sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_asconf.c,v 1.24 2005/03/06 16:04:16 itojun Exp $  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35 #include <netinet/sctp_os.h>
  36 #include <netinet/sctp_var.h>
  37 #include <netinet/sctp_sysctl.h>
  38 #include <netinet/sctp_pcb.h>
  39 #include <netinet/sctp_header.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_output.h>
  42 #include <netinet/sctp_asconf.h>
  43 #include <netinet/sctp_timer.h>
  44
  45 /*
  46  * debug flags:
  47  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  48  * SCTP_DEBUG_ASCONF2: detailed info
  49  */
  50 #ifdef SCTP_DEBUG
  51 #endif                          /* SCTP_DEBUG */
  52
  53
  54 static void
  55 sctp_asconf_get_source_ip(struct mbuf *m, struct sockaddr *sa)
  56 {
  57         struct ip *iph;
  58         struct sockaddr_in *sin;
  59
  60 #ifdef INET6
  61         struct sockaddr_in6 *sin6;
  62
  63 #endif
  64
  65         iph = mtod(m, struct ip *);
  66         if (iph->ip_v == IPVERSION) {
  67                 /* IPv4 source */
  68                 sin = (struct sockaddr_in *)sa;
  69                 bzero(sin, sizeof(*sin));
  70                 sin->sin_family = AF_INET;
  71                 sin->sin_len = sizeof(struct sockaddr_in);
  72                 sin->sin_port = 0;
  73                 sin->sin_addr.s_addr = iph->ip_src.s_addr;
  74                 return;
  75         }
  76 #ifdef INET6
  77         else if (iph->ip_v == (IPV6_VERSION >> 4)) {
  78                 /* IPv6 source */
  79                 struct ip6_hdr *ip6;
  80
  81                 sin6 = (struct sockaddr_in6 *)sa;
  82                 bzero(sin6, sizeof(*sin6));
  83                 sin6->sin6_family = AF_INET6;
  84                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  85                 sin6->sin6_port = 0;
  86                 ip6 = mtod(m, struct ip6_hdr *);
  87                 sin6->sin6_addr = ip6->ip6_src;
  88                 return;
  89         }
  90 #endif                          /* INET6 */
  91         else
  92                 return;
  93 }
  94
  95 /*
  96  * draft-ietf-tsvwg-addip-sctp
  97  *
  98  * An ASCONF parameter queue exists per asoc which holds the pending address
  99  * operations.  Lists are updated upon receipt of ASCONF-ACK.
 100  *
 101  * A restricted_addrs list exists per assoc to hold local addresses that are
 102  * not (yet) usable by the assoc as a source address.  These addresses are
 103  * either pending an ASCONF operation (and exist on the ASCONF parameter
 104  * queue), or they are permanently restricted (the peer has returned an
 105  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
 106  *
 107  * Deleted addresses are always immediately removed from the lists as they will
 108  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
 109  * only if allowed.
 110  */
 111
 112 /*
 113  * ASCONF parameter processing.
 114  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
 115  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
 116  * FIX: allocating this many mbufs on the fly is pretty inefficient...
 117  */
 118 static struct mbuf *
 119 sctp_asconf_success_response(uint32_t id)
 120 {
 121         struct mbuf *m_reply = NULL;
 122         struct sctp_asconf_paramhdr *aph;
 123
 124         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
 125             0, M_DONTWAIT, 1, MT_DATA);
 126         if (m_reply == NULL) {
 127                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 128                     "asconf_success_response: couldn't get mbuf!\n");
 129                 return NULL;
 130         }
 131         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 132         aph->correlation_id = id;
 133         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
 134         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
 135         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 136         aph->ph.param_length = htons(aph->ph.param_length);
 137
 138         return m_reply;
 139 }
 140
 141 static struct mbuf *
 142 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 143     uint16_t tlv_length)
 144 {
 145         struct mbuf *m_reply = NULL;
 146         struct sctp_asconf_paramhdr *aph;
 147         struct sctp_error_cause *error;
 148         uint8_t *tlv;
 149
 150         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 151             tlv_length +
 152             sizeof(struct sctp_error_cause)),
 153             0, M_DONTWAIT, 1, MT_DATA);
 154         if (m_reply == NULL) {
 155                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 156                     "asconf_error_response: couldn't get mbuf!\n");
 157                 return NULL;
 158         }
 159         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 160         error = (struct sctp_error_cause *)(aph + 1);
 161
 162         aph->correlation_id = id;
 163         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 164         error->code = htons(cause);
 165         error->length = tlv_length + sizeof(struct sctp_error_cause);
 166         aph->ph.param_length = error->length +
 167             sizeof(struct sctp_asconf_paramhdr);
 168
 169         if (aph->ph.param_length > MLEN) {
 170                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 171                     "asconf_error_response: tlv_length (%xh) too big\n",
 172                     tlv_length);
 173                 sctp_m_freem(m_reply);  /* discard */
 174                 return NULL;
 175         }
 176         if (error_tlv != NULL) {
 177                 tlv = (uint8_t *) (error + 1);
 178                 memcpy(tlv, error_tlv, tlv_length);
 179         }
 180         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 181         error->length = htons(error->length);
 182         aph->ph.param_length = htons(aph->ph.param_length);
 183
 184         return m_reply;
 185 }
 186
 187 static struct mbuf *
 188 sctp_process_asconf_add_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 189     struct sctp_tcb *stcb, int response_required)
 190 {
 191         struct mbuf *m_reply = NULL;
 192         struct sockaddr_storage sa_source, sa_store;
 193         struct sctp_ipv4addr_param *v4addr;
 194         uint16_t param_type, param_length, aparam_length;
 195         struct sockaddr *sa;
 196         struct sockaddr_in *sin;
 197         int zero_address = 0;
 198
 199 #ifdef INET6
 200         struct sockaddr_in6 *sin6;
 201         struct sctp_ipv6addr_param *v6addr;
 202
 203 #endif                          /* INET6 */
 204
 205         aparam_length = ntohs(aph->ph.param_length);
 206         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 207 #ifdef INET6
 208         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 209 #endif                          /* INET6 */
 210         param_type = ntohs(v4addr->ph.param_type);
 211         param_length = ntohs(v4addr->ph.param_length);
 212
 213         sa = (struct sockaddr *)&sa_store;
 214         switch (param_type) {
 215         case SCTP_IPV4_ADDRESS:
 216                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 217                         /* invalid param size */
 218                         return NULL;
 219                 }
 220                 sin = (struct sockaddr_in *)&sa_store;
 221                 bzero(sin, sizeof(*sin));
 222                 sin->sin_family = AF_INET;
 223                 sin->sin_len = sizeof(struct sockaddr_in);
 224                 sin->sin_port = stcb->rport;
