sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_asconf.c,v 1.24 2005/03/06 16:04:16 itojun Exp $  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35 #include <netinet/sctp_os.h>
  36 #include <netinet/sctp_var.h>
  37 #include <netinet/sctp_sysctl.h>
  38 #include <netinet/sctp_pcb.h>
  39 #include <netinet/sctp_header.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_output.h>
  42 #include <netinet/sctp_asconf.h>
  43 #include <netinet/sctp_timer.h>
  44
  45 /*
  46  * debug flags:
  47  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  48  * SCTP_DEBUG_ASCONF2: detailed info
  49  */
  50 #ifdef SCTP_DEBUG
  51 #endif                          /* SCTP_DEBUG */
  52
  53
  54 static void
  55 sctp_asconf_get_source_ip(struct mbuf *m, struct sockaddr *sa)
  56 {
  57         struct ip *iph;
  58         struct sockaddr_in *sin;
  59
  60 #ifdef INET6
  61         struct sockaddr_in6 *sin6;
  62
  63 #endif
  64
  65         iph = mtod(m, struct ip *);
  66         if (iph->ip_v == IPVERSION) {
  67                 /* IPv4 source */
  68                 sin = (struct sockaddr_in *)sa;
  69                 bzero(sin, sizeof(*sin));
  70                 sin->sin_family = AF_INET;
  71                 sin->sin_len = sizeof(struct sockaddr_in);
  72                 sin->sin_port = 0;
  73                 sin->sin_addr.s_addr = iph->ip_src.s_addr;
  74                 return;
  75         }
  76 #ifdef INET6
  77         else if (iph->ip_v == (IPV6_VERSION >> 4)) {
  78                 /* IPv6 source */
  79                 struct ip6_hdr *ip6;
  80
  81                 sin6 = (struct sockaddr_in6 *)sa;
  82                 bzero(sin6, sizeof(*sin6));
  83                 sin6->sin6_family = AF_INET6;
  84                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  85                 sin6->sin6_port = 0;
  86                 ip6 = mtod(m, struct ip6_hdr *);
  87                 sin6->sin6_addr = ip6->ip6_src;
  88                 return;
  89         }
  90 #endif                          /* INET6 */
  91         else
  92                 return;
  93 }
  94
  95 /*
  96  * draft-ietf-tsvwg-addip-sctp
  97  *
  98  * An ASCONF parameter queue exists per asoc which holds the pending address
  99  * operations.  Lists are updated upon receipt of ASCONF-ACK.
 100  *
 101  * A restricted_addrs list exists per assoc to hold local addresses that are
 102  * not (yet) usable by the assoc as a source address.  These addresses are
 103  * either pending an ASCONF operation (and exist on the ASCONF parameter
 104  * queue), or they are permanently restricted (the peer has returned an
 105  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
 106  *
 107  * Deleted addresses are always immediately removed from the lists as they will
 108  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
 109  * only if allowed.
 110  */
 111
 112 /*
 113  * ASCONF parameter processing.
 114  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
 115  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
 116  * FIX: allocating this many mbufs on the fly is pretty inefficient...
 117  */
 118 static struct mbuf *
 119 sctp_asconf_success_response(uint32_t id)
 120 {
 121         struct mbuf *m_reply = NULL;
 122         struct sctp_asconf_paramhdr *aph;
 123
 124         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
 125             0, M_DONTWAIT, 1, MT_DATA);
 126         if (m_reply == NULL) {
 127                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 128                     "asconf_success_response: couldn't get mbuf!\n");
 129                 return NULL;
 130         }
 131         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 132         aph->correlation_id = id;
 133         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
 134         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
 135         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 136         aph->ph.param_length = htons(aph->ph.param_length);
 137
 138         return m_reply;
 139 }
 140
 141 static struct mbuf *
 142 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 143     uint16_t tlv_length)
 144 {
 145         struct mbuf *m_reply = NULL;
 146         struct sctp_asconf_paramhdr *aph;
 147         struct sctp_error_cause *error;
 148         uint8_t *tlv;
 149
 150         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 151             tlv_length +
 152             sizeof(struct sctp_error_cause)),
 153             0, M_DONTWAIT, 1, MT_DATA);
 154         if (m_reply == NULL) {
 155                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 156                     "asconf_error_response: couldn't get mbuf!\n");
 157                 return NULL;
 158         }
 159         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 160         error = (struct sctp_error_cause *)(aph + 1);
 161
 162         aph->correlation_id = id;
 163         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 164         error->code = htons(cause);
 165         error->length = tlv_length + sizeof(struct sctp_error_cause);
 166         aph->ph.param_length = error->length +
 167             sizeof(struct sctp_asconf_paramhdr);
 168
 169         if (aph->ph.param_length > MLEN) {
 170                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 171                     "asconf_error_response: tlv_length (%xh) too big\n",
 172                     tlv_length);
 173                 sctp_m_freem(m_reply);  /* discard */
 174                 return NULL;
 175         }
 176         if (error_tlv != NULL) {
 177                 tlv = (uint8_t *) (error + 1);
 178                 memcpy(tlv, error_tlv, tlv_length);
 179         }
 180         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 181         error->length = htons(error->length);
 182         aph->ph.param_length = htons(aph->ph.param_length);
 183
 184         return m_reply;
 185 }
 186
 187 static struct mbuf *
 188 sctp_process_asconf_add_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 189     struct sctp_tcb *stcb, int response_required)
 190 {
 191         struct mbuf *m_reply = NULL;
 192         struct sockaddr_storage sa_source, sa_store;
 193         struct sctp_ipv4addr_param *v4addr;
 194         uint16_t param_type, param_length, aparam_length;
 195         struct sockaddr *sa;
 196         struct sockaddr_in *sin;
 197         int zero_address = 0;
 198
 199 #ifdef INET6
 200         struct sockaddr_in6 *sin6;
 201         struct sctp_ipv6addr_param *v6addr;
 202
 203 #endif                          /* INET6 */
 204
 205         aparam_length = ntohs(aph->ph.param_length);
 206         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 207 #ifdef INET6
 208         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 209 #endif                          /* INET6 */
 210         param_type = ntohs(v4addr->ph.param_type);
 211         param_length = ntohs(v4addr->ph.param_length);
 212
 213         sa = (struct sockaddr *)&sa_store;
 214         switch (param_type) {
 215         case SCTP_IPV4_ADDRESS:
 216                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 217                         /* invalid param size */
 218                         return NULL;
 219                 }
 220                 sin = (struct sockaddr_in *)&sa_store;
 221                 bzero(sin, sizeof(*sin));
 222                 sin->sin_family = AF_INET;
 223                 sin->sin_len = sizeof(struct sockaddr_in);
 224                 sin->sin_port = stcb->rport;
 225                 sin->sin_addr.s_addr = v4addr->addr;
 226                 if (sin->sin_addr.s_addr == INADDR_ANY)
 227                         zero_address = 1;
 228                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 229                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 230                 break;
 231         case SCTP_IPV6_ADDRESS:
 232 #ifdef INET6
 233                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 234                         /* invalid param size */
 235                         return NULL;
 236                 }
 237                 sin6 = (struct sockaddr_in6 *)&sa_store;
 238                 bzero(sin6, sizeof(*sin6));
 239                 sin6->sin6_family = AF_INET6;
 240                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 241                 sin6->sin6_port = stcb->rport;
 242                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 243                     sizeof(struct in6_addr));
 244                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 245                         zero_address = 1;
 246                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 247                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 248 #else
 249                 /* IPv6 not enabled! */
 250                 /* FIX ME: currently sends back an invalid param error */
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph, aparam_length);
 253                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 254                     "process_asconf_add_ip: v6 disabled- skipping ");
 255                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 256                 return m_reply;
 257 #endif
 258                 break;
 259         default:
 260                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 261                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 262                     aparam_length);
 263                 return m_reply;
 264         }                       /* end switch */
 265
 266         /* if 0.0.0.0/::0, add the source address instead */
 267         if (zero_address && sctp_nat_friendly) {
 268                 sa = (struct sockaddr *)&sa_source;
 269                 sctp_asconf_get_source_ip(m, sa);
 270                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 271                     "process_asconf_add_ip: using source addr ");
 272                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 273         }
 274         /* add the address */
 275         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE,
 276             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 277                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 278                     "process_asconf_add_ip: error adding address\n");
 279                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 280                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 281                     aparam_length);
 282         } else {
 283                 /* notify upper layer */
 284                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 285                 if (response_required) {
 286                         m_reply =
 287                             sctp_asconf_success_response(aph->correlation_id);
 288                 }
 289                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
 290                     NULL, SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 291                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 292                     stcb, NULL);
 293         }
 294
 295         return m_reply;
 296 }
 297
 298 static int
 299 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 300 {
 301         struct sctp_nets *src_net, *net;
 302
 303         /* make sure the source address exists as a destination net */
 304         src_net = sctp_findnet(stcb, src);
 305         if (src_net == NULL) {
 306                 /* not found */
 307                 return -1;
 308         }
 309         /* delete all destination addresses except the source */
 310         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 311                 if (net != src_net) {
 312                         /* delete this address */
 313                         sctp_remove_net(stcb, net);
 314                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 315                             "asconf_del_remote_addrs_except: deleting ");
 316                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 317                             (struct sockaddr *)&net->ro._l_addr);
 318                         /* notify upper layer */
 319                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 320                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 321                 }
 322         }
 323         return 0;
 324 }
 325
 326 static struct mbuf *
 327 sctp_process_asconf_delete_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 328     struct sctp_tcb *stcb, int response_required)
 329 {
 330         struct mbuf *m_reply = NULL;
 331         struct sockaddr_storage sa_source, sa_store;
 332         struct sctp_ipv4addr_param *v4addr;
 333         uint16_t param_type, param_length, aparam_length;
 334         struct sockaddr *sa;
 335         struct sockaddr_in *sin;
 336         int zero_address = 0;
 337         int result;
 338
 339 #ifdef INET6
 340         struct sockaddr_in6 *sin6;
 341         struct sctp_ipv6addr_param *v6addr;
 342
 343 #endif                          /* INET6 */
 344
 345         /* get the source IP address for src and 0.0.0.0/::0 delete checks */
 346         sctp_asconf_get_source_ip(m, (struct sockaddr *)&sa_source);
 347
 348         aparam_length = ntohs(aph->ph.param_length);
 349         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 350 #ifdef INET6
 351         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 352 #endif                          /* INET6 */
 353         param_type = ntohs(v4addr->ph.param_type);
 354         param_length = ntohs(v4addr->ph.param_length);
 355
 356         sa = (struct sockaddr *)&sa_store;
 357         switch (param_type) {
 358         case SCTP_IPV4_ADDRESS:
 359                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 360                         /* invalid param size */
 361                         return NULL;
 362                 }
 363                 sin = (struct sockaddr_in *)&sa_store;
 364                 bzero(sin, sizeof(*sin));
 365                 sin->sin_family = AF_INET;
 366                 sin->sin_len = sizeof(struct sockaddr_in);
 367                 sin->sin_port = stcb->rport;
 368                 sin->sin_addr.s_addr = v4addr->addr;
 369                 if (sin->sin_addr.s_addr == INADDR_ANY)
 370                         zero_address = 1;
 371                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 372                     "process_asconf_delete_ip: deleting ");
 373                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 374                 break;
 375         case SCTP_IPV6_ADDRESS:
 376                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 377                         /* invalid param size */
 378                         return NULL;
 379                 }
 380 #ifdef INET6
 381                 sin6 = (struct sockaddr_in6 *)&sa_store;
 382                 bzero(sin6, sizeof(*sin6));
 383                 sin6->sin6_family = AF_INET6;
 384                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 385                 sin6->sin6_port = stcb->rport;
 386                 memcpy(&sin6->sin6_addr, v6addr->addr,
 387                     sizeof(struct in6_addr));
 388                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 389                         zero_address = 1;
 390                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 391                     "process_asconf_delete_ip: deleting ");
 392                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 393 #else
 394                 /* IPv6 not enabled!  No "action" needed; just ack it */
 395                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 396                     "process_asconf_delete_ip: v6 disabled- ignoring: ");
 397                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 398                 /* just respond with a "success" ASCONF-ACK */
 399                 return NULL;
 400 #endif
 401                 break;
 402         default:
 403                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 404                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 405                     aparam_length);
 406                 return m_reply;
 407         }
 408
 409         /* make sure the source address is not being deleted */
 410         if (sctp_cmpaddr(sa, (struct sockaddr *)&sa_source)) {
 411                 /* trying to delete the source address! */
 412                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 413                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 414                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 415                     aparam_length);
 416                 return m_reply;
 417         }
 418         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 419         if (zero_address && sctp_nat_friendly) {
 420                 result = sctp_asconf_del_remote_addrs_except(stcb,
 421                     (struct sockaddr *)&sa_source);
 422
 423                 if (result) {
 424                         /* src address did not exist? */
 425                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 426                         /* what error to reply with?? */
