ptype = ntohs(ph->param_type);
2789                 plen = ntohs(ph->param_length);
2790                 switch (ptype) {
2791 #ifdef INET6
2792                 case SCTP_IPV6_ADDRESS:
2793                         {
2794                                 struct sctp_ipv6addr_param *a6p;
2795
2796                                 /* get the entire IPv6 address param */
2797                                 a6p = (struct sctp_ipv6addr_param *)
2798                                     sctp_m_getptr(m, offset,
2799                                     sizeof(struct sctp_ipv6addr_param),
2800                                     (uint8_t *) & addr6_store);
2801                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2802                                     a6p == NULL) {
2803                                         return;
2804                                 }
2805                                 memset(&store, 0, sizeof(union sctp_sockstore));
2806                                 store.sin6.sin6_family = AF_INET6;
2807                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2808                                 store.sin6.sin6_port = stcb->rport;
2809                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2810                                 break;
2811                         }
2812 #endif
2813 #ifdef INET
2814                 case SCTP_IPV4_ADDRESS:
2815                         {
2816                                 struct sctp_ipv4addr_param *a4p;
2817
2818                                 /* get the entire IPv4 address param */
2819                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2820                                     sizeof(struct sctp_ipv4addr_param),
2821                                     (uint8_t *) & addr4_store);
2822                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2823                                     a4p == NULL) {
2824                                         return;
2825                                 }
2826                                 memset(&store, 0, sizeof(union sctp_sockstore));
2827                                 store.sin.sin_family = AF_INET;
2828                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2829                                 store.sin.sin_port = stcb->rport;
2830                                 store.sin.sin_addr.s_addr = a4p->addr;
2831                                 break;
2832                         }
2833 #endif
2834                 default:
2835                         goto next_addr;
2836                 }
2837
2838                 /* see if this address really (still) exists */
2839                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2840                     SCTP_ADDR_NOT_LOCKED);
2841                 if (sctp_ifa == NULL) {
2842                         /* address doesn't exist anymore */
2843                         int status;
2844
2845                         /* are ASCONFs allowed ? */
2846                         if ((sctp_is_feature_on(stcb->sctp_ep,
2847                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2848                             stcb->asoc.asconf_supported) {
2849                                 /* queue an ASCONF DEL_IP_ADDRESS */
2850                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2851                                 /*
2852                                  * if queued ok, and in correct state, send
2853                                  * out the ASCONF.
2854                                  */
2855                                 if (status == 0 &&
2856                                     SCTP_GET_STATE(&stcb->asoc) ==
2857                                     SCTP_STATE_OPEN) {
2858 #ifdef SCTP_TIMER_BASED_ASCONF
2859                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2860                                             stcb->sctp_ep, stcb,
2861                                             stcb->asoc.primary_destination);
2862 #else
2863                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2864 #endif
2865                                 }
2866                         }
2867                 }
2868 next_addr:
2869                 /*
2870                  * Sanity check:  Make sure the length isn't 0, otherwise
2871                  * we'll be stuck in this loop for a long time...