 225                 sin->sin_addr.s_addr = v4addr->addr;
 226                 if (sin->sin_addr.s_addr == INADDR_ANY)
 227                         zero_address = 1;
 228                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 229                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 230                 break;
 231         case SCTP_IPV6_ADDRESS:
 232 #ifdef INET6
 233                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 234                         /* invalid param size */
 235                         return NULL;
 236                 }
 237                 sin6 = (struct sockaddr_in6 *)&sa_store;
 238                 bzero(sin6, sizeof(*sin6));
 239                 sin6->sin6_family = AF_INET6;
 240                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 241                 sin6->sin6_port = stcb->rport;
 242                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 243                     sizeof(struct in6_addr));
 244                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 245                         zero_address = 1;
 246                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 247                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 248 #else
 249                 /* IPv6 not enabled! */
 250                 /* FIX ME: currently sends back an invalid param error */
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph, aparam_length);
 253                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 254                     "process_asconf_add_ip: v6 disabled- skipping ");
 255                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 256                 return m_reply;
 257 #endif
 258                 break;
 259         default:
 260                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 261                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 262                     aparam_length);
 263                 return m_reply;
 264         }                       /* end switch */
 265
 266         /* if 0.0.0.0/::0, add the source address instead */
 267         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 268                 sa = (struct sockaddr *)&sa_source;
 269                 sctp_asconf_get_source_ip(m, sa);
 270                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 271                     "process_asconf_add_ip: using source addr ");
 272                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 273         }
 274         /* add the address */
 275         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE,
 276             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 277                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 278                     "process_asconf_add_ip: error adding address\n");
 279                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 280                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 281                     aparam_length);
 282         } else {
 283                 /* notify upper layer */
 284                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 285                 if (response_required) {
 286                         m_reply =
 287                             sctp_asconf_success_response(aph->correlation_id);
 288                 }
 289                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
 290                     NULL, SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 291                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 292                     stcb, NULL);
 293         }
 294
 295         return m_reply;
 296 }
 297
 298 static int
 299 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 300 {
 301         struct sctp_nets *src_net, *net;
 302
 303         /* make sure the source address exists as a destination net */
 304         src_net = sctp_findnet(stcb, src);
 305         if (src_net == NULL) {
 306                 /* not found */
 307                 return -1;
 308         }
 309         /* delete all destination addresses except the source */
 310         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 311                 if (net != src_net) {
 312                         /* delete this address */
 313                         sctp_remove_net(stcb, net);
 314                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 315                             "asconf_del_remote_addrs_except: deleting ");
 316                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 317                             (struct sockaddr *)&net->ro._l_addr);
 318                         /* notify upper layer */
 319                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 320                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 321                 }
 322         }
 323         return 0;
 324 }
 325
 326 static struct mbuf *
 327 sctp_process_asconf_delete_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
 328     struct sctp_tcb *stcb, int response_required)
 329 {
 330         struct mbuf *m_reply = NULL;
 331         struct sockaddr_storage sa_source, sa_store;
 332         struct sctp_ipv4addr_param *v4addr;
 333         uint16_t param_type, param_length, aparam_length;
 334         struct sockaddr *sa;
 335         struct sockaddr_in *sin;
 336         int zero_address = 0;
 337         int result;
 338
 339 #ifdef INET6
 340         struct sockaddr_in6 *sin6;
 341         struct sctp_ipv6addr_param *v6addr;
 342
 343 #endif                          /* INET6 */
 344
 345         /* get the source IP address for src and 0.0.0.0/::0 delete checks */
 346         sctp_asconf_get_source_ip(m, (struct sockaddr *)&sa_source);
 347
 348         aparam_length = ntohs(aph->ph.param_length);
 349         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 350 #ifdef INET6
 351         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 352 #endif                          /* INET6 */
 353         param_type = ntohs(v4addr->ph.param_type);
 354         param_length = ntohs(v4addr->ph.param_length);
 355
 356         sa = (struct sockaddr *)&sa_store;
 357         switch (param_type) {
 358         case SCTP_IPV4_ADDRESS:
 359                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 360                         /* invalid param size */
 361                         return NULL;
 362                 }
 363                 sin = (struct sockaddr_in *)&sa_store;
 364                 bzero(sin, sizeof(*sin));
 365                 sin->sin_family = AF_INET;
 366                 sin->sin_len = sizeof(struct sockaddr_in);
 367                 sin->sin_port = stcb->rport;
 368                 sin->sin_addr.s_addr = v4addr->addr;
 369                 if (sin->sin_addr.s_addr == INADDR_ANY)
 370                         zero_address = 1;
 371                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 372                     "process_asconf_delete_ip: deleting ");
 373                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 374                 break;
 375         case SCTP_IPV6_ADDRESS:
 376                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 377                         /* invalid param size */
 378                         return NULL;
 379                 }
 380 #ifdef INET6
 381                 sin6 = (struct sockaddr_in6 *)&sa_store;
 382                 bzero(sin6, sizeof(*sin6));
 383                 sin6->sin6_family = AF_INET6;
 384                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 385                 sin6->sin6_port = stcb->rport;