 427                         m_reply =
 428                             sctp_asconf_error_response(aph->correlation_id,
 429                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 430                             aparam_length);
 431                 } else if (response_required) {
 432                         m_reply =
 433                             sctp_asconf_success_response(aph->correlation_id);
 434                 }
 435                 return m_reply;
 436         }
 437         /* delete the address */
 438         result = sctp_del_remote_addr(stcb, sa);
 439         /*
 440          * note if result == -2, the address doesn't exist in the asoc but
 441          * since it's being deleted anyways, we just ack the delete -- but
 442          * this probably means something has already gone awry
 443          */
 444         if (result == -1) {
 445                 /* only one address in the asoc */
 446                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 447                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 448                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 449                     aparam_length);
 450         } else {
 451                 if (response_required) {
 452                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 453                 }
 454                 /* notify upper layer */
 455                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 456         }
 457         return m_reply;
 458 }
 459
 460 static struct mbuf *
 461 sctp_process_asconf_set_primary(struct mbuf *m,
 462     struct sctp_asconf_paramhdr *aph,
 463     struct sctp_tcb *stcb, int response_required)
 464 {
 465         struct mbuf *m_reply = NULL;
 466         struct sockaddr_storage sa_source, sa_store;
 467         struct sctp_ipv4addr_param *v4addr;
 468         uint16_t param_type, param_length, aparam_length;
 469         struct sockaddr *sa;
 470         struct sockaddr_in *sin;
 471         int zero_address = 0;
 472
 473 #ifdef INET6
 474         struct sockaddr_in6 *sin6;
 475         struct sctp_ipv6addr_param *v6addr;
 476
 477 #endif                          /* INET6 */
 478
 479         aparam_length = ntohs(aph->ph.param_length);
 480         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 481 #ifdef INET6
 482         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 483 #endif                          /* INET6 */
 484         param_type = ntohs(v4addr->ph.param_type);
 485         param_length = ntohs(v4addr->ph.param_length);
 486
 487         sa = (struct sockaddr *)&sa_store;
 488         switch (param_type) {
 489         case SCTP_IPV4_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 491                         /* invalid param size */
 492                         return NULL;
 493                 }
 494                 sin = (struct sockaddr_in *)&sa_store;
 495                 bzero(sin, sizeof(*sin));
 496                 sin->sin_family = AF_INET;
 497                 sin->sin_len = sizeof(struct sockaddr_in);
 498                 sin->sin_addr.s_addr = v4addr->addr;
 499                 if (sin->sin_addr.s_addr == INADDR_ANY)
 500                         zero_address = 1;
 501                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 502                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 503                 break;
 504         case SCTP_IPV6_ADDRESS:
 505                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 506                         /* invalid param size */
 507                         return NULL;
 508                 }
 509 #ifdef INET6
 510                 sin6 = (struct sockaddr_in6 *)&sa_store;
 511                 bzero(sin6, sizeof(*sin6));
 512                 sin6->sin6_family = AF_INET6;
 513                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 514                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 515                     sizeof(struct in6_addr));
 516                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 517                         zero_address = 1;
 518                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 520 #else
 521                 /* IPv6 not enabled!  No "action" needed; just ack it */
 522                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 523                     "process_asconf_set_primary: v6 disabled- ignoring: ");
 524                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 525                 /* just respond with a "success" ASCONF-ACK */
 526                 return NULL;
 527 #endif
 528                 break;
 529         default:
 530                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 531                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 532                     aparam_length);
 533                 return m_reply;
 534         }
 535
 536         /* if 0.0.0.0/::0, use the source address instead */
 537         if (zero_address && sctp_nat_friendly) {
 538                 sa = (struct sockaddr *)&sa_source;
 539                 sctp_asconf_get_source_ip(m, sa);
 540                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 541                     "process_asconf_set_primary: using source addr ");
 542                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 543         }
 544         /* set the primary address */
 545         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 546                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 547                     "process_asconf_set_primary: primary address set\n");
 548                 /* notify upper layer */
 549                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 550
 551                 if (response_required) {
 552                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 553                 }
 554                 /*
 555                  * Mobility adaptation. Ideally, when the reception of SET
 556                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 557                  * destination, unacknowledged DATA are retransmitted
 558                  * immediately to the new primary destination for seamless
 559                  * handover.  If the destination is UNCONFIRMED and marked
 560                  * to REQ_PRIM, The retransmission occur when reception of
 561                  * the HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 562                  * sctp_input.c) Also, when change of the primary
 563                  * destination, it is better that all subsequent new DATA
 564                  * containing already queued DATA are transmitted to the new
 565                  * primary destination. (by micchie)
 566                  */
 567                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 568                     SCTP_MOBILITY_BASE) ||
 569                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 570                     SCTP_MOBILITY_FASTHANDOFF)) &&
 571                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 572                     SCTP_MOBILITY_PRIM_DELETED) &&
 573                     (stcb->asoc.primary_destination->dest_state &
 574                     SCTP_ADDR_UNCONFIRMED) == 0) {
 575
 576                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 577                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 578                             SCTP_MOBILITY_FASTHANDOFF)) {
 579                                 sctp_assoc_immediate_retrans(stcb,
 580                                     stcb->asoc.primary_destination);
 581                         }
 582                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 583                             SCTP_MOBILITY_BASE)) {
 584                                 sctp_move_chunks_from_deleted_prim(stcb,
 585                                     stcb->asoc.primary_destination);
 586                         }
 587                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 588                             stcb->asoc.deleted_primary);
 589                 }
 590         } else {
 591                 /* couldn't set the requested primary address! */
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "process_asconf_set_primary: set primary failed!\n");
 594                 /* must have been an invalid address, so report */
 595                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 596                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 597                     aparam_length);
 598         }
 599
 600         return m_reply;
 601 }
 602
 603 /*
 604  * handles an ASCONF chunk.
 605  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 606  */
 607 void
 608 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 609     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 610     int first)
 611 {
 612         struct sctp_association *asoc;
 613         uint32_t serial_num;
 614         struct mbuf *n, *m_ack, *m_result, *m_tail;
 615         struct sctp_asconf_ack_chunk *ack_cp;
 616         struct sctp_asconf_paramhdr *aph, *ack_aph;
 617         struct sctp_ipv6addr_param *p_addr;
 618         unsigned int asconf_limit;
 619         int error = 0;          /* did an error occur? */
 620
 621         /* asconf param buffer */
 622         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 623         struct sctp_asconf_ack *ack, *ack_next;
 624
 625         /* verify minimum length */
 626         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 627                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 628                     "handle_asconf: chunk too small = %xh\n",
 629                     ntohs(cp->ch.chunk_length));
 630                 return;
 631         }
 632         asoc = &stcb->asoc;
 633         serial_num = ntohl(cp->serial_number);
 634
 635         if (compare_with_wrap(asoc->asconf_seq_in, serial_num, MAX_SEQ) ||
 636             serial_num == asoc->asconf_seq_in) {
 637                 /* got a duplicate ASCONF */
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: got duplicate serial number = %xh\n",
 640                     serial_num);
 641                 return;
 642         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 643                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 644                     serial_num, asoc->asconf_seq_in + 1);
 645                 return;
 646         }
 647         /* it's the expected "next" sequence number, so process it */
 648         asoc->asconf_seq_in = serial_num;       /* update sequence */
 649         /* get length of all the param's in the ASCONF */
 650         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 651         SCTPDBG(SCTP_DEBUG_ASCONF1,
 652             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 653             asconf_limit, serial_num);
 654
 655         if (first) {
 656                 /* delete old cache */
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing firstASCONF. Try to delte old cache\n");
 658
 659                 ack = TAILQ_FIRST(&stcb->asoc.asconf_ack_sent);
 660                 while (ack != NULL) {
 661                         ack_next = TAILQ_NEXT(ack, next);
 662                         if (ack->serial_number == serial_num)
 663                                 break;
 664                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 665                             ack->serial_number, serial_num);
 666                         TAILQ_REMOVE(&stcb->asoc.asconf_ack_sent, ack, next);
 667                         if (ack->data != NULL) {
 668                                 sctp_m_freem(ack->data);
 669                         }
 670                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asconf_ack, ack);
 671                         ack = ack_next;
 672                 }
 673         }
 674         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 675             M_DONTWAIT, 1, MT_DATA);
 676         if (m_ack == NULL) {
 677                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 678                     "handle_asconf: couldn't get mbuf!\n");
 679                 return;
 680         }
 681         m_tail = m_ack;         /* current reply chain's tail */
 682
 683         /* fill in ASCONF-ACK header */
 684         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 685         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 686         ack_cp->ch.chunk_flags = 0;
 687         ack_cp->serial_number = htonl(serial_num);
 688         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 689         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 690         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 691
 692         /* skip the lookup address parameter */
 693         offset += sizeof(struct sctp_asconf_chunk);
 694         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 695         if (p_addr == NULL) {
 696                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 697                     "handle_asconf: couldn't get lookup addr!\n");
 698                 /* respond with a missing/invalid mandatory parameter error */
 699                 return;
 700         }
 701         /* param_length is already validated in process_control... */
 702         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 703
 704         /* get pointer to first asconf param in ASCONF-ACK */
 705         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 706         if (ack_aph == NULL) {
 707                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 708                 return;
 709         }
 710         /* get pointer to first asconf param in ASCONF */
 711         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 712         if (aph == NULL) {
 713                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 714                 goto send_reply;
 715         }
 716         /* process through all parameters */
 717         while (aph != NULL) {
 718                 unsigned int param_length, param_type;
 719
 720                 param_type = ntohs(aph->ph.param_type);
 721                 param_length = ntohs(aph->ph.param_length);
 722                 if (offset + param_length > asconf_limit) {
 723                         /* parameter goes beyond end of chunk! */
 724                         sctp_m_freem(m_ack);
 725                         return;
 726                 }
 727                 m_result = NULL;
 728
 729                 if (param_length > sizeof(aparam_buf)) {
 730                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 731                         sctp_m_freem(m_ack);
 732                         return;
 733                 }
 734                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 735                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 736                         sctp_m_freem(m_ack);
 737                 }
 738                 /* get the entire parameter */
 739                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 740                 if (aph == NULL) {
 741                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 742                         sctp_m_freem(m_ack);
 743                         return;
 744                 }
 745                 switch (param_type) {
 746                 case SCTP_ADD_IP_ADDRESS:
 747                         asoc->peer_supports_asconf = 1;
 748                         m_result = sctp_process_asconf_add_ip(m, aph, stcb,
 749                             error);
 750                         break;
 751                 case SCTP_DEL_IP_ADDRESS:
 752                         asoc->peer_supports_asconf = 1;
 753                         m_result = sctp_process_asconf_delete_ip(m, aph, stcb,
 754                             error);
 755                         break;
 756                 case SCTP_ERROR_CAUSE_IND:
 757                         /* not valid in an ASCONF chunk */
 758                         break;
 759                 case SCTP_SET_PRIM_ADDR:
 760                         asoc->peer_supports_asconf = 1;
 761                         m_result = sctp_process_asconf_set_primary(m, aph,
 762                             stcb, error);
 763                         break;
 764                 case SCTP_SUCCESS_REPORT:
 765                         /* not valid in an ASCONF chunk */
 766                         break;
 767                 case SCTP_ULP_ADAPTATION:
 768                         /* FIX */
 769                         break;
 770                 default:
 771                         if ((param_type & 0x8000) == 0) {
 772                                 /* Been told to STOP at this param */
 773                                 asconf_limit = offset;
 774                                 /*
 775                                  * FIX FIX - We need to call
 776                                  * sctp_arethere_unrecognized_parameters()
 777                                  * to get a operr and send it for any
 778                                  * param's with the 0x4000 bit set OR do it
 779                                  * here ourselves... note we still must STOP
 780                                  * if the 0x8000 bit is clear.