2872                  */
2873                 if (SCTP_SIZE32(plen) == 0) {
2874                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2875                             plen, ptype);
2876                         return;
2877                 }
2878                 /* get next parameter */
2879                 offset += SCTP_SIZE32(plen);
2880                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2881                         return;
2882                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2883                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2884         }                       /* while */
2885 }
2886
2887 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2888 /*
2889  * checks to see if a specific address is in the initack address list returns
2890  * 1 if found, 0 if not
2891  */
2892 static uint32_t
2893 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2894 {
2895         struct sctp_paramhdr tmp_param, *ph;
2896         uint16_t plen, ptype;
2897
2898 #ifdef INET
2899         struct sockaddr_in *sin;
2900         struct sctp_ipv4addr_param *a4p;
2901         struct sctp_ipv6addr_param addr4_store;
2902
2903 #endif
2904 #ifdef INET6
2905         struct sockaddr_in6 *sin6;
2906         struct sctp_ipv6addr_param *a6p;
2907         struct sctp_ipv6addr_param addr6_store;
2908         struct sockaddr_in6 sin6_tmp;
2909
2910 #endif
2911
2912         switch (sa->sa_family) {
2913 #ifdef INET
2914         case AF_INET:
2915                 break;
2916 #endif
2917 #ifdef INET6
2918         case AF_INET6:
2919                 break;
2920 #endif
2921         default:
2922                 return (0);
2923         }
2924
2925         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2926         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2927         /* convert to upper bound */
2928         length += offset;
2929
2930         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2931                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2932                     "find_initack_addr: invalid offset?\n");
2933                 return (0);
2934         }
2935         /* go through the addresses in the init-ack */
2936         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2937             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2938         while (ph != NULL) {
2939                 ptype = ntohs(ph->param_type);
2940                 plen = ntohs(ph->param_length);
2941                 switch (ptype) {
2942 #ifdef INET6
2943                 case SCTP_IPV6_ADDRESS:
2944                         if (sa->sa_family == AF_INET6) {
2945                                 /* get the entire IPv6 address param */
2946                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2947                                         break;
2948                                 }
2949                                 /* get the entire IPv6 address param */
2950                                 a6p = (struct sctp_ipv6addr_param *)
2951                                     sctp_m_getptr(m, offset,
2952                                     sizeof(struct sctp_ipv6addr_param),
2953                                     (uint8_t *) & addr6_store);
2954                                 if (a6p == NULL) {
2955                                         return (0);
2956                                 }
2957                                 sin6 = (struct sockaddr_in6 *)sa;
2958                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2959                                         /* create a copy and clear scope */
2960                                         memcpy(&sin6_tmp, sin6,
2961                                             sizeof(struct sockaddr_in6));
2962                                         sin6 = &sin6_tmp;
2963                                         in6_clearscope(&sin6->sin6_addr);
2964                                 }
2965                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2966                                     sizeof(struct in6_addr)) == 0) {
2967                                         /* found it */
2968                                         return (1);
2969                                 }
2970                         }
2971                         break;
2972 #endif                          /* INET6 */
2973 #ifdef INET
2974                 case SCTP_IPV4_ADDRESS:
2975                         if (sa->sa_family == AF_INET) {
2976                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2977                                         break;
2978                                 }
2979                                 /* get the entire IPv4 address param */
2980                                 a4p = (struct sctp_ipv4addr_param *)
2981                                     sctp_m_getptr(m, offset,
2982                                     sizeof(struct sctp_ipv4addr_param),
2983                                     (uint8_t *) & addr4_store);
2984                                 if (a4p == NULL) {
2985                                         return (0);
2986                                 }
2987                                 sin = (struct sockaddr_in *)sa;
2988                                 if (sin->sin_addr.s_addr == a4p->addr) {
2989                                         /* found it */
2990                                         return (1);
2991                                 }
2992                         }
2993                         break;
2994 #endif
2995                 default:
2996                         break;
2997                 }
2998                 /* get next parameter */
2999                 offset += SCTP_SIZE32(plen);
3000                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3001                         return (0);
3002                 }
3003                 ph = (struct sctp_paramhdr *)
3004                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3005                     (uint8_t *) & tmp_param);
3006         }                       /* while */
3007         /* not found! */
3008         return (0);
3009 }
3010
3011 /*
3012  * makes sure that the current endpoint local addr list is consistent with
3013  * the new association (eg. subset bound, asconf allowed) adds addresses as
3014  * necessary
3015  */
3016 static void
3017 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3018     int length, struct sockaddr *init_addr)
3019 {
3020         struct sctp_laddr *laddr;
3021
3022         /* go through the endpoint list */
3023         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3024                 /* be paranoid and validate the laddr */
3025                 if (laddr->ifa == NULL) {
3026                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3027                             "check_addr_list_ep: laddr->ifa is NULL");
3028                         continue;
3029                 }
3030                 if (laddr->ifa == NULL) {
3031                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3032                         continue;
3033                 }
3034                 /* do i have it implicitly? */
3035                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3036                         continue;
3037                 }
3038                 /* check to see if in the init-ack */
3039                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3040                         /* try to add it */
3041                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3042                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3043                 }
3044         }
3045 }
3046
3047 /*
3048  * makes sure that the current kernel address list is consistent with the new