 386                 memcpy(&sin6->sin6_addr, v6addr->addr,
 387                     sizeof(struct in6_addr));
 388                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 389                         zero_address = 1;
 390                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 391                     "process_asconf_delete_ip: deleting ");
 392                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 393 #else
 394                 /* IPv6 not enabled!  No "action" needed; just ack it */
 395                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 396                     "process_asconf_delete_ip: v6 disabled- ignoring: ");
 397                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 398                 /* just respond with a "success" ASCONF-ACK */
 399                 return NULL;
 400 #endif
 401                 break;
 402         default:
 403                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 404                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 405                     aparam_length);
 406                 return m_reply;
 407         }
 408
 409         /* make sure the source address is not being deleted */
 410         if (sctp_cmpaddr(sa, (struct sockaddr *)&sa_source)) {
 411                 /* trying to delete the source address! */
 412                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 413                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 414                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 415                     aparam_length);
 416                 return m_reply;
 417         }
 418         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 419         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 420                 result = sctp_asconf_del_remote_addrs_except(stcb,
 421                     (struct sockaddr *)&sa_source);
 422
 423                 if (result) {
 424                         /* src address did not exist? */
 425                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 426                         /* what error to reply with?? */
 427                         m_reply =
 428                             sctp_asconf_error_response(aph->correlation_id,
 429                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 430                             aparam_length);
 431                 } else if (response_required) {
 432                         m_reply =
 433                             sctp_asconf_success_response(aph->correlation_id);
 434                 }
 435                 return m_reply;
 436         }
 437         /* delete the address */
 438         result = sctp_del_remote_addr(stcb, sa);
 439         /*
 440          * note if result == -2, the address doesn't exist in the asoc but
 441          * since it's being deleted anyways, we just ack the delete -- but
 442          * this probably means something has already gone awry
 443          */
 444         if (result == -1) {
 445                 /* only one address in the asoc */
 446                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 447                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 448                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 449                     aparam_length);
 450         } else {
 451                 if (response_required) {
 452                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 453                 }
 454                 /* notify upper layer */
 455                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 456         }
 457         return m_reply;
 458 }
 459
 460 static struct mbuf *
 461 sctp_process_asconf_set_primary(struct mbuf *m,
 462     struct sctp_asconf_paramhdr *aph,
 463     struct sctp_tcb *stcb, int response_required)
 464 {
 465         struct mbuf *m_reply = NULL;
 466         struct sockaddr_storage sa_source, sa_store;
 467         struct sctp_ipv4addr_param *v4addr;
 468         uint16_t param_type, param_length, aparam_length;
 469         struct sockaddr *sa;
 470         struct sockaddr_in *sin;
 471         int zero_address = 0;
 472
 473 #ifdef INET6
 474         struct sockaddr_in6 *sin6;
 475         struct sctp_ipv6addr_param *v6addr;
 476
 477 #endif                          /* INET6 */
 478
 479         aparam_length = ntohs(aph->ph.param_length);
 480         v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
 481 #ifdef INET6
 482         v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
 483 #endif                          /* INET6 */
 484         param_type = ntohs(v4addr->ph.param_type);
 485         param_length = ntohs(v4addr->ph.param_length);
 486
 487         sa = (struct sockaddr *)&sa_store;
 488         switch (param_type) {
 489         case SCTP_IPV4_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 491                         /* invalid param size */
 492                         return NULL;
 493                 }
 494                 sin = (struct sockaddr_in *)&sa_store;
 495                 bzero(sin, sizeof(*sin));
 496                 sin->sin_family = AF_INET;
 497                 sin->sin_len = sizeof(struct sockaddr_in);
 498                 sin->sin_addr.s_addr = v4addr->addr;
 499                 if (sin->sin_addr.s_addr == INADDR_ANY)
 500                         zero_address = 1;
 501                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 502                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 503                 break;
 504         case SCTP_IPV6_ADDRESS:
 505                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 506                         /* invalid param size */
 507                         return NULL;
 508                 }
 509 #ifdef INET6
 510                 sin6 = (struct sockaddr_in6 *)&sa_store;
 511                 bzero(sin6, sizeof(*sin6));
 512                 sin6->sin6_family = AF_INET6;
 513                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 514                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 515                     sizeof(struct in6_addr));
 516                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 517                         zero_address = 1;
 518                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 520 #else
 521                 /* IPv6 not enabled!  No "action" needed; just ack it */
 522                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 523                     "process_asconf_set_primary: v6 disabled- ignoring: ");
 524                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 525                 /* just respond with a "success" ASCONF-ACK */
 526                 return NULL;
 527 #endif
 528                 break;
 529         default:
 530                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 531                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 532                     aparam_length);
 533                 return m_reply;
 534         }
 535
 536         /* if 0.0.0.0/::0, use the source address instead */
 537         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 538                 sa = (struct sockaddr *)&sa_source;
 539                 sctp_asconf_get_source_ip(m, sa);
 540                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 541                     "process_asconf_set_primary: using source addr ");
 542                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 543         }