 781                                  */
 782                         }
 783                         /* unknown/invalid param type */
 784                         break;
 785                 }               /* switch */
 786
 787                 /* add any (error) result to the reply mbuf chain */
 788                 if (m_result != NULL) {
 789                         SCTP_BUF_NEXT(m_tail) = m_result;
 790                         m_tail = m_result;
 791                         /* update lengths, make sure it's aligned too */
 792                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 793                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 794                         /* set flag to force success reports */
 795                         error = 1;
 796                 }
 797                 offset += SCTP_SIZE32(param_length);
 798                 /* update remaining ASCONF message length to process */
 799                 if (offset >= asconf_limit) {
 800                         /* no more data in the mbuf chain */
 801                         break;
 802                 }
 803                 /* get pointer to next asconf param */
 804                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 805                     sizeof(struct sctp_asconf_paramhdr),
 806                     (uint8_t *) & aparam_buf);
 807                 if (aph == NULL) {
 808                         /* can't get an asconf paramhdr */
 809                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 810                         /* FIX ME - add error here... */
 811                 }
 812         }
 813
 814 send_reply:
 815         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 816         /* save the ASCONF-ACK reply */
 817         ack = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asconf_ack,
 818             struct sctp_asconf_ack);
 819         if (ack == NULL) {
 820                 sctp_m_freem(m_ack);
 821                 return;
 822         }
 823         ack->serial_number = serial_num;
 824         ack->last_sent_to = NULL;
 825         ack->data = m_ack;
 826         n = m_ack;
 827         while (n) {
 828                 ack->len += SCTP_BUF_LEN(n);
 829                 n = SCTP_BUF_NEXT(n);
 830         }
 831         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 832
 833         /* see if last_control_chunk_from is set properly (use IP src addr) */
 834         if (stcb->asoc.last_control_chunk_from == NULL) {
 835                 /*
 836                  * this could happen if the source address was just newly
 837                  * added
 838                  */
 839                 struct ip *iph;
 840                 struct sctphdr *sh;
 841                 struct sockaddr_storage from_store;
 842                 struct sockaddr *from = (struct sockaddr *)&from_store;
 843
 844                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 845                 /* pullup already done, IP options already stripped */
 846                 iph = mtod(m, struct ip *);
 847                 sh = (struct sctphdr *)((caddr_t)iph + sizeof(*iph));
 848                 if (iph->ip_v == IPVERSION) {
 849                         struct sockaddr_in *from4;
 850
 851                         from4 = (struct sockaddr_in *)&from_store;
 852                         bzero(from4, sizeof(*from4));
 853                         from4->sin_family = AF_INET;
 854                         from4->sin_len = sizeof(struct sockaddr_in);
 855                         from4->sin_addr.s_addr = iph->ip_src.s_addr;
 856                         from4->sin_port = sh->src_port;
 857                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
 858                         struct ip6_hdr *ip6;
 859                         struct sockaddr_in6 *from6;
 860
 861                         ip6 = mtod(m, struct ip6_hdr *);
 862                         from6 = (struct sockaddr_in6 *)&from_store;
 863                         bzero(from6, sizeof(*from6));
 864                         from6->sin6_family = AF_INET6;
 865                         from6->sin6_len = sizeof(struct sockaddr_in6);
 866                         from6->sin6_addr = ip6->ip6_src;
 867                         from6->sin6_port = sh->src_port;
 868                         /* Get the scopes in properly to the sin6 addr's */
 869                         /* we probably don't need these operations */
 870                         (void)sa6_recoverscope(from6);
 871                         sa6_embedscope(from6, ip6_use_defzone);
 872                 } else {
 873                         /* unknown address type */
 874                         from = NULL;
 875                 }
 876                 if (from != NULL) {
 877                         SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 878                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, from);
 879                         /* look up the from address */
 880                         stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, from);
 881 #ifdef SCTP_DEBUG
 882                         if (stcb->asoc.last_control_chunk_from == NULL)
 883                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 884 #endif
 885                 }
 886         }
 887 }
 888
 889 /*
 890  * does the address match? returns 0 if not, 1 if so
 891  */
 892 static uint32_t
 893 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 894 {
 895 #ifdef INET6
 896         if (sa->sa_family == AF_INET6) {
 897                 /* IPv6 sa address */
 898                 /* XXX scopeid */
 899                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 900
 901                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 902                     (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 903                     sizeof(struct in6_addr)) == 0)) {
 904                         return (1);
 905                 }
 906         } else
 907 #endif                          /* INET6 */
 908         if (sa->sa_family == AF_INET) {
 909                 /* IPv4 sa address */
 910                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 911
 912                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 913                     (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 914                     sizeof(struct in_addr)) == 0)) {
 915                         return (1);
 916                 }
 917         }
 918         return (0);
 919 }
 920
 921 /*
 922  * Cleanup for non-responded/OP ERR'd ASCONF
 923  */
 924 void
 925 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 926 {
 927         /* mark peer as ASCONF incapable */
 928         stcb->asoc.peer_supports_asconf = 0;
 929         /*
 930          * clear out any existing asconfs going out
 931          */
 932         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 933             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 934         stcb->asoc.asconf_seq_out++;
 935         /* remove the old ASCONF on our outbound queue */
 936         sctp_toss_old_asconf(stcb);
 937 }
 938
 939 /*
 940  * cleanup any cached source addresses that may be topologically
 941  * incorrect after a new address has been added to this interface.
 942  */
 943 static void
 944 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 945 {
 946         struct sctp_nets *net;
 947
 948         /*
 949          * Ideally, we want to only clear cached routes and source addresses
 950          * that are topologically incorrect.  But since there is no easy way
 951          * to know whether the newly added address on the ifn would cause a
 952          * routing change (i.e. a new egress interface would be chosen)
 953          * without doing a new routing lookup and source address selection,
 954          * we will (for now) just flush any cached route using a different
 955          * ifn (and cached source addrs) and let output re-choose them
 956          * during the next send on that net.
 957          */
 958         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 959                 /*
 960                  * clear any cached route (and cached source address) if the
 961                  * route's interface is NOT the same as the address change.
 962                  * If it's the same interface, just clear the cached source
 963                  * address.
 964                  */
 965                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 966                     SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index) {
 967                         /* clear any cached route */
 968                         RTFREE(net->ro.ro_rt);
 969                         net->ro.ro_rt = NULL;
 970                 }
 971                 /* clear any cached source address */
 972                 if (net->src_addr_selected) {
 973                         sctp_free_ifa(net->ro._s_addr);
 974                         net->ro._s_addr = NULL;
 975                         net->src_addr_selected = 0;
 976                 }
 977         }
 978 }
 979
 980 void
 981 sctp_move_chunks_from_deleted_prim(struct sctp_tcb *stcb, struct sctp_nets *dst)
 982 {
 983         struct sctp_association *asoc;
 984         struct sctp_stream_out *outs;
 985         struct sctp_tmit_chunk *chk;
 986         struct sctp_stream_queue_pending *sp;
 987
 988         if (dst->dest_state & SCTP_ADDR_UNCONFIRMED) {
 989                 return;
 990         }
 991         if (stcb->asoc.deleted_primary == NULL) {
 992                 return;
 993         }
 994         asoc = &stcb->asoc;
 995
 996         /*
 997          * now through all the streams checking for chunks sent to our bad
 998          * network.
 999          */
1000         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
1001                 /* now clean up any chunks here */
1002                 TAILQ_FOREACH(sp, &outs->outqueue, next) {
1003                         if (sp->net == asoc->deleted_primary) {
1004                                 sctp_free_remote_addr(sp->net);
1005                                 sp->net = dst;
1006                                 atomic_add_int(&dst->ref_count, 1);
1007                         }
1008                 }
1009         }
1010         /* Now check the pending queue */
1011         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
1012                 if (chk->whoTo == asoc->deleted_primary) {
1013                         sctp_free_remote_addr(chk->whoTo);
1014                         chk->whoTo = dst;
1015                         atomic_add_int(&dst->ref_count, 1);
1016                 }
1017         }
1018
1019 }
1020
1021
1022 void
1023 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
1024 {
1025         int error;
1026
1027         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1028                 return;
1029         }
1030         if (stcb->asoc.deleted_primary == NULL) {
1031                 return;
1032         }
1033         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1034                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1035                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1036                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1037                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1038                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1039                     stcb->asoc.deleted_primary,
1040                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1041                 stcb->asoc.num_send_timers_up--;
1042                 if (stcb->asoc.num_send_timers_up < 0) {
1043                         stcb->asoc.num_send_timers_up = 0;
1044                 }
1045                 SCTP_TCB_LOCK_ASSERT(stcb);
1046                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1047                     stcb->asoc.deleted_primary);
1048                 if (error) {
1049                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1050                         return;
1051                 }
1052                 SCTP_TCB_LOCK_ASSERT(stcb);
1053 #ifdef SCTP_AUDITING_ENABLED
1054                 sctp_auditing(4, stcb->sctp_ep, stcb->asoc.deleted_primary);
1055 #endif
1056                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1057                 if ((stcb->asoc.num_send_timers_up == 0) &&
1058                     (stcb->asoc.sent_queue_cnt > 0)) {
1059                         struct sctp_tmit_chunk *chk;
1060
1061                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1062                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1063                             stcb, chk->whoTo);
1064                 }
1065         }
1066         return;
1067 }
1068
1069 static int
1070     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1071
1072 void
1073 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1074 {
1075         struct sctp_tmit_chunk *chk;
1076
1077         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1078         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1079             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1080         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1081         net->error_count = 0;
1082         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1083                 if (chk->whoTo == net) {
1084                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1085                                 chk->sent = SCTP_DATAGRAM_RESEND;
1086                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1087                                 sctp_flight_size_decrease(chk);
1088                                 sctp_total_flight_decrease(stcb, chk);
1089                                 net->marked_retrans++;
1090                                 stcb->asoc.marked_retrans++;
1091                         }
1092                 }
1093         }
1094         if (net->marked_retrans) {
1095                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1096         }
1097 }
1098
1099 static void
1100 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1101 {
1102         struct sctp_nets *net;
1103         int addrnum, changed;
1104
1105         /*
1106          * If number of local valid addresses is 1, the valid address is
1107          * probably newly added address.  Several valid addresses in this
1108          * association.  A source address may not be changed.  Additionally,
1109          * they can be configured on a same interface as "alias" addresses.
1110          * (by micchie)
1111          */
1112         addrnum = sctp_local_addr_count(stcb);
1113         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1114             addrnum);
1115         if (addrnum == 1) {
1116                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1117                         /* clear any cached route and source address */
1118                         if (net->ro.ro_rt) {
1119                                 RTFREE(net->ro.ro_rt);
1120                                 net->ro.ro_rt = NULL;
1121                         }
1122                         if (net->src_addr_selected) {
1123                                 sctp_free_ifa(net->ro._s_addr);
1124                                 net->ro._s_addr = NULL;
1125                                 net->src_addr_selected = 0;
1126                         }
1127                         /* Retransmit unacknowledged DATA chunks immediately */
1128                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1129                             SCTP_MOBILITY_FASTHANDOFF)) {
1130                                 sctp_net_immediate_retrans(stcb, net);
1131                         }
1132                         /* also, SET PRIMARY is maybe already sent */
1133                 }
1134                 return;
1135         }
1136         /* Multiple local addresses exsist in the association.  */
1137         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1138                 /* clear any cached route and source address */
1139                 if (net->ro.ro_rt) {
1140                         RTFREE(net->ro.ro_rt);
1141                         net->ro.ro_rt = NULL;
1142                 }
1143                 if (net->src_addr_selected) {
1144                         sctp_free_ifa(net->ro._s_addr);
1145                         net->ro._s_addr = NULL;
1146                         net->src_addr_selected = 0;
1147                 }
1148                 /*
1149                  * Check if the nexthop is corresponding to the new address.