3049  * association (with all addrs bound) adds addresses as necessary
3050  */
3051 static void
3052 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3053     int length, struct sockaddr *init_addr,
3054     uint16_t local_scope, uint16_t site_scope,
3055     uint16_t ipv4_scope, uint16_t loopback_scope)
3056 {
3057         struct sctp_vrf *vrf = NULL;
3058         struct sctp_ifn *sctp_ifn;
3059         struct sctp_ifa *sctp_ifa;
3060         uint32_t vrf_id;
3061
3062 #ifdef INET
3063         struct sockaddr_in *sin;
3064
3065 #endif
3066 #ifdef INET6
3067         struct sockaddr_in6 *sin6;
3068
3069 #endif
3070
3071         if (stcb) {
3072                 vrf_id = stcb->asoc.vrf_id;
3073         } else {
3074                 return;
3075         }
3076         SCTP_IPI_ADDR_RLOCK();
3077         vrf = sctp_find_vrf(vrf_id);
3078         if (vrf == NULL) {
3079                 SCTP_IPI_ADDR_RUNLOCK();
3080                 return;
3081         }
3082         /* go through all our known interfaces */
3083         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3084                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3085                         /* skip loopback interface */
3086                         continue;
3087                 }
3088                 /* go through each interface address */
3089                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3090                         /* do i have it implicitly? */
3091                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3092                                 continue;
3093                         }
3094                         switch (sctp_ifa->address.sa.sa_family) {
3095 #ifdef INET
3096                         case AF_INET:
3097                                 sin = &sctp_ifa->address.sin;
3098                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3099                                     &sin->sin_addr) != 0) {
3100                                         continue;
3101                                 }
3102                                 if ((ipv4_scope == 0) &&
3103                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3104                                         /* private address not in scope */
3105                                         continue;
3106                                 }
3107                                 break;
3108 #endif
3109 #ifdef INET6
3110                         case AF_INET6:
3111                                 sin6 = &sctp_ifa->address.sin6;
3112                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3113                                     &sin6->sin6_addr) != 0) {
3114                                         continue;
3115                                 }
3116                                 if ((local_scope == 0) &&
3117                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3118                                         continue;
3119                                 }
3120                                 if ((site_scope == 0) &&
3121                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3122                                         continue;
3123                                 }
3124                                 break;
3125 #endif
3126                         default:
3127                                 break;
3128                         }
3129                         /* check to see if in the init-ack */
3130                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3131                                 /* try to add it */
3132                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3133                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3134                                     SCTP_ADDR_LOCKED);
3135                         }
3136                 }               /* end foreach ifa */
3137         }                       /* end foreach ifn */
3138         SCTP_IPI_ADDR_RUNLOCK();
3139 }
3140
3141 /*
3142  * validates an init-ack chunk (from a cookie-echo) with current addresses
3143  * adds addresses from the init-ack into our local address list, if needed
3144  * queues asconf adds/deletes addresses as needed and makes appropriate list
3145  * changes for source address selection m, offset: points to the start of the
3146  * address list in an init-ack chunk length: total length of the address
3147  * params only init_addr: address where my INIT-ACK was sent from
3148  */
3149 void
3150 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3151     int length, struct sockaddr *init_addr,
3152     uint16_t local_scope, uint16_t site_scope,
3153     uint16_t ipv4_scope, uint16_t loopback_scope)
3154 {
3155         /* process the local addresses in the initack */
3156         sctp_process_initack_addresses(stcb, m, offset, length);
3157
3158         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3159                 /* bound all case */
3160                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3161                     local_scope, site_scope, ipv4_scope, loopback_scope);
3162         } else {
3163                 /* subset bound case */
3164                 if (sctp_is_feature_on(stcb->sctp_ep,
3165                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3166                         /* asconf's allowed */
3167                         sctp_check_address_list_ep(stcb, m, offset, length,
3168                             init_addr);
3169                 }
3170                 /* else, no asconfs allowed, so what we sent is what we get */
3171         }
3172 }
3173
3174 /*
3175  * sctp_bindx() support
3176  */
3177 uint32_t
3178 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3179     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3180 {
3181         struct sctp_ifa *ifa;
3182         struct sctp_laddr *laddr, *nladdr;
3183
3184         if (sa->sa_len == 0) {
3185                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3186                 return (EINVAL);
3187         }
3188         if (sctp_ifap) {
3189                 ifa = sctp_ifap;
3190         } else if (type == SCTP_ADD_IP_ADDRESS) {
3191                 /* For an add the address MUST be on the system */
3192                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3193         } else if (type == SCTP_DEL_IP_ADDRESS) {
3194                 /* For a delete we need to find it in the inp */
3195                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3196         } else {
3197                 ifa = NULL;
3198         }
3199         if (ifa != NULL) {
3200                 if (type == SCTP_ADD_IP_ADDRESS) {
3201                         sctp_add_local_addr_ep(inp, ifa, type);
3202                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3203                         if (inp->laddr_count < 2) {
3204                                 /* can't delete the last local address */
3205                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3206                                 return (EINVAL);
3207                         }
3208                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3209                             sctp_nxt_addr) {
3210                                 if (ifa == laddr->ifa) {
3211                                         /* Mark in the delete */
3212                                         laddr->action = type;
3213                                 }
3214                         }
3215                 }
3216                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3217                         /*
3218                          * There is no need to start the iterator if the inp
3219                          * has no associations.