 544         /* set the primary address */
 545         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 546                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 547                     "process_asconf_set_primary: primary address set\n");
 548                 /* notify upper layer */
 549                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 550
 551                 if (response_required) {
 552                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 553                 }
 554                 /*
 555                  * Mobility adaptation. Ideally, when the reception of SET
 556                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 557                  * destination, unacknowledged DATA are retransmitted
 558                  * immediately to the new primary destination for seamless
 559                  * handover. If the destination is UNCONFIRMED and marked to
 560                  * REQ_PRIM, The retransmission occur when reception of the
 561                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 562                  * sctp_input.c) Also, when change of the primary
 563                  * destination, it is better that all subsequent new DATA
 564                  * containing already queued DATA are transmitted to the new
 565                  * primary destination. (by micchie)
 566                  */
 567                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 568                     SCTP_MOBILITY_BASE) ||
 569                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 570                     SCTP_MOBILITY_FASTHANDOFF)) &&
 571                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 572                     SCTP_MOBILITY_PRIM_DELETED) &&
 573                     (stcb->asoc.primary_destination->dest_state &
 574                     SCTP_ADDR_UNCONFIRMED) == 0) {
 575
 576                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 577                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 578                             SCTP_MOBILITY_FASTHANDOFF)) {
 579                                 sctp_assoc_immediate_retrans(stcb,
 580                                     stcb->asoc.primary_destination);
 581                         }
 582                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 583                             SCTP_MOBILITY_BASE)) {
 584                                 sctp_move_chunks_from_net(stcb,
 585                                     stcb->asoc.deleted_primary);
 586                         }
 587                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 588                             stcb->asoc.deleted_primary);
 589                 }
 590         } else {
 591                 /* couldn't set the requested primary address! */
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "process_asconf_set_primary: set primary failed!\n");
 594                 /* must have been an invalid address, so report */
 595                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 596                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 597                     aparam_length);
 598         }
 599
 600         return m_reply;
 601 }
 602
 603 /*
 604  * handles an ASCONF chunk.
 605  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 606  */
 607 void
 608 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 609     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 610     int first)
 611 {
 612         struct sctp_association *asoc;
 613         uint32_t serial_num;
 614         struct mbuf *n, *m_ack, *m_result, *m_tail;
 615         struct sctp_asconf_ack_chunk *ack_cp;
 616         struct sctp_asconf_paramhdr *aph, *ack_aph;
 617         struct sctp_ipv6addr_param *p_addr;
 618         unsigned int asconf_limit;
 619         int error = 0;          /* did an error occur? */
 620
 621         /* asconf param buffer */
 622         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 623         struct sctp_asconf_ack *ack, *ack_next;
 624
 625         /* verify minimum length */
 626         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 627                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 628                     "handle_asconf: chunk too small = %xh\n",
 629                     ntohs(cp->ch.chunk_length));
 630                 return;
 631         }
 632         asoc = &stcb->asoc;
 633         serial_num = ntohl(cp->serial_number);
 634
 635         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 636                 /* got a duplicate ASCONF */
 637                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 638                     "handle_asconf: got duplicate serial number = %xh\n",
 639                     serial_num);
 640                 return;
 641         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 642                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 643                     serial_num, asoc->asconf_seq_in + 1);
 644                 return;
 645         }
 646         /* it's the expected "next" sequence number, so process it */
 647         asoc->asconf_seq_in = serial_num;       /* update sequence */
 648         /* get length of all the param's in the ASCONF */
 649         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 650         SCTPDBG(SCTP_DEBUG_ASCONF1,
 651             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 652             asconf_limit, serial_num);
 653
 654         if (first) {
 655                 /* delete old cache */
 656                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing firstASCONF. Try to delte old cache\n");
 657
 658                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 659                         if (ack->serial_number == serial_num)
 660                                 break;
 661                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 662                             ack->serial_number, serial_num);
 663                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 664                         if (ack->data != NULL) {
 665                                 sctp_m_freem(ack->data);
 666                         }
 667                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 668                 }
 669         }
 670         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 671             M_DONTWAIT, 1, MT_DATA);
 672         if (m_ack == NULL) {
 673                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 674                     "handle_asconf: couldn't get mbuf!\n");
 675                 return;
 676         }
 677         m_tail = m_ack;         /* current reply chain's tail */
 678
 679         /* fill in ASCONF-ACK header */
 680         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 681         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 682         ack_cp->ch.chunk_flags = 0;
 683         ack_cp->serial_number = htonl(serial_num);
 684         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 685         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 686         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 687
 688         /* skip the lookup address parameter */
 689         offset += sizeof(struct sctp_asconf_chunk);
 690         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 691         if (p_addr == NULL) {
 692                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 693                     "handle_asconf: couldn't get lookup addr!\n");