1150                  * If the new address is corresponding to the current
1151                  * nexthop, the path will be changed.  If the new address is
1152                  * NOT corresponding to the current nexthop, the path will
1153                  * not be changed.
1154                  */
1155                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1156                     stcb->sctp_ep->def_vrf_id);
1157                 if (net->ro.ro_rt == NULL)
1158                         continue;
1159
1160                 changed = 0;
1161                 if (net->ro._l_addr.sa.sa_family == AF_INET) {
1162                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro))
1163                                 changed = 1;
1164                 }
1165                 if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1166                         if (sctp_v6src_match_nexthop(
1167                             &newifa->address.sin6, (sctp_route_t *) & net->ro))
1168                                 changed = 1;
1169                 }
1170                 /*
1171                  * if the newly added address does not relate routing
1172                  * information, we skip.
1173                  */
1174                 if (changed == 0)
1175                         continue;
1176                 /* Retransmit unacknowledged DATA chunks immediately */
1177                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1178                     SCTP_MOBILITY_FASTHANDOFF)) {
1179                         sctp_net_immediate_retrans(stcb, net);
1180                 }
1181                 /* Send SET PRIMARY for this new address */
1182                 if (net == stcb->asoc.primary_destination) {
1183                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1184                             SCTP_SET_PRIM_ADDR);
1185                 }
1186         }
1187 }
1188
1189 /*
1190  * process an ADD/DELETE IP ack from peer.
1191  * addr: corresponding sctp_ifa to the address being added/deleted.
1192  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1193  * flag: 1=success, 0=failure.
1194  */
1195 static void
1196 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr,
1197     uint16_t type, uint32_t flag)
1198 {
1199         /*
1200          * do the necessary asoc list work- if we get a failure indication,
1201          * leave the address on the assoc's restricted list.  If we get a
1202          * success indication, remove the address from the restricted list.
1203          */
1204         /*
1205          * Note: this will only occur for ADD_IP_ADDRESS, since
1206          * DEL_IP_ADDRESS is never actually added to the list...
1207          */
1208         if (flag) {
1209                 /* success case, so remove from the restricted list */
1210                 sctp_del_local_addr_restricted(stcb, addr);
1211
1212                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1213                     SCTP_MOBILITY_BASE) ||
1214                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1215                     SCTP_MOBILITY_FASTHANDOFF)) {
1216                         sctp_path_check_and_react(stcb, addr);
1217                         return;
1218                 }
1219                 /* clear any cached/topologically incorrect source addresses */
1220                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1221         }
1222         /* else, leave it on the list */
1223 }
1224
1225 /*
1226  * add an asconf add/delete/set primary IP address parameter to the queue.
1227  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1228  * returns 0 if queued, -1 if not queued/removed.
1229  * NOTE: if adding, but a delete for the same address is already scheduled
1230  * (and not yet sent out), simply remove it from queue.  Same for deleting
1231  * an address already scheduled for add.  If a duplicate operation is found,
1232  * ignore the new one.
1233  */
1234 static int
1235 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1236     uint16_t type)
1237 {
1238         struct sctp_asconf_addr *aa, *aa_next;
1239         struct sockaddr *sa;
1240
1241         /* make sure the request isn't already in the queue */
1242         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1243             aa = aa_next) {
1244                 aa_next = TAILQ_NEXT(aa, next);
1245                 /* address match? */
1246                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1247                         continue;
1248                 /* is the request already in queue (sent or not) */
1249                 if (aa->ap.aph.ph.param_type == type) {
1250                         return (-1);
1251                 }
1252                 /* is the negative request already in queue, and not sent */
1253                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1254                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1255                         /* add requested, delete already queued */
1256                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1257                         /* remove the ifa from the restricted list */
1258                         sctp_del_local_addr_restricted(stcb, ifa);
1259                         /* free the asconf param */
1260                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1261                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1262                         return (-1);
1263                 }
1264                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1265                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1266                         /* delete requested, add already queued */
1267                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1268                         /* remove the aa->ifa from the restricted list */
1269                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1270                         /* free the asconf param */
1271                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1272                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1273                         return (-1);
1274                 }
1275         }                       /* for each aa */
1276
1277         /* adding new request to the queue */
1278         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1279             SCTP_M_ASC_ADDR);
1280         if (aa == NULL) {
1281                 /* didn't get memory */
1282                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1283                 return (-1);
1284         }
1285         /* fill in asconf address parameter fields */
1286         /* top level elements are "networked" during send */
1287         aa->ap.aph.ph.param_type = type;
1288         aa->ifa = ifa;
1289         atomic_add_int(&ifa->refcount, 1);
1290         /* correlation_id filled in during send routine later... */
1291         if (ifa->address.sa.sa_family == AF_INET6) {
1292                 /* IPv6 address */
1293                 struct sockaddr_in6 *sin6;
1294
1295                 sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1296                 sa = (struct sockaddr *)sin6;
1297                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1298                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1299                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1300                     sizeof(struct sctp_ipv6addr_param);
1301                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1302                     sizeof(struct in6_addr));
1303         } else if (ifa->address.sa.sa_family == AF_INET) {
1304                 /* IPv4 address */
1305                 struct sockaddr_in *sin;
1306
1307                 sin = (struct sockaddr_in *)&ifa->address.sa;
1308                 sa = (struct sockaddr *)sin;
1309                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1310                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1311                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1312                     sizeof(struct sctp_ipv4addr_param);
1313                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1314                     sizeof(struct in_addr));
1315         } else {
1316                 /* invalid family! */
1317                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1318                 sctp_free_ifa(ifa);
1319                 return (-1);
1320         }
1321         aa->sent = 0;           /* clear sent flag */
1322
1323         /*
1324          * if we are deleting an address it should go out last otherwise,
1325          * add it to front of the pending queue
1326          */
1327         if (type == SCTP_ADD_IP_ADDRESS) {
1328                 /* add goes to the front of the queue */
1329                 TAILQ_INSERT_HEAD(&stcb->asoc.asconf_queue, aa, next);
1330                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1331                     "asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1332                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1333         } else {
1334                 /* delete and set primary goes to the back of the queue */
1335                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1336 #ifdef SCTP_DEBUG
1337                 if (sctp_debug_on && SCTP_DEBUG_ASCONF2) {
1338                         if (type == SCTP_DEL_IP_ADDRESS) {
1339                                 SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1340                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1341                         } else {
1342                                 SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1343                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1344                         }
1345                 }
1346 #endif
1347         }
1348
1349         return (0);
1350 }
1351
1352
1353 /*
1354  * add an asconf operation for the given ifa and type.
1355  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1356  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1357  * advisable.
1358  */
1359 static int
1360 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1361     uint16_t type)
1362 {
1363         uint32_t status;
1364         int pending_delete_queued = 0;
1365
1366         /* see if peer supports ASCONF */
1367         if (stcb->asoc.peer_supports_asconf == 0) {
1368                 return (-1);
1369         }
1370         /*
1371          * if this is deleting the last address from the assoc, mark it as
1372          * pending.
1373          */
1374         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1375             (sctp_local_addr_count(stcb) < 2)) {
1376                 /* set the pending delete info only */
1377                 stcb->asoc.asconf_del_pending = 1;
1378                 stcb->asoc.asconf_addr_del_pending = ifa;
1379                 atomic_add_int(&ifa->refcount, 1);
1380                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1381                     "asconf_queue_add: mark delete last address pending\n");
1382                 return (-1);
1383         }
1384         /*
1385          * if this is an add, and there is a delete also pending (i.e. the
1386          * last local address is being changed), queue the pending delete
1387          * too.
1388          */
1389         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending) {
1390                 /* queue in the pending delete */
1391                 if (sctp_asconf_queue_mgmt(stcb,
1392                     stcb->asoc.asconf_addr_del_pending,
1393                     SCTP_DEL_IP_ADDRESS) == 0) {
1394                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1395                         pending_delete_queued = 1;
1396                         /* clear out the pending delete info */
1397                         stcb->asoc.asconf_del_pending = 0;
1398                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1399                         stcb->asoc.asconf_addr_del_pending = NULL;
1400                 }
1401         }
1402         /* queue an asconf parameter */
1403         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1404
1405         if (pending_delete_queued && (status == 0)) {
1406                 struct sctp_nets *net;
1407
1408                 /*
1409                  * since we know that the only/last address is now being
1410                  * changed in this case, reset the cwnd/rto on all nets to
1411                  * start as a new address and path.  Also clear the error
1412                  * counts to give the assoc the best chance to complete the
1413                  * address change.
1414                  */
1415                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1416                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1417                             net);
1418                         net->RTO = 0;
1419                         net->error_count = 0;
1420                 }
1421                 stcb->asoc.overall_error_count = 0;
1422                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
1423                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1424                             stcb->asoc.overall_error_count,
1425                             0,
1426                             SCTP_FROM_SCTP_ASCONF,
1427                             __LINE__);
1428                 }
1429                 /* queue in an advisory set primary too */
1430                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1431                 /* let caller know we should send this out immediately */
1432                 status = 1;
1433         }
1434         return (status);
1435 }
1436
1437 /*-
1438  * add an asconf delete IP address parameter to the queue by sockaddr and
1439  * possibly with no sctp_ifa available.  This is only called by the routine
1440  * that checks the addresses in an INIT-ACK against the current address list.
1441  * returns 0 if completed, non-zero if not completed.
1442  * NOTE: if an add is already scheduled (and not yet sent out), simply
1443  * remove it from queue.  If a duplicate operation is found, ignore the
1444  * new one.
1445  */
1446 static int
1447 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1448 {
1449         struct sctp_ifa *ifa;
1450         struct sctp_asconf_addr *aa, *aa_next;
1451         uint32_t vrf_id;
1452
1453         if (stcb == NULL) {
1454                 return (-1);
1455         }
1456         /* see if peer supports ASCONF */
1457         if (stcb->asoc.peer_supports_asconf == 0) {
1458                 return (-1);
1459         }
1460         /* make sure the request isn't already in the queue */
1461         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1462             aa = aa_next) {
1463                 aa_next = TAILQ_NEXT(aa, next);
1464                 /* address match? */
1465                 if (sctp_asconf_addr_match(aa, sa) == 0)
1466                         continue;
1467                 /* is the request already in queue (sent or not) */
1468                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1469                         return (-1);
1470                 }
1471                 /* is the negative request already in queue, and not sent */
1472                 if (aa->sent == 1)
1473                         continue;
1474                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1475                         /* add already queued, so remove existing entry */
1476                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1477                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1478                         /* free the entry */
1479                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1480                         return (-1);
1481                 }
1482         }                       /* for each aa */
1483
1484         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1485         if (stcb) {
1486                 vrf_id = stcb->asoc.vrf_id;
1487         } else {
1488                 vrf_id = SCTP_DEFAULT_VRFID;
1489         }
1490         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1491
1492         /* adding new request to the queue */
1493         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1494             SCTP_M_ASC_ADDR);
1495         if (aa == NULL) {
1496                 /* didn't get memory */
1497                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1498                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1499                 return (-1);
1500         }
1501         /* fill in asconf address parameter fields */
1502         /* top level elements are "networked" during send */
1503         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1504         aa->ifa = ifa;
1505         if (ifa)
1506                 atomic_add_int(&ifa->refcount, 1);
1507         /* correlation_id filled in during send routine later... */
1508         if (sa->sa_family == AF_INET6) {
1509                 /* IPv6 address */
1510                 struct sockaddr_in6 *sin6;
1511
1512                 sin6 = (struct sockaddr_in6 *)sa;
1513                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1514                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1515                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1516                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1517                     sizeof(struct in6_addr));
1518         } else if (sa->sa_family == AF_INET) {
1519                 /* IPv4 address */
1520                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1521
1522                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1523                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1524                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1525                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1526                     sizeof(struct in_addr));
1527         } else {
1528                 /* invalid family! */
1529                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1530                 if (ifa)
1531                         sctp_free_ifa(ifa);
1532                 return (-1);
1533         }
1534         aa->sent = 0;           /* clear sent flag */
1535
1536         /* delete goes to the back of the queue */
1537         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1538
1539         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1540         return (0);
1541 }
1542
1543 /*
1544  * find a specific asconf param on our "sent" queue
1545  */
1546 static struct sctp_asconf_addr *
1547 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1548 {
1549         struct sctp_asconf_addr *aa;
1550
1551         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1552                 if (aa->ap.aph.correlation_id == correlation_id &&
1553                     aa->sent == 1) {
1554                         /* found it */
1555                         return (aa);
1556                 }
1557         }
1558         /* didn't find it */
1559         return (NULL);
1560 }
1561
1562 /*
1563  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1564  * notifications based on the error response
1565  */
1566 static void
1567 sctp_asconf_process_error(struct sctp_tcb *stcb,
1568     struct sctp_asconf_paramhdr *aph)
1569 {
1570         struct sctp_error_cause *eh;
1571         struct sctp_paramhdr *ph;
1572         uint16_t param_type;
1573         uint16_t error_code;
1574
1575         eh = (struct sctp_error_cause *)(aph + 1);
1576         ph = (struct sctp_paramhdr *)(eh + 1);
1577         /* validate lengths */
1578         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1579             htons(aph->ph.param_length)) {
1580                 /* invalid error cause length */
1581                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1582                     "asconf_process_error: cause element too long\n");
1583                 return;
1584         }
1585         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1586             htons(eh->length)) {
1587                 /* invalid included TLV length */
1588                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1589                     "asconf_process_error: included TLV too long\n");
1590                 return;
1591         }
1592         /* which error code ? */
1593         error_code = ntohs(eh->code);
1594         param_type = ntohs(aph->ph.param_type);
1595         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1596         switch (error_code) {
1597         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1598                 /* we allow ourselves to "try again" for this error */
1599                 break;
1600         default:
1601                 /* peer can't handle it... */
1602                 switch (param_type) {
1603                 case SCTP_ADD_IP_ADDRESS:
1604                 case SCTP_DEL_IP_ADDRESS:
1605                         stcb->asoc.peer_supports_asconf = 0;
1606                         break;
1607                 case SCTP_SET_PRIM_ADDR:
1608                         stcb->asoc.peer_supports_asconf = 0;
1609                         break;
1610                 default:
1611                         break;
1612                 }
1613         }
1614 }
1615
1616 /*
1617  * process an asconf queue param.