3220                          */
3221                         if (type == SCTP_DEL_IP_ADDRESS) {
3222                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3223                                         if (laddr->ifa == ifa) {
3224                                                 sctp_del_local_addr_ep(inp, ifa);
3225                                         }
3226                                 }
3227                         }
3228                 } else {
3229                         struct sctp_asconf_iterator *asc;
3230                         struct sctp_laddr *wi;
3231
3232                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3233                             sizeof(struct sctp_asconf_iterator),
3234                             SCTP_M_ASC_IT);
3235                         if (asc == NULL) {
3236                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3237                                 return (ENOMEM);
3238                         }
3239                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3240                         if (wi == NULL) {
3241                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3242                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3243                                 return (ENOMEM);
3244                         }
3245                         LIST_INIT(&asc->list_of_work);
3246                         asc->cnt = 1;
3247                         SCTP_INCR_LADDR_COUNT();
3248                         wi->ifa = ifa;
3249                         wi->action = type;
3250                         atomic_add_int(&ifa->refcount, 1);
3251                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3252                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3253                             sctp_asconf_iterator_stcb,
3254                             sctp_asconf_iterator_ep_end,
3255                             SCTP_PCB_ANY_FLAGS,
3256                             SCTP_PCB_ANY_FEATURES,
3257                             SCTP_ASOC_ANY_STATE,
3258                             (void *)asc, 0,
3259                             sctp_asconf_iterator_end, inp, 0);
3260                 }
3261                 return (0);
3262         } else {
3263                 /* invalid address! */
3264                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3265                 return (EADDRNOTAVAIL);
3266         }
3267 }
3268
3269 void
3270 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3271     struct sctp_nets *net)
3272 {
3273         struct sctp_asconf_addr *aa;
3274         struct sctp_ifa *sctp_ifap;
3275         struct sctp_asconf_tag_param *vtag;
3276
3277 #ifdef INET
3278         struct sockaddr_in *to;
3279
3280 #endif
3281 #ifdef INET6
3282         struct sockaddr_in6 *to6;
3283
3284 #endif
3285         if (net == NULL) {
3286                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3287                 return;
3288         }
3289         if (stcb == NULL) {
3290                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3291                 return;
3292         }
3293         /*
3294          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3295          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3296          */
3297         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3298             SCTP_M_ASC_ADDR);
3299         if (aa == NULL) {
3300                 /* didn't get memory */
3301                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3302                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3303                 return;
3304         }
3305         aa->special_del = 0;
3306         /* fill in asconf address parameter fields */
3307         /* top level elements are "networked" during send */
3308         aa->ifa = NULL;
3309         aa->sent = 0;           /* clear sent flag */
3310         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3311         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3312         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3313         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3314         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3315         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3316
3317         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3318             SCTP_M_ASC_ADDR);
3319         if (aa == NULL) {
3320                 /* didn't get memory */
3321                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3322                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3323                 return;
3324         }
3325         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3326         /* fill in asconf address parameter fields */
3327         /* ADD(0.0.0.0) */
3328         switch (net->ro._l_addr.sa.sa_family) {
3329 #ifdef INET
3330         case AF_INET:
3331                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3332                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3333                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3334                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3335                 /* No need to add an address, we are using 0.0.0.0 */
3336                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3337                 break;
3338 #endif
3339 #ifdef INET6
3340         case AF_INET6:
3341                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3342                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3343                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3344                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3345                 /* No need to add an address, we are using 0.0.0.0 */
3346                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3347                 break;
3348 #endif
3349         default:
3350                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3351                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3352                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3353                 return;
3354         }
3355         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3356             SCTP_M_ASC_ADDR);
3357         if (aa == NULL) {
3358                 /* didn't get memory */
3359                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3360                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3361                 return;
3362         }
3363         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3364         /* fill in asconf address parameter fields */