 694                 /* respond with a missing/invalid mandatory parameter error */
 695                 return;
 696         }
 697         /* param_length is already validated in process_control... */
 698         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 699
 700         /* get pointer to first asconf param in ASCONF-ACK */
 701         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 702         if (ack_aph == NULL) {
 703                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 704                 return;
 705         }
 706         /* get pointer to first asconf param in ASCONF */
 707         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 708         if (aph == NULL) {
 709                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 710                 goto send_reply;
 711         }
 712         /* process through all parameters */
 713         while (aph != NULL) {
 714                 unsigned int param_length, param_type;
 715
 716                 param_type = ntohs(aph->ph.param_type);
 717                 param_length = ntohs(aph->ph.param_length);
 718                 if (offset + param_length > asconf_limit) {
 719                         /* parameter goes beyond end of chunk! */
 720                         sctp_m_freem(m_ack);
 721                         return;
 722                 }
 723                 m_result = NULL;
 724
 725                 if (param_length > sizeof(aparam_buf)) {
 726                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 727                         sctp_m_freem(m_ack);
 728                         return;
 729                 }
 730                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 731                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 732                         sctp_m_freem(m_ack);
 733                 }
 734                 /* get the entire parameter */
 735                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 736                 if (aph == NULL) {
 737                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 738                         sctp_m_freem(m_ack);
 739                         return;
 740                 }
 741                 switch (param_type) {
 742                 case SCTP_ADD_IP_ADDRESS:
 743                         asoc->peer_supports_asconf = 1;
 744                         m_result = sctp_process_asconf_add_ip(m, aph, stcb,
 745                             error);
 746                         break;
 747                 case SCTP_DEL_IP_ADDRESS:
 748                         asoc->peer_supports_asconf = 1;
 749                         m_result = sctp_process_asconf_delete_ip(m, aph, stcb,
 750                             error);
 751                         break;
 752                 case SCTP_ERROR_CAUSE_IND:
 753                         /* not valid in an ASCONF chunk */
 754                         break;
 755                 case SCTP_SET_PRIM_ADDR:
 756                         asoc->peer_supports_asconf = 1;
 757                         m_result = sctp_process_asconf_set_primary(m, aph,
 758                             stcb, error);
 759                         break;
 760                 case SCTP_NAT_VTAGS:
 761                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 762                         break;
 763                 case SCTP_SUCCESS_REPORT:
 764                         /* not valid in an ASCONF chunk */
 765                         break;
 766                 case SCTP_ULP_ADAPTATION:
 767                         /* FIX */
 768                         break;
 769                 default:
 770                         if ((param_type & 0x8000) == 0) {
 771                                 /* Been told to STOP at this param */
 772                                 asconf_limit = offset;
 773                                 /*
 774                                  * FIX FIX - We need to call
 775                                  * sctp_arethere_unrecognized_parameters()
 776                                  * to get a operr and send it for any
 777                                  * param's with the 0x4000 bit set OR do it
 778                                  * here ourselves... note we still must STOP
 779                                  * if the 0x8000 bit is clear.
 780                                  */
 781                         }
 782                         /* unknown/invalid param type */
 783                         break;
 784                 }               /* switch */
 785
 786                 /* add any (error) result to the reply mbuf chain */
 787                 if (m_result != NULL) {
 788                         SCTP_BUF_NEXT(m_tail) = m_result;
 789                         m_tail = m_result;
 790                         /* update lengths, make sure it's aligned too */
 791                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 792                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 793                         /* set flag to force success reports */
 794                         error = 1;
 795                 }
 796                 offset += SCTP_SIZE32(param_length);
 797                 /* update remaining ASCONF message length to process */
 798                 if (offset >= asconf_limit) {
 799                         /* no more data in the mbuf chain */
 800                         break;
 801                 }
 802                 /* get pointer to next asconf param */
 803                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 804                     sizeof(struct sctp_asconf_paramhdr),
 805                     (uint8_t *) & aparam_buf);
 806                 if (aph == NULL) {
 807                         /* can't get an asconf paramhdr */
 808                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 809                         /* FIX ME - add error here... */
 810                 }
 811         }
 812
 813 send_reply:
 814         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 815         /* save the ASCONF-ACK reply */
 816         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 817             struct sctp_asconf_ack);
 818         if (ack == NULL) {
 819                 sctp_m_freem(m_ack);
 820                 return;
 821         }
 822         ack->serial_number = serial_num;
 823         ack->last_sent_to = NULL;
 824         ack->data = m_ack;
 825         ack->len = 0;
 826         n = m_ack;
 827         while (n) {
 828                 ack->len += SCTP_BUF_LEN(n);
 829                 n = SCTP_BUF_NEXT(n);
 830         }
 831         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 832
 833         /* see if last_control_chunk_from is set properly (use IP src addr) */
 834         if (stcb->asoc.last_control_chunk_from == NULL) {
 835                 /*
 836                  * this could happen if the source address was just newly
 837                  * added
 838                  */
 839                 struct ip *iph;
 840                 struct sctphdr *sh;
 841                 struct sockaddr_storage from_store;
 842                 struct sockaddr *from = (struct sockaddr *)&from_store;
 843
 844                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 845                 /* pullup already done, IP options already stripped */
 846                 iph = mtod(m, struct ip *);
 847                 sh = (struct sctphdr *)((caddr_t)iph + sizeof(*iph));
 848                 switch (iph->ip_v) {