1618  * aparam: parameter to process, will be removed from the queue.
1619  * flag: 1=success case, 0=failure case
1620  */
1621 static void
1622 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1623     struct sctp_asconf_addr *aparam, uint32_t flag)
1624 {
1625         uint16_t param_type;
1626
1627         /* process this param */
1628         param_type = aparam->ap.aph.ph.param_type;
1629         switch (param_type) {
1630         case SCTP_ADD_IP_ADDRESS:
1631                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1632                     "process_param_ack: added IP address\n");
1633                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, param_type, flag);
1634                 break;
1635         case SCTP_DEL_IP_ADDRESS:
1636                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1637                     "process_param_ack: deleted IP address\n");
1638                 /* nothing really to do... lists already updated */
1639                 break;
1640         case SCTP_SET_PRIM_ADDR:
1641                 /* nothing to do... peer may start using this addr */
1642                 if (flag == 0)
1643                         stcb->asoc.peer_supports_asconf = 0;
1644                 break;
1645         default:
1646                 /* should NEVER happen */
1647                 break;
1648         }
1649
1650         /* remove the param and free it */
1651         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1652         if (aparam->ifa)
1653                 sctp_free_ifa(aparam->ifa);
1654         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1655 }
1656
1657 /*
1658  * cleanup from a bad asconf ack parameter
1659  */
1660 static void
1661 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1662 {
1663         /* assume peer doesn't really know how to do asconfs */
1664         stcb->asoc.peer_supports_asconf = 0;
1665         /* XXX we could free the pending queue here */
1666 }
1667
1668 void
1669 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1670     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1671     struct sctp_nets *net, int *abort_no_unlock)
1672 {
1673         struct sctp_association *asoc;
1674         uint32_t serial_num;
1675         uint16_t ack_length;
1676         struct sctp_asconf_paramhdr *aph;
1677         struct sctp_asconf_addr *aa, *aa_next;
1678         uint32_t last_error_id = 0;     /* last error correlation id */
1679         uint32_t id;
1680         struct sctp_asconf_addr *ap;
1681
1682         /* asconf param buffer */
1683         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1684
1685         /* verify minimum length */
1686         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1687                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1688                     "handle_asconf_ack: chunk too small = %xh\n",
1689                     ntohs(cp->ch.chunk_length));
1690                 return;
1691         }
1692         asoc = &stcb->asoc;
1693         serial_num = ntohl(cp->serial_number);
1694
1695         /*
1696          * NOTE: we may want to handle this differently- currently, we will
1697          * abort when we get an ack for the expected serial number + 1 (eg.
1698          * we didn't send it), process an ack normally if it is the expected
1699          * serial number, and re-send the previous ack for *ALL* other
1700          * serial numbers
1701          */
1702
1703         /*
1704          * if the serial number is the next expected, but I didn't send it,
1705          * abort the asoc, since someone probably just hijacked us...
1706          */
1707         if (serial_num == (asoc->asconf_seq_out + 1)) {
1708                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1709                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1710                     SCTP_CAUSE_ILLEGAL_ASCONF_ACK, NULL, SCTP_SO_NOT_LOCKED);
1711                 *abort_no_unlock = 1;
1712                 return;
1713         }
1714         if (serial_num != asoc->asconf_seq_out) {
1715                 /* got a duplicate/unexpected ASCONF-ACK */
1716                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1717                     serial_num, asoc->asconf_seq_out);
1718                 return;
1719         }
1720         if (stcb->asoc.asconf_sent == 0) {
1721                 /* got a unexpected ASCONF-ACK for serial not in flight */
1722                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got serial number = %xh but not in flight\n",
1723                     serial_num);
1724                 /* nothing to do... duplicate ACK received */
1725                 return;
1726         }
1727         /* stop our timer */
1728         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1729             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1730
1731         /* process the ASCONF-ACK contents */
1732         ack_length = ntohs(cp->ch.chunk_length) -
1733             sizeof(struct sctp_asconf_ack_chunk);
1734         offset += sizeof(struct sctp_asconf_ack_chunk);
1735         /* process through all parameters */
1736         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1737                 unsigned int param_length, param_type;
1738
1739                 /* get pointer to next asconf parameter */
1740                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1741                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1742                 if (aph == NULL) {
1743                         /* can't get an asconf paramhdr */
1744                         sctp_asconf_ack_clear(stcb);
1745                         return;
1746                 }
1747                 param_type = ntohs(aph->ph.param_type);
1748                 param_length = ntohs(aph->ph.param_length);
1749                 if (param_length > ack_length) {
1750                         sctp_asconf_ack_clear(stcb);
1751                         return;
1752                 }
1753                 if (param_length < sizeof(struct sctp_paramhdr)) {
1754                         sctp_asconf_ack_clear(stcb);
1755                         return;
1756                 }
1757                 /* get the complete parameter... */
1758                 if (param_length > sizeof(aparam_buf)) {
1759                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1760                             "param length (%u) larger than buffer size!\n", param_length);
1761                         sctp_asconf_ack_clear(stcb);
1762                         return;
1763                 }
1764                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1765                 if (aph == NULL) {
1766                         sctp_asconf_ack_clear(stcb);
1767                         return;
1768                 }
1769                 /* correlation_id is transparent to peer, no ntohl needed */
1770                 id = aph->correlation_id;
1771
1772                 switch (param_type) {
1773                 case SCTP_ERROR_CAUSE_IND:
1774                         last_error_id = id;
1775                         /* find the corresponding asconf param in our queue */
1776                         ap = sctp_asconf_find_param(stcb, id);
1777                         if (ap == NULL) {
1778                                 /* hmm... can't find this in our queue! */
1779                                 break;
1780                         }
1781                         /* process the parameter, failed flag */
1782                         sctp_asconf_process_param_ack(stcb, ap, 0);
1783                         /* process the error response */
1784                         sctp_asconf_process_error(stcb, aph);
1785                         break;
1786                 case SCTP_SUCCESS_REPORT:
1787                         /* find the corresponding asconf param in our queue */
1788                         ap = sctp_asconf_find_param(stcb, id);
1789                         if (ap == NULL) {
1790                                 /* hmm... can't find this in our queue! */
1791                                 break;
1792                         }
1793                         /* process the parameter, success flag */
1794                         sctp_asconf_process_param_ack(stcb, ap, 1);
1795                         break;
1796                 default:
1797                         break;
1798                 }               /* switch */
1799
1800                 /* update remaining ASCONF-ACK message length to process */
1801                 ack_length -= SCTP_SIZE32(param_length);
1802                 if (ack_length <= 0) {
1803                         /* no more data in the mbuf chain */
1804                         break;
1805                 }
1806                 offset += SCTP_SIZE32(param_length);
1807         }                       /* while */
1808
1809         /*
1810          * if there are any "sent" params still on the queue, these are
1811          * implicitly "success", or "failed" (if we got an error back) ...
1812          * so process these appropriately
1813          *
1814          * we assume that the correlation_id's are monotonically increasing
1815          * beginning from 1 and that we don't have *that* many outstanding
1816          * at any given time
1817          */
1818         if (last_error_id == 0)
1819                 last_error_id--;/* set to "max" value */
1820         for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1821             aa = aa_next) {
1822                 aa_next = TAILQ_NEXT(aa, next);
1823                 if (aa->sent == 1) {
1824                         /*
1825                          * implicitly successful or failed if correlation_id
1826                          * < last_error_id, then success else, failure
1827                          */
1828                         if (aa->ap.aph.correlation_id < last_error_id)
1829                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1830                         else
1831                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1832                 } else {
1833                         /*
1834                          * since we always process in order (FIFO queue) if
1835                          * we reach one that hasn't been sent, the rest
1836                          * should not have been sent either. so, we're
1837                          * done...
1838                          */
1839                         break;
1840                 }
1841         }
1842
1843         /* update the next sequence number to use */
1844         asoc->asconf_seq_out++;
1845         /* remove the old ASCONF on our outbound queue */
1846         sctp_toss_old_asconf(stcb);
1847         /* clear the sent flag to allow new ASCONFs */
1848         asoc->asconf_sent = 0;
1849         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1850 #ifdef SCTP_TIMER_BASED_ASCONF
1851                 /* we have more params, so restart our timer */
1852                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1853                     stcb, net);
1854 #else
1855                 /* we have more params, so send out more */
1856                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1857 #endif
1858         }
1859 }
1860
1861 static uint32_t
1862 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1863 {
1864         struct sockaddr_in6 *sin6, *net6;
1865         struct sctp_nets *net;
1866
1867         if (sa->sa_family != AF_INET6) {
1868                 /* wrong family */
1869                 return (0);
1870         }
1871         sin6 = (struct sockaddr_in6 *)sa;
1872         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1873                 /* not link local address */
1874                 return (0);
1875         }
1876         /* hunt through our destination nets list for this scope_id */
1877         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1878                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1879                     AF_INET6)
1880                         continue;
1881                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1882                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1883                         continue;
1884                 if (sctp_is_same_scope(sin6, net6)) {
1885                         /* found one */
1886                         return (1);
1887                 }
1888         }
1889         /* didn't find one */
1890         return (0);
1891 }
1892
1893 /*
1894  * address management functions
1895  */
1896 static void
1897 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1898     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1899 {
1900         int status;
1901
1902
1903         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 &&
1904             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1905                 /* subset bound, no ASCONF allowed case, so ignore */
1906                 return;
1907         }
1908         /*
1909          * note: we know this is not the subset bound, no ASCONF case eg.