3365         /* ADD(0.0.0.0) */
3366         switch (net->ro._l_addr.sa.sa_family) {
3367 #ifdef INET
3368         case AF_INET:
3369                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3370                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3371                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3372                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3373                 /* No need to add an address, we are using 0.0.0.0 */
3374                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3375                 break;
3376 #endif
3377 #ifdef INET6
3378         case AF_INET6:
3379                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3380                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3381                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3382                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3383                 /* No need to add an address, we are using 0.0.0.0 */
3384                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3385                 break;
3386 #endif
3387         default:
3388                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3389                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3390                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3391                 return;
3392         }
3393         /* Now we must hunt the addresses and add all global addresses */
3394         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3395                 struct sctp_vrf *vrf = NULL;
3396                 struct sctp_ifn *sctp_ifnp;
3397                 uint32_t vrf_id;
3398
3399                 vrf_id = stcb->sctp_ep->def_vrf_id;
3400                 vrf = sctp_find_vrf(vrf_id);
3401                 if (vrf == NULL) {
3402                         goto skip_rest;
3403                 }
3404                 SCTP_IPI_ADDR_RLOCK();
3405                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3406                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3407                                 switch (sctp_ifap->address.sa.sa_family) {
3408 #ifdef INET
3409                                 case AF_INET:
3410                                         to = &sctp_ifap->address.sin;
3411                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3412                                             &to->sin_addr) != 0) {
3413                                                 continue;
3414                                         }
3415                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3416                                                 continue;
3417                                         }
3418                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3419                                                 continue;
3420                                         }
3421                                         break;
3422 #endif
3423 #ifdef INET6
3424                                 case AF_INET6:
3425                                         to6 = &sctp_ifap->address.sin6;
3426                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3427                                             &to6->sin6_addr) != 0) {
3428                                                 continue;
3429                                         }
3430                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3431                                                 continue;
3432                                         }
3433                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3434                                                 continue;
3435                                         }
3436                                         break;
3437 #endif
3438                                 default:
3439                                         continue;
3440                                 }
3441                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3442                         }
3443                 }
3444                 SCTP_IPI_ADDR_RUNLOCK();
3445         } else {
3446                 struct sctp_laddr *laddr;
3447
3448                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3449                         if (laddr->ifa == NULL) {
3450                                 continue;
3451                         }
3452                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3453                                 /*
3454                                  * Address being deleted by the system, dont
3455                                  * list.
3456                                  */
3457                                 continue;
3458                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3459                                 /*
3460                                  * Address being deleted on this ep don't
3461                                  * list.
3462                                  */
3463                                 continue;
3464                         }
3465                         sctp_ifap = laddr->ifa;
3466                         switch (sctp_ifap->address.sa.sa_family) {
3467 #ifdef INET
3468                         case AF_INET:
3469                                 to = &sctp_ifap->address.sin;
3470                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3471                                         continue;
3472                                 }
3473                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3474                                         continue;
3475                                 }
3476                                 break;
3477 #endif
3478 #ifdef INET6
3479                         case AF_INET6:
3480                                 to6 = &sctp_ifap->address.sin6;
3481                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3482                                         continue;
3483                                 }
3484                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3485                                         continue;
3486                                 }
3487                                 break;
3488 #endif
3489                         default:
3490                                 continue;
3491                         }
3492                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3493                 }
3494         }
3495 skip_rest:
3496         /* Now we must send the asconf into the queue */
3497         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3498 }