 849                 case IPVERSION:
 850                         {
 851                                 struct sockaddr_in *from4;
 852
 853                                 from4 = (struct sockaddr_in *)&from_store;
 854                                 bzero(from4, sizeof(*from4));
 855                                 from4->sin_family = AF_INET;
 856                                 from4->sin_len = sizeof(struct sockaddr_in);
 857                                 from4->sin_addr.s_addr = iph->ip_src.s_addr;
 858                                 from4->sin_port = sh->src_port;
 859                                 break;
 860                         }
 861 #ifdef INET6
 862                 case IPV6_VERSION >> 4:
 863                         {
 864                                 struct ip6_hdr *ip6;
 865                                 struct sockaddr_in6 *from6;
 866
 867                                 ip6 = mtod(m, struct ip6_hdr *);
 868                                 from6 = (struct sockaddr_in6 *)&from_store;
 869                                 bzero(from6, sizeof(*from6));
 870                                 from6->sin6_family = AF_INET6;
 871                                 from6->sin6_len = sizeof(struct sockaddr_in6);
 872                                 from6->sin6_addr = ip6->ip6_src;
 873                                 from6->sin6_port = sh->src_port;
 874                                 /*
 875                                  * Get the scopes in properly to the sin6
 876                                  * addr's
 877                                  */
 878                                 /* we probably don't need these operations */
 879                                 (void)sa6_recoverscope(from6);
 880                                 sa6_embedscope(from6,
 881                                     MODULE_GLOBAL(ip6_use_defzone));
 882
 883                                 break;
 884                         }
 885 #endif
 886                 default:
 887                         /* unknown address type */
 888                         from = NULL;
 889                 }
 890                 if (from != NULL) {
 891                         SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 892                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, from);
 893                         /* look up the from address */
 894                         stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, from);
 895 #ifdef SCTP_DEBUG
 896                         if (stcb->asoc.last_control_chunk_from == NULL)
 897                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 898 #endif
 899                 }
 900         }
 901 }
 902
 903 /*
 904  * does the address match? returns 0 if not, 1 if so
 905  */
 906 static uint32_t
 907 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 908 {
 909 #ifdef INET6
 910         if (sa->sa_family == AF_INET6) {
 911                 /* IPv6 sa address */
 912                 /* XXX scopeid */
 913                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 914
 915                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 916                     (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 917                     sizeof(struct in6_addr)) == 0)) {
 918                         return (1);
 919                 }
 920         } else
 921 #endif                          /* INET6 */
 922         if (sa->sa_family == AF_INET) {
 923                 /* IPv4 sa address */
 924                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 925
 926                 if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 927                     (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 928                     sizeof(struct in_addr)) == 0)) {
 929                         return (1);
 930                 }
 931         }
 932         return (0);
 933 }
 934
 935 /*
 936  * does the address match? returns 0 if not, 1 if so
 937  */
 938 static uint32_t
 939 sctp_addr_match(
 940     struct sctp_ipv6addr_param *v6addr,
 941     struct sockaddr *sa)
 942 {
 943         uint16_t param_type, param_length;
 944         struct sctp_ipv4addr_param *v4addr = (struct sctp_ipv4addr_param *)v6addr;
 945
 946 #ifdef INET6
 947         if (sa->sa_family == AF_INET6) {
 948                 /* IPv6 sa address */
 949                 /* XXX scopeid */
 950                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 951
 952                 param_type = ntohs(v6addr->ph.param_type);
 953                 param_length = ntohs(v6addr->ph.param_length);
 954
 955                 if ((param_type == SCTP_IPV6_ADDRESS) &&
 956                     param_length == sizeof(struct sctp_ipv6addr_param) &&
 957                     (memcmp(&v6addr->addr, &sin6->sin6_addr,
 958                     sizeof(struct in6_addr)) == 0)) {
 959                         return (1);
 960                 }
 961         }
 962 #endif
 963         if (sa->sa_family == AF_INET) {
 964                 /* IPv4 sa address */
 965                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 966
 967                 param_type = ntohs(v4addr->ph.param_type);
 968                 param_length = ntohs(v4addr->ph.param_length);
 969
 970                 if ((param_type == SCTP_IPV4_ADDRESS) &&
 971                     param_length == sizeof(struct sctp_ipv4addr_param) &&
 972                     (memcmp(&v4addr->addr, &sin->sin_addr,
 973                     sizeof(struct in_addr)) == 0)) {
 974                         return (1);
 975                 }
 976         }
 977         return (0);
 978 }
 979
 980 /*
 981  * Cleanup for non-responded/OP ERR'd ASCONF
 982  */
 983 void
 984 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 985 {
 986         /* mark peer as ASCONF incapable */
 987         stcb->asoc.peer_supports_asconf = 0;
 988         /*
 989          * clear out any existing asconfs going out
 990          */
 991         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 992             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 993         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 994         /* remove the old ASCONF on our outbound queue */
 995         sctp_toss_old_asconf(stcb);
 996 }
 997
 998 /*
 999  * cleanup any cached source addresses that may be topologically
1000  * incorrect after a new address has been added to this interface.
1001  */
1002 static void
1003 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
1004 {
1005         struct sctp_nets *net;
1006
1007         /*
1008          * Ideally, we want to only clear cached routes and source addresses
1009          * that are topologically incorrect.  But since there is no easy way
1010          * to know whether the newly added address on the ifn would cause a
1011          * routing change (i.e. a new egress interface would be chosen)
1012          * without doing a new routing lookup and source address selection,
1013          * we will (for now) just flush any cached route using a different
1014          * ifn (and cached source addrs) and let output re-choose them
1015          * during the next send on that net.
1016          */
1017         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1018                 /*
1019                  * clear any cached route (and cached source address) if the
1020                  * route's interface is NOT the same as the address change.
1021                  * If it's the same interface, just clear the cached source
1022                  * address.