1910          * this is boundall or subset bound w/ASCONF allowed
1911          */
1912
1913         /* first, make sure it's a good address family */
1914         if (ifa->address.sa.sa_family != AF_INET6 &&
1915             ifa->address.sa.sa_family != AF_INET) {
1916                 return;
1917         }
1918         /* make sure we're "allowed" to add this type of addr */
1919         if (ifa->address.sa.sa_family == AF_INET6) {
1920                 /* invalid if we're not a v6 endpoint */
1921                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1922                         return;
1923                 /* is the v6 addr really valid ? */
1924                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1925                         return;
1926                 }
1927         }
1928         /* put this address on the "pending/do not use yet" list */
1929         sctp_add_local_addr_restricted(stcb, ifa);
1930         /*
1931          * check address scope if address is out of scope, don't queue
1932          * anything... note: this would leave the address on both inp and
1933          * asoc lists
1934          */
1935         if (ifa->address.sa.sa_family == AF_INET6) {
1936                 struct sockaddr_in6 *sin6;
1937
1938                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1939                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1940                         /* we skip unspecifed addresses */
1941                         return;
1942                 }
1943                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1944                         if (stcb->asoc.local_scope == 0) {
1945                                 return;
1946                         }
1947                         /* is it the right link local scope? */
1948                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1949                                 return;
1950                         }
1951                 }
1952                 if (stcb->asoc.site_scope == 0 &&
1953                     IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1954                         return;
1955                 }
1956         } else if (ifa->address.sa.sa_family == AF_INET) {
1957                 struct sockaddr_in *sin;
1958                 struct in6pcb *inp6;
1959
1960                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1961                 /* invalid if we are a v6 only endpoint */
1962                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1963                     SCTP_IPV6_V6ONLY(inp6))
1964                         return;
1965
1966                 sin = (struct sockaddr_in *)&ifa->address.sa;
1967                 if (sin->sin_addr.s_addr == 0) {
1968                         /* we skip unspecifed addresses */
1969                         return;
1970                 }
1971                 if (stcb->asoc.ipv4_local_scope == 0 &&
1972                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1973                         return;
1974                 }
1975         } else {
1976                 /* else, not AF_INET or AF_INET6, so skip */
1977                 return;
1978         }
1979
1980         /* queue an asconf for this address add/delete */
1981         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1982                 /* does the peer do asconf? */
1983                 if (stcb->asoc.peer_supports_asconf) {
1984                         /* queue an asconf for this addr */
1985                         status = sctp_asconf_queue_add(stcb, ifa, type);
1986
1987                         /*
1988                          * if queued ok, and in the open state, send out the
1989                          * ASCONF.  If in the non-open state, these will be
1990                          * sent when the state goes open.
1991                          */
1992                         if (status == 0 &&
1993                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1994 #ifdef SCTP_TIMER_BASED_ASCONF
1995                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1996                                     stcb, stcb->asoc.primary_destination);
1997 #else
1998                                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
1999                                     addr_locked);
2000 #endif
2001                         }
2002                 }
2003         }
2004 }
2005
2006
2007 int
2008 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2009 {
2010         struct sctp_asconf_iterator *asc;
2011         struct sctp_ifa *ifa;
2012         struct sctp_laddr *l;
2013         int type;
2014         int cnt_invalid = 0;
2015
2016         asc = (struct sctp_asconf_iterator *)ptr;
2017         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2018                 ifa = l->ifa;
2019                 type = l->action;
2020                 if (ifa->address.sa.sa_family == AF_INET6) {
2021                         /* invalid if we're not a v6 endpoint */
2022                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2023                                 cnt_invalid++;
2024                                 if (asc->cnt == cnt_invalid)
2025                                         return (1);
2026                                 else
2027                                         continue;
2028                         }
2029                 } else if (ifa->address.sa.sa_family == AF_INET) {
2030                         /* invalid if we are a v6 only endpoint */
2031                         struct in6pcb *inp6;
2032
2033                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2034                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2035                             SCTP_IPV6_V6ONLY(inp6)) {
2036                                 cnt_invalid++;
2037                                 if (asc->cnt == cnt_invalid)
2038                                         return (1);
2039                                 else
2040                                         continue;
2041                         }
2042                 } else {
2043                         /* invalid address family */
2044                         cnt_invalid++;
2045                         if (asc->cnt == cnt_invalid)
2046                                 return (1);
2047                         else
2048                                 continue;
2049                 }
2050         }
2051         return (0);
2052 }
2053
2054 static int
2055 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2056 {
2057         struct sctp_ifa *ifa;
2058         struct sctp_asconf_iterator *asc;
2059         struct sctp_laddr *laddr, *nladdr, *l;
2060
2061         /* Only for specific case not bound all */
2062         asc = (struct sctp_asconf_iterator *)ptr;
2063         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2064                 ifa = l->ifa;
2065                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2066                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2067                             sctp_nxt_addr) {
2068                                 if (laddr->ifa == ifa) {
2069                                         laddr->action = 0;
2070                                         break;
2071                                 }
2072                         }
2073                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2074                         laddr = LIST_FIRST(&inp->sctp_addr_list);
2075                         while (laddr) {
2076                                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2077                                 /* remove only after all guys are done */
2078                                 if (laddr->ifa == ifa) {
2079                                         sctp_del_local_addr_ep(inp, ifa);
2080                                 }
2081                                 laddr = nladdr;
2082                         }
2083                 }
2084         }
2085         return (0);
2086 }
2087
2088 void
2089 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2090     void *ptr, uint32_t val)
2091 {
2092         struct sctp_asconf_iterator *asc;
2093         struct sctp_ifa *ifa;
2094         struct sctp_laddr *l;
2095         int cnt_invalid = 0;
2096         int type, status;
2097         int num_queued = 0;
2098
2099         asc = (struct sctp_asconf_iterator *)ptr;
2100         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2101                 ifa = l->ifa;
2102                 type = l->action;
2103
2104                 /* address's vrf_id must be the vrf_id of the assoc */
2105                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2106                         continue;
2107                 }
2108                 /* Same checks again for assoc */
2109                 if (ifa->address.sa.sa_family == AF_INET6) {
2110                         /* invalid if we're not a v6 endpoint */
2111                         struct sockaddr_in6 *sin6;
2112
2113                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2114                                 cnt_invalid++;
2115                                 if (asc->cnt == cnt_invalid)
2116                                         return;
2117                                 else
2118                                         continue;
2119                         }
2120                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2121                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2122                                 /* we skip unspecifed addresses */
2123                                 continue;
2124                         }
2125                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2126                                 if (stcb->asoc.local_scope == 0) {
2127                                         continue;
2128                                 }
2129                                 /* is it the right link local scope? */
2130                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2131                                         continue;
2132                                 }
2133                         }
2134                 } else if (ifa->address.sa.sa_family == AF_INET) {
2135                         /* invalid if we are a v6 only endpoint */
2136                         struct in6pcb *inp6;
2137                         struct sockaddr_in *sin;
2138
2139                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2140                         /* invalid if we are a v6 only endpoint */
2141                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2142                             SCTP_IPV6_V6ONLY(inp6))
2143                                 continue;
2144
2145                         sin = (struct sockaddr_in *)&ifa->address.sa;
2146                         if (sin->sin_addr.s_addr == 0) {
2147                                 /* we skip unspecifed addresses */
2148                                 continue;
2149                         }
2150                         if (stcb->asoc.ipv4_local_scope == 0 &&
2151                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2152                                 continue;;
2153                         }
2154                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2155                             SCTP_IPV6_V6ONLY(inp6)) {
2156                                 cnt_invalid++;
2157                                 if (asc->cnt == cnt_invalid)
2158                                         return;
2159                                 else
2160                                         continue;
2161                         }
2162                 } else {
2163                         /* invalid address family */
2164                         cnt_invalid++;
2165                         if (asc->cnt == cnt_invalid)
2166                                 return;
2167                         else
2168                                 continue;
2169                 }
2170
2171                 if (type == SCTP_ADD_IP_ADDRESS) {
2172                         /* prevent this address from being used as a source */
2173                         sctp_add_local_addr_restricted(stcb, ifa);
2174                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2175                         struct sctp_nets *net;
2176
2177                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2178                                 sctp_rtentry_t *rt;
2179
2180                                 /* delete this address if cached */
2181                                 if (net->ro._s_addr == ifa) {
2182                                         sctp_free_ifa(net->ro._s_addr);
2183                                         net->ro._s_addr = NULL;
2184                                         net->src_addr_selected = 0;
2185                                         rt = net->ro.ro_rt;
2186                                         if (rt) {
2187                                                 RTFREE(rt);
2188                                                 net->ro.ro_rt = NULL;
2189                                         }
2190                                         /*
2191                                          * Now we deleted our src address,
2192                                          * should we not also now reset the
2193                                          * cwnd/rto to start as if its a new
2194                                          * address?
2195                                          */
2196                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2197                                         net->RTO = 0;
2198
2199                                 }
2200                         }
2201                 } else if (type == SCTP_SET_PRIM_ADDR) {
2202                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2203                                 /* must validate the ifa is in the ep */
2204                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2205                                         continue;
2206                                 }
2207                         } else {
2208                                 /* Need to check scopes for this guy */
2209                                 if (sctp_is_address_in_scope(ifa,
2210                                     stcb->asoc.ipv4_addr_legal,
2211                                     stcb->asoc.ipv6_addr_legal,
2212                                     stcb->asoc.loopback_scope,
2213                                     stcb->asoc.ipv4_local_scope,
2214                                     stcb->asoc.local_scope,
2215                                     stcb->asoc.site_scope, 0) == 0) {
2216                                         continue;
2217                                 }
2218                         }
2219                 }
2220                 /* queue an asconf for this address add/delete */
2221                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2222                     stcb->asoc.peer_supports_asconf) {
2223                         /* queue an asconf for this addr */
2224                         status = sctp_asconf_queue_add(stcb, ifa, type);
2225                         /*
2226                          * if queued ok, and in the open state, update the
2227                          * count of queued params.  If in the non-open
2228                          * state, these get sent when the assoc goes open.
2229                          */
2230                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2231                                 if (status >= 0) {
2232                                         num_queued++;
2233                                 }
2234                         }
2235                 }
2236         }
2237         /*
2238          * If we have queued params in the open state, send out an ASCONF.
2239          */
2240         if (num_queued > 0) {
2241                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2242                     SCTP_ADDR_NOT_LOCKED);
2243         }
2244 }
2245
2246 void
2247 sctp_asconf_iterator_end(void *ptr, uint32_t val)
2248 {
2249         struct sctp_asconf_iterator *asc;
2250         struct sctp_ifa *ifa;
2251         struct sctp_laddr *l, *l_next;
2252
2253         asc = (struct sctp_asconf_iterator *)ptr;
2254         l = LIST_FIRST(&asc->list_of_work);
2255         while (l != NULL) {
2256                 l_next = LIST_NEXT(l, sctp_nxt_addr);
2257                 ifa = l->ifa;
2258                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2259                         /* Clear the defer use flag */
2260                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2261                 }
2262                 sctp_free_ifa(ifa);
2263                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, l);
2264                 SCTP_DECR_LADDR_COUNT();
2265                 l = l_next;
2266         }
2267         SCTP_FREE(asc, SCTP_M_ASC_IT);
2268 }
2269
2270 /*
2271  * sa is the sockaddr to ask the peer to set primary to.