1023                  */
1024                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
1025                     ((ifn == NULL) ||
1026                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
1027                         /* clear any cached route */
1028                         RTFREE(net->ro.ro_rt);
1029                         net->ro.ro_rt = NULL;
1030                 }
1031                 /* clear any cached source address */
1032                 if (net->src_addr_selected) {
1033                         sctp_free_ifa(net->ro._s_addr);
1034                         net->ro._s_addr = NULL;
1035                         net->src_addr_selected = 0;
1036                 }
1037         }
1038 }
1039
1040
1041 void
1042 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
1043 {
1044         int error;
1045
1046         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1047                 return;
1048         }
1049         if (stcb->asoc.deleted_primary == NULL) {
1050                 return;
1051         }
1052         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1053                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1054                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1055                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1056                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1057                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1058                     stcb->asoc.deleted_primary,
1059                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1060                 stcb->asoc.num_send_timers_up--;
1061                 if (stcb->asoc.num_send_timers_up < 0) {
1062                         stcb->asoc.num_send_timers_up = 0;
1063                 }
1064                 SCTP_TCB_LOCK_ASSERT(stcb);
1065                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1066                     stcb->asoc.deleted_primary);
1067                 if (error) {
1068                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1069                         return;
1070                 }
1071                 SCTP_TCB_LOCK_ASSERT(stcb);
1072 #ifdef SCTP_AUDITING_ENABLED
1073                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1074 #endif
1075                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1076                 if ((stcb->asoc.num_send_timers_up == 0) &&
1077                     (stcb->asoc.sent_queue_cnt > 0)) {
1078                         struct sctp_tmit_chunk *chk;
1079
1080                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1081                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1082                             stcb, chk->whoTo);
1083                 }
1084         }
1085         return;
1086 }
1087
1088 static int
1089     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1090
1091 void
1092 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1093 {
1094         struct sctp_tmit_chunk *chk;
1095
1096         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1097         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1098             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1099         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1100         net->error_count = 0;
1101         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1102                 if (chk->whoTo == net) {
1103                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1104                                 chk->sent = SCTP_DATAGRAM_RESEND;
1105                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1106                                 sctp_flight_size_decrease(chk);
1107                                 sctp_total_flight_decrease(stcb, chk);
1108                                 net->marked_retrans++;
1109                                 stcb->asoc.marked_retrans++;
1110                         }
1111                 }
1112         }
1113         if (net->marked_retrans) {
1114                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1115         }
1116 }
1117
1118 static void
1119 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1120 {
1121         struct sctp_nets *net;
1122         int addrnum, changed;
1123
1124         /*
1125          * If number of local valid addresses is 1, the valid address is
1126          * probably newly added address. Several valid addresses in this
1127          * association.  A source address may not be changed.  Additionally,
1128          * they can be configured on a same interface as "alias" addresses.
1129          * (by micchie)
1130          */
1131         addrnum = sctp_local_addr_count(stcb);
1132         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1133             addrnum);
1134         if (addrnum == 1) {
1135                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1136                         /* clear any cached route and source address */
1137                         if (net->ro.ro_rt) {
1138                                 RTFREE(net->ro.ro_rt);
1139                                 net->ro.ro_rt = NULL;
1140                         }
1141                         if (net->src_addr_selected) {
1142                                 sctp_free_ifa(net->ro._s_addr);
1143                                 net->ro._s_addr = NULL;
1144                                 net->src_addr_selected = 0;
1145                         }
1146                         /* Retransmit unacknowledged DATA chunks immediately */
1147                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1148                             SCTP_MOBILITY_FASTHANDOFF)) {
1149                                 sctp_net_immediate_retrans(stcb, net);
1150                         }
1151                         /* also, SET PRIMARY is maybe already sent */
1152                 }
1153                 return;
1154         }
1155         /* Multiple local addresses exsist in the association.  */
1156         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1157                 /* clear any cached route and source address */
1158                 if (net->ro.ro_rt) {
1159                         RTFREE(net->ro.ro_rt);
1160                         net->ro.ro_rt = NULL;
1161                 }
1162                 if (net->src_addr_selected) {
1163                         sctp_free_ifa(net->ro._s_addr);
1164                         net->ro._s_addr = NULL;
1165                         net->src_addr_selected = 0;
1166                 }
1167                 /*
1168                  * Check if the nexthop is corresponding to the new address.
1169                  * If the new address is corresponding to the current
1170                  * nexthop, the path will be changed. If the new address is
1171                  * NOT corresponding to the current nexthop, the path will
1172                  * not be changed.
1173                  */
1174                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1175                     stcb->sctp_ep->def_vrf_id);
1176                 if (net->ro.ro_rt == NULL)
1177                         continue;
1178
1179                 changed = 0;
1180                 if (net->ro._l_addr.sa.sa_family == AF_INET) {
1181                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro))
1182                                 changed = 1;
1183                 }
1184 #ifdef INET6
1185                 if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1186                         if (sctp_v6src_match_nexthop(
1187                             &newifa->address.sin6, (sctp_route_t *) & net->ro))
1188                                 changed = 1;
1189                 }
1190 #endif
1191                 /*
1192                  * if the newly added address does not relate routing
1193                  * information, we skip.
1194                  */
1195                 if (changed == 0)
1196                         continue;
1197                 /* Retransmit unacknowledged DATA chunks immediately */
1198                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1199                     SCTP_MOBILITY_FASTHANDOFF)) {
1200                         sctp_net_immediate_retrans(stcb, net);
1201                 }
1202                 /* Send SET PRIMARY for this new address */
1203                 if (net == stcb->asoc.primary_destination) {
1204                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1205                             SCTP_SET_PRIM_ADDR);
1206                 }
1207         }
1208 }
1209
1210 /*
1211  * process an ADD/DELETE IP ack from peer.