2272  * returns: 0 = completed, -1 = error
2273  */
2274 int32_t
2275 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2276 {
2277         uint32_t vrf_id;
2278         struct sctp_ifa *ifa;
2279
2280         /* find the ifa for the desired set primary */
2281         vrf_id = stcb->asoc.vrf_id;
2282         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2283         if (ifa == NULL) {
2284                 /* Invalid address */
2285                 return (-1);
2286         }
2287         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2288         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2289                 /* set primary queuing succeeded */
2290                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2291                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2292                     stcb);
2293                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2294                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2295 #ifdef SCTP_TIMER_BASED_ASCONF
2296                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2297                             stcb->sctp_ep, stcb,
2298                             stcb->asoc.primary_destination);
2299 #else
2300                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2301                             SCTP_ADDR_NOT_LOCKED);
2302 #endif
2303                 }
2304         } else {
2305                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2306                     stcb);
2307                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2308                 return (-1);
2309         }
2310         return (0);
2311 }
2312
2313 void
2314 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2315 {
2316         struct sctp_inpcb *inp;
2317
2318         /* go through all our PCB's */
2319         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
2320                 struct sctp_tcb *stcb;
2321
2322                 /* process for all associations for this endpoint */
2323                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2324                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2325                         if (!sctp_asconf_queue_add(stcb, ifa,
2326                             SCTP_SET_PRIM_ADDR)) {
2327                                 /* set primary queuing succeeded */
2328                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2329                                     stcb);
2330                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2331                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2332 #ifdef SCTP_TIMER_BASED_ASCONF
2333                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2334                                             stcb->sctp_ep, stcb,
2335                                             stcb->asoc.primary_destination);
2336 #else
2337                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2338                                             SCTP_ADDR_NOT_LOCKED);
2339 #endif
2340                                 }
2341                         }
2342                 }               /* for each stcb */
2343         }                       /* for each inp */
2344 }
2345
2346 static struct sockaddr *
2347 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2348 {
2349         struct sctp_vrf *vrf = NULL;
2350         struct sctp_ifn *sctp_ifn;
2351         struct sctp_ifa *sctp_ifa;
2352
2353         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2354                 SCTP_IPI_ADDR_RLOCK();
2355         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2356         if (vrf == NULL) {
2357                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2358                         SCTP_IPI_ADDR_RUNLOCK();
2359                 return (NULL);
2360         }
2361         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2362                 if (stcb->asoc.loopback_scope == 0 &&
2363                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2364                         /* Skip if loopback_scope not set */
2365                         continue;
2366                 }
2367                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2368                         if (sctp_ifa->address.sa.sa_family == AF_INET &&
2369                             stcb->asoc.ipv4_addr_legal) {
2370                                 struct sockaddr_in *sin;
2371
2372                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2373                                 if (sin->sin_addr.s_addr == 0) {
2374                                         /* skip unspecifed addresses */
2375                                         continue;
2376                                 }
2377                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2378                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2379                                         continue;
2380
2381                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
2382                                         continue;
2383                                 /* found a valid local v4 address to use */
2384                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2385                                         SCTP_IPI_ADDR_RUNLOCK();
2386                                 return (&sctp_ifa->address.sa);
2387                         } else if (sctp_ifa->address.sa.sa_family == AF_INET6 &&
2388                             stcb->asoc.ipv6_addr_legal) {
2389                                 struct sockaddr_in6 *sin6;
2390
2391                                 if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2392                                         continue;
2393                                 }
2394                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2395                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2396                                         /* we skip unspecifed addresses */
2397                                         continue;
2398                                 }
2399                                 if (stcb->asoc.local_scope == 0 &&
2400                                     IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2401                                         continue;
2402                                 if (stcb->asoc.site_scope == 0 &&
2403                                     IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2404                                         continue;
2405
2406                                 /* found a valid local v6 address to use */
2407                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2408                                         SCTP_IPI_ADDR_RUNLOCK();
2409                                 return (&sctp_ifa->address.sa);
2410                         }
2411                 }
2412         }
2413         /* no valid addresses found */
2414         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2415                 SCTP_IPI_ADDR_RUNLOCK();
2416         return (NULL);
2417 }
2418
2419 static struct sockaddr *
2420 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2421 {
2422         struct sctp_laddr *laddr;
2423
2424         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2425                 if (laddr->ifa == NULL) {
2426                         continue;
2427                 }
2428                 /* is the address restricted ? */
2429                 if (sctp_is_addr_restricted(stcb, laddr->ifa))
2430                         continue;
2431
2432                 /* found a valid local address to use */
2433                 return (&laddr->ifa->address.sa);
2434         }
2435         /* no valid addresses found */
2436         return (NULL);
2437 }
2438
2439 /*
2440  * builds an ASCONF chunk from queued ASCONF params.
2441  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2442  */
2443 struct mbuf *
2444 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2445 {
2446         struct mbuf *m_asconf, *m_asconf_chk;
2447         struct sctp_asconf_addr *aa;
2448         struct sctp_asconf_chunk *acp;
2449         struct sctp_asconf_paramhdr *aph;
2450         struct sctp_asconf_addr_param *aap;
2451         uint32_t p_length;
2452         uint32_t correlation_id = 1;    /* 0 is reserved... */
2453         caddr_t ptr, lookup_ptr;
2454         uint8_t lookup_used = 0;
2455
2456         /* are there any asconf params to send? */
2457         if (TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
2458                 return (NULL);
2459         }
2460         /* can't send a new one if there is one in flight already */
2461         if (stcb->asoc.asconf_sent > 0) {
2462                 return (NULL);
2463         }
2464         /*
2465          * get a chunk header mbuf and a cluster for the asconf params since
2466          * it's simpler to fill in the asconf chunk header lookup address on
2467          * the fly
2468          */
2469         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2470         if (m_asconf_chk == NULL) {
2471                 /* no mbuf's */
2472                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2473                     "compose_asconf: couldn't get chunk mbuf!\n");
2474                 return (NULL);
2475         }
2476         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2477         if (m_asconf == NULL) {
2478                 /* no mbuf's */
2479                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2480                     "compose_asconf: couldn't get mbuf!\n");
2481                 sctp_m_freem(m_asconf_chk);
2482                 return (NULL);
2483         }
2484         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2485         SCTP_BUF_LEN(m_asconf) = 0;
2486         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2487         bzero(acp, sizeof(struct sctp_asconf_chunk));
2488         /* save pointers to lookup address and asconf params */
2489         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2490         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2491
2492         /* fill in chunk header info */
2493         acp->ch.chunk_type = SCTP_ASCONF;
2494         acp->ch.chunk_flags = 0;
2495         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2496
2497         /* add parameters... up to smallest MTU allowed */
2498         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2499                 /* get the parameter length */
2500                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2501                 /* will it fit in current chunk? */
2502                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2503                         /* won't fit, so we're done with this chunk */
2504                         break;
2505                 }
2506                 /* assign (and store) a correlation id */
2507                 aa->ap.aph.correlation_id = correlation_id++;
2508
2509                 /*
2510                  * fill in address if we're doing a delete this is a simple
2511                  * way for us to fill in the correlation address, which
2512                  * should only be used by the peer if we're deleting our
2513                  * source address and adding a new address (e.g. renumbering
2514                  * case)
2515                  */
2516                 if (lookup_used == 0 &&
2517                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2518                         struct sctp_ipv6addr_param *lookup;
2519                         uint16_t p_size, addr_size;
2520
2521                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2522                         lookup->ph.param_type =
2523                             htons(aa->ap.addrp.ph.param_type);
2524                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2525                                 /* copy IPv6 address */
2526                                 p_size = sizeof(struct sctp_ipv6addr_param);
2527                                 addr_size = sizeof(struct in6_addr);
2528                         } else {
2529                                 /* copy IPv4 address */
2530                                 p_size = sizeof(struct sctp_ipv4addr_param);
2531                                 addr_size = sizeof(struct in_addr);
2532                         }
2533                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2534                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2535                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2536                         lookup_used = 1;
2537                 }
2538                 /* copy into current space */
2539                 memcpy(ptr, &aa->ap, p_length);
2540
2541                 /* network elements and update lengths */
2542                 aph = (struct sctp_asconf_paramhdr *)ptr;
2543                 aap = (struct sctp_asconf_addr_param *)ptr;
2544                 /* correlation_id is transparent to peer, no htonl needed */
2545                 aph->ph.param_type = htons(aph->ph.param_type);
2546                 aph->ph.param_length = htons(aph->ph.param_length);
2547                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2548                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2549
2550                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2551                 ptr += SCTP_SIZE32(p_length);
2552
2553                 /*
2554                  * these params are removed off the pending list upon
2555                  * getting an ASCONF-ACK back from the peer, just set flag
2556                  */
2557                 aa->sent = 1;
2558         }
2559         /* check to see if the lookup addr has been populated yet */
2560         if (lookup_used == 0) {
2561                 /* NOTE: if the address param is optional, can skip this... */
2562                 /* add any valid (existing) address... */
2563                 struct sctp_ipv6addr_param *lookup;
2564                 uint16_t p_size, addr_size;
2565                 struct sockaddr *found_addr;
2566                 caddr_t addr_ptr;
2567
2568                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2569                         found_addr = sctp_find_valid_localaddr(stcb,
2570                             addr_locked);
2571                 else
2572                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2573
2574                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2575                 if (found_addr != NULL) {
2576                         if (found_addr->sa_family == AF_INET6) {
2577                                 /* copy IPv6 address */
2578                                 lookup->ph.param_type =
2579                                     htons(SCTP_IPV6_ADDRESS);
2580                                 p_size = sizeof(struct sctp_ipv6addr_param);
2581                                 addr_size = sizeof(struct in6_addr);
2582                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2583                                     found_addr)->sin6_addr;
2584                         } else {
2585                                 /* copy IPv4 address */
2586                                 lookup->ph.param_type =
2587                                     htons(SCTP_IPV4_ADDRESS);
2588                                 p_size = sizeof(struct sctp_ipv4addr_param);
2589                                 addr_size = sizeof(struct in_addr);
2590                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2591                                     found_addr)->sin_addr;
2592                         }
2593                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2594                         memcpy(lookup->addr, addr_ptr, addr_size);
2595                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2596                         lookup_used = 1;
2597                 } else {
2598                         /* uh oh... don't have any address?? */
2599                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2600                             "compose_asconf: no lookup addr!\n");
2601                         /* for now, we send a IPv4 address of 0.0.0.0 */
2602                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2603                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2604                         bzero(lookup->addr, sizeof(struct in_addr));
2605                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2606                         lookup_used = 1;
2607                 }
2608         }
2609         /* chain it all together */
2610         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2611         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2612         acp->ch.chunk_length = ntohs(*retlen);
2613
2614         /* update "sent" flag */
2615         stcb->asoc.asconf_sent++;
2616
2617         return (m_asconf_chk);
2618 }
2619
2620 /*
2621  * section to handle address changes before an association is up eg. changes
2622  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2623  */
2624
2625 /*
2626  * processes the (local) addresses in the INIT-ACK chunk
2627  */
2628 static void
2629 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2630     unsigned int offset, unsigned int length)
2631 {
2632         struct sctp_paramhdr tmp_param, *ph;
2633         uint16_t plen, ptype;
2634         struct sctp_ifa *sctp_ifa;
2635         struct sctp_ipv6addr_param addr_store;
2636         struct sockaddr_in6 sin6;
2637         struct sockaddr_in sin;
2638         struct sockaddr *sa;
2639         uint32_t vrf_id;
2640
2641         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2642         if (stcb == NULL)       /* Un-needed check for SA */
2643                 return;
2644
2645         /* convert to upper bound */
2646         length += offset;
2647
2648         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2649                 return;
2650         }
2651         /* init the addresses */
2652         bzero(&sin6, sizeof(sin6));
2653         sin6.sin6_family = AF_INET6;
2654         sin6.sin6_len = sizeof(sin6);
2655         sin6.sin6_port = stcb->rport;
2656
2657         bzero(&sin, sizeof(sin));
2658         sin.sin_len = sizeof(sin);
2659         sin.sin_family = AF_INET;
2660         sin.sin_port = stcb->rport;
2661
2662         /* go through the addresses in the init-ack */
2663         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2664             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2665         while (ph != NULL) {
2666                 ptype = ntohs(ph->param_type);
2667                 plen = ntohs(ph->param_length);
2668                 if (ptype == SCTP_IPV6_ADDRESS) {
2669                         struct sctp_ipv6addr_param *a6p;
2670
2671                         /* get the entire IPv6 address param */
2672                         a6p = (struct sctp_ipv6addr_param *)
2673                             sctp_m_getptr(m, offset,
2674                             sizeof(struct sctp_ipv6addr_param),
2675                             (uint8_t *) & addr_store);
2676                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2677                             a6p == NULL) {
2678                                 return;
2679                         }
2680                         memcpy(&sin6.sin6_addr, a6p->addr,
2681                             sizeof(struct in6_addr));
2682                         sa = (struct sockaddr *)&sin6;
2683                 } else if (ptype == SCTP_IPV4_ADDRESS) {
2684                         struct sctp_ipv4addr_param *a4p;
2685
2686                         /* get the entire IPv4 address param */
2687                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2688                             sizeof(struct sctp_ipv4addr_param),
2689                             (uint8_t *) & addr_store);
2690                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2691                             a4p == NULL) {
2692                                 return;
2693                         }
2694                         sin.sin_addr.s_addr = a4p->addr;
2695                         sa = (struct sockaddr *)&sin;
2696                 } else {
2697                         goto next_addr;
2698                 }
2699
2700                 /* see if this address really (still) exists */
2701                 if (stcb) {
2702                         vrf_id = stcb->asoc.vrf_id;
2703                 } else {
2704                         vrf_id = SCTP_DEFAULT_VRFID;
2705                 }
2706                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2707                     SCTP_ADDR_NOT_LOCKED);
2708                 if (sctp_ifa == NULL) {
2709                         /* address doesn't exist anymore */
2710                         int status;
2711
2712                         /* are ASCONFs allowed ? */
2713                         if ((sctp_is_feature_on(stcb->sctp_ep,
2714                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2715                             stcb->asoc.peer_supports_asconf) {
2716                                 /* queue an ASCONF DEL_IP_ADDRESS */
2717                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2718                                 /*
2719                                  * if queued ok, and in correct state, send
2720                                  * out the ASCONF.
2721                                  */
2722                                 if (status == 0 &&
2723                                     SCTP_GET_STATE(&stcb->asoc) ==
2724                                     SCTP_STATE_OPEN) {
2725 #ifdef SCTP_TIMER_BASED_ASCONF
2726                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2727                                             stcb->sctp_ep, stcb,
2728                                             stcb->asoc.primary_destination);
2729 #else
2730                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2731                                             SCTP_ADDR_NOT_LOCKED);
2732 #endif
2733                                 }
2734                         }
2735                 }
2736 next_addr:
2737                 /*
2738                  * Sanity check:  Make sure the length isn't 0, otherwise
2739                  * we'll be stuck in this loop for a long time...
2740                  */
2741                 if (SCTP_SIZE32(plen) == 0) {
2742                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2743                             plen, ptype);
2744                         return;
2745                 }
2746                 /* get next parameter */
2747                 offset += SCTP_SIZE32(plen);
2748                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2749                         return;
2750                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2751                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2752         }                       /* while */
2753 }
2754
2755 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2756 /*
2757  * checks to see if a specific address is in the initack address list returns
2758  * 1 if found, 0 if not
2759  */
2760 static uint32_t
2761 sctp_addr_in_initack(struct sctp_tcb *stcb, struct mbuf *m, uint32_t offset,
2762     uint32_t length, struct sockaddr *sa)
2763 {
2764         struct sctp_paramhdr tmp_param, *ph;
2765         uint16_t plen, ptype;
2766         struct sctp_ipv6addr_param addr_store;
2767         struct sockaddr_in *sin;
2768         struct sctp_ipv4addr_param *a4p;
2769
2770 #ifdef INET6
2771         struct sockaddr_in6 *sin6;
2772         struct sctp_ipv6addr_param *a6p;
2773         struct sockaddr_in6 sin6_tmp;
2774
2775 #endif                          /* INET6 */
2776
2777         if (
2778 #ifdef INET6
2779             (sa->sa_family != AF_INET6) &&
2780 #endif                          /* INET6 */
2781             (sa->sa_family != AF_INET))
2782                 return (0);
2783
2784         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2785         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2786         /* convert to upper bound */
2787         length += offset;
2788
2789         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2790                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2791                     "find_initack_addr: invalid offset?\n");
2792                 return (0);
2793         }
2794         /* go through the addresses in the init-ack */
2795         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2796             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2797         while (ph != NULL) {
2798                 ptype = ntohs(ph->param_type);
2799                 plen = ntohs(ph->param_length);
2800 #ifdef INET6
2801                 if (ptype == SCTP_IPV6_ADDRESS && sa->sa_family == AF_INET6) {
2802                         /* get the entire IPv6 address param */
2803                         a6p = (struct sctp_ipv6addr_param *)
2804                             sctp_m_getptr(m, offset,
2805                             sizeof(struct sctp_ipv6addr_param),
2806                             (uint8_t *) & addr_store);
2807                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2808                             (ph == NULL) ||
2809                             (a6p == NULL)) {
2810                                 return (0);
2811                         }
2812                         sin6 = (struct sockaddr_in6 *)sa;
2813                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2814                                 /* create a copy and clear scope */
2815                                 memcpy(&sin6_tmp, sin6,
2816                                     sizeof(struct sockaddr_in6));
2817                                 sin6 = &sin6_tmp;
2818                                 in6_clearscope(&sin6->sin6_addr);
2819                         }
2820                         if (memcmp(&sin6->sin6_addr, a6p->addr,
2821                             sizeof(struct in6_addr)) == 0) {
2822                                 /* found it */
2823                                 return (1);
2824                         }
2825                 } else
2826 #endif                          /* INET6 */
2827
2828                         if (ptype == SCTP_IPV4_ADDRESS &&
2829                     sa->sa_family == AF_INET) {
2830                         /* get the entire IPv4 address param */
2831                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m,
2832                             offset, sizeof(struct sctp_ipv4addr_param),
2833                             (uint8_t *) & addr_store);
2834                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2835                             (ph == NULL) ||
2836                             (a4p == NULL)) {
2837                                 return (0);
2838                         }
2839                         sin = (struct sockaddr_in *)sa;
2840                         if (sin->sin_addr.s_addr == a4p->addr) {
2841                                 /* found it */
2842                                 return (1);
2843                         }
2844                 }
2845                 /* get next parameter */
2846                 offset += SCTP_SIZE32(plen);
2847                 if (offset + sizeof(struct sctp_paramhdr) > length)
2848                         return (0);
2849                 ph = (struct sctp_paramhdr *)
2850                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2851                     (uint8_t *) & tmp_param);
2852         }                       /* while */
2853         /* not found! */
2854         return (0);
2855 }
2856
2857 /*
2858  * makes sure that the current endpoint local addr list is consistent with
2859  * the new association (eg. subset bound, asconf allowed) adds addresses as
2860  * necessary
2861  */
2862 static void
2863 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2864     int length, struct sockaddr *init_addr)
2865 {
2866         struct sctp_laddr *laddr;
2867
2868         /* go through the endpoint list */
2869         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2870                 /* be paranoid and validate the laddr */
2871                 if (laddr->ifa == NULL) {
2872                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2873                             "check_addr_list_ep: laddr->ifa is NULL");
2874                         continue;
2875                 }
2876                 if (laddr->ifa == NULL) {
2877                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
2878                         continue;
2879                 }
2880                 /* do i have it implicitly? */
2881                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
2882                         continue;
2883                 }
2884                 /* check to see if in the init-ack */
2885                 if (!sctp_addr_in_initack(stcb, m, offset, length,
2886                     &laddr->ifa->address.sa)) {
2887                         /* try to add it */
2888                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
2889                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
2890                 }
2891         }
2892 }
2893
2894 /*
2895  * makes sure that the current kernel address list is consistent with the new
2896  * association (with all addrs bound) adds addresses as necessary
2897  */
2898 static void
2899 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2900     int length, struct sockaddr *init_addr,
2901     uint16_t local_scope, uint16_t site_scope,
2902     uint16_t ipv4_scope, uint16_t loopback_scope)
2903 {
2904         struct sctp_vrf *vrf = NULL;
2905         struct sctp_ifn *sctp_ifn;
2906         struct sctp_ifa *sctp_ifa;
2907         uint32_t vrf_id;
2908
2909         if (stcb) {
2910                 vrf_id = stcb->asoc.vrf_id;
2911         } else {
2912                 return;
2913         }
2914         SCTP_IPI_ADDR_RLOCK();
2915         vrf = sctp_find_vrf(vrf_id);
2916         if (vrf == NULL) {
2917                 SCTP_IPI_ADDR_RUNLOCK();
2918                 return;
2919         }
2920         /* go through all our known interfaces */
2921         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2922                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2923                         /* skip loopback interface */
2924                         continue;
2925                 }
2926                 /* go through each interface address */
2927                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2928                         /* do i have it implicitly? */
2929                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
2930                                 continue;
2931                         }
2932                         /* check to see if in the init-ack */
2933                         if (!sctp_addr_in_initack(stcb, m, offset, length,
2934                             &sctp_ifa->address.sa)) {
2935                                 /* try to add it */
2936                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
2937                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
2938                                     SCTP_ADDR_LOCKED);
2939                         }
2940                 }               /* end foreach ifa */
2941         }                       /* end foreach ifn */
2942         SCTP_IPI_ADDR_RUNLOCK();
2943 }
2944
2945 /*
2946  * validates an init-ack chunk (from a cookie-echo) with current addresses
2947  * adds addresses from the init-ack into our local address list, if needed
2948  * queues asconf adds/deletes addresses as needed and makes appropriate list
2949  * changes for source address selection m, offset: points to the start of the
2950  * address list in an init-ack chunk length: total length of the address
2951  * params only init_addr: address where my INIT-ACK was sent from
2952  */
2953 void
2954 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2955     int length, struct sockaddr *init_addr,
2956     uint16_t local_scope, uint16_t site_scope,
2957     uint16_t ipv4_scope, uint16_t loopback_scope)
2958 {
2959         /* process the local addresses in the initack */
2960         sctp_process_initack_addresses(stcb, m, offset, length);
2961
2962         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2963                 /* bound all case */
2964                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
2965                     local_scope, site_scope, ipv4_scope, loopback_scope);
2966         } else {
2967                 /* subset bound case */
2968                 if (sctp_is_feature_on(stcb->sctp_ep,
2969                     SCTP_PCB_FLAGS_DO_ASCONF)) {
2970                         /* asconf's allowed */
2971                         sctp_check_address_list_ep(stcb, m, offset, length,
2972                             init_addr);
2973                 }
2974                 /* else, no asconfs allowed, so what we sent is what we get */
2975         }
2976 }
2977
2978 /*
2979  * sctp_bindx() support
2980  */
2981 uint32_t
2982 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
2983     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
2984 {
2985         struct sctp_ifa *ifa;
2986
2987         if (sa->sa_len == 0) {
2988                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
2989                 return (EINVAL);
2990         }
2991         if (sctp_ifap) {
2992                 ifa = sctp_ifap;
2993         } else if (type == SCTP_ADD_IP_ADDRESS) {
2994                 /* For an add the address MUST be on the system */
2995                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2996         } else if (type == SCTP_DEL_IP_ADDRESS) {
2997                 /* For a delete we need to find it in the inp */
2998                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
2999         } else {
3000                 ifa = NULL;
3001         }
3002         if (ifa != NULL) {
3003                 /* add this address */
3004                 struct sctp_asconf_iterator *asc;
3005                 struct sctp_laddr *wi;
3006
3007                 SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3008                     sizeof(struct sctp_asconf_iterator),
3009                     SCTP_M_ASC_IT);
3010                 if (asc == NULL) {
3011                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3012                         return (ENOMEM);
3013                 }
3014                 wi = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr,
3015                     struct sctp_laddr);
3016                 if (wi == NULL) {
3017                         SCTP_FREE(asc, SCTP_M_ASC_IT);
3018                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3019                         return (ENOMEM);
3020                 }
3021                 if (type == SCTP_ADD_IP_ADDRESS) {
3022                         sctp_add_local_addr_ep(inp, ifa, type);
3023                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3024                         struct sctp_laddr *laddr;
3025
3026                         if (inp->laddr_count < 2) {
3027                                 /* can't delete the last local address */
3028                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3029                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
3030                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3031                                 return (EINVAL);
3032                         }
3033                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3034                             sctp_nxt_addr) {
3035                                 if (ifa == laddr->ifa) {
3036                                         /* Mark in the delete */
3037                                         laddr->action = type;
3038                                 }
3039                         }
3040                 }
3041                 LIST_INIT(&asc->list_of_work);
3042                 asc->cnt = 1;
3043                 SCTP_INCR_LADDR_COUNT();
3044                 wi->ifa = ifa;
3045                 wi->action = type;
3046                 atomic_add_int(&ifa->refcount, 1);
3047                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3048                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3049                     sctp_asconf_iterator_stcb,
3050                     sctp_asconf_iterator_ep_end,
3051                     SCTP_PCB_ANY_FLAGS,
3052                     SCTP_PCB_ANY_FEATURES,
3053                     SCTP_ASOC_ANY_STATE,
3054                     (void *)asc, 0,
3055                     sctp_asconf_iterator_end, inp, 0);
3056         } else {
3057                 /* invalid address! */
3058                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3059                 return (EADDRNOTAVAIL);
3060         }
3061         return (0);
3062 }