1212  * addr: corresponding sctp_ifa to the address being added/deleted.
1213  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1214  * flag: 1=success, 0=failure.
1215  */
1216 static void
1217 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr,
1218     uint16_t type, uint32_t flag)
1219 {
1220         /*
1221          * do the necessary asoc list work- if we get a failure indication,
1222          * leave the address on the assoc's restricted list.  If we get a
1223          * success indication, remove the address from the restricted list.
1224          */
1225         /*
1226          * Note: this will only occur for ADD_IP_ADDRESS, since
1227          * DEL_IP_ADDRESS is never actually added to the list...
1228          */
1229         if (flag) {
1230                 /* success case, so remove from the restricted list */
1231                 sctp_del_local_addr_restricted(stcb, addr);
1232
1233                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1234                     SCTP_MOBILITY_BASE) ||
1235                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1236                     SCTP_MOBILITY_FASTHANDOFF)) {
1237                         sctp_path_check_and_react(stcb, addr);
1238                         return;
1239                 }
1240                 /* clear any cached/topologically incorrect source addresses */
1241                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1242         }
1243         /* else, leave it on the list */
1244 }
1245
1246 /*
1247  * add an asconf add/delete/set primary IP address parameter to the queue.
1248  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1249  * returns 0 if queued, -1 if not queued/removed.
1250  * NOTE: if adding, but a delete for the same address is already scheduled
1251  * (and not yet sent out), simply remove it from queue.  Same for deleting
1252  * an address already scheduled for add.  If a duplicate operation is found,
1253  * ignore the new one.
1254  */
1255 static int
1256 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1257     uint16_t type)
1258 {
1259         struct sctp_asconf_addr *aa, *aa_next;
1260         struct sockaddr *sa;
1261
1262         /* make sure the request isn't already in the queue */
1263         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1264                 /* address match? */
1265                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1266                         continue;
1267                 /*
1268                  * is the request already in queue but not sent? pass the
1269                  * request already sent in order to resolve the following
1270                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1271                  * can't remove the ADD request already sent 3. arrival of
1272                  * ADD
1273                  */
1274                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1275                         return (-1);
1276                 }
1277                 /* is the negative request already in queue, and not sent */
1278                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1279                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1280                         /* add requested, delete already queued */
1281                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1282                         /* remove the ifa from the restricted list */
1283                         sctp_del_local_addr_restricted(stcb, ifa);
1284                         /* free the asconf param */
1285                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1286                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1287                         return (-1);
1288                 }
1289                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1290                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1291                         /* delete requested, add already queued */
1292                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1293                         /* remove the aa->ifa from the restricted list */
1294                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1295                         /* free the asconf param */
1296                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1297                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1298                         return (-1);
1299                 }
1300         }                       /* for each aa */
1301
1302         /* adding new request to the queue */
1303         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1304             SCTP_M_ASC_ADDR);
1305         if (aa == NULL) {
1306                 /* didn't get memory */
1307                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1308                 return (-1);
1309         }
1310         aa->special_del = 0;
1311         /* fill in asconf address parameter fields */
1312         /* top level elements are "networked" during send */
1313         aa->ap.aph.ph.param_type = type;
1314         aa->ifa = ifa;
1315         atomic_add_int(&ifa->refcount, 1);
1316         /* correlation_id filled in during send routine later... */
1317         if (ifa->address.sa.sa_family == AF_INET6) {
1318                 /* IPv6 address */
1319                 struct sockaddr_in6 *sin6;
1320
1321                 sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1322                 sa = (struct sockaddr *)sin6;
1323                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1324                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1325                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1326                     sizeof(struct sctp_ipv6addr_param);
1327                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1328                     sizeof(struct in6_addr));
1329         } else if (ifa->address.sa.sa_family == AF_INET) {
1330                 /* IPv4 address */
1331                 struct sockaddr_in *sin;
1332
1333                 sin = (struct sockaddr_in *)&ifa->address.sa;
1334                 sa = (struct sockaddr *)sin;
1335                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1336                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1337                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1338                     sizeof(struct sctp_ipv4addr_param);
1339                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1340                     sizeof(struct in_addr));
1341         } else {
1342                 /* invalid family! */
1343                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1344                 sctp_free_ifa(ifa);
1345                 return (-1);
1346         }
1347         aa->sent = 0;           /* clear sent flag */
1348
1349         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1350 #ifdef SCTP_DEBUG
1351         if (SCTP_BASE_SYSCTL(sctp_debug_on) && SCTP_DEBUG_ASCONF2) {
1352                 if (type == SCTP_ADD_IP_ADDRESS) {
1353                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1354                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1355                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1356                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1357                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1358                 } else {
1359                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1360                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1361                 }
1362         }
1363 #endif
1364
1365         return (0);
1366 }
1367
1368
1369 /*
1370  * add an asconf operation for the given ifa and type.
1371  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1372  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1373  * advisable.
1374  */
1375 static int
1376 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1377     uint16_t type)
1378 {
1379         uint32_t status;
1380         int pending_delete_queued = 0;
1381
1382         /* see if peer supports ASCONF */
1383         if (stcb->asoc.peer_supports_asconf == 0) {
1384                 return (-1);
1385         }
1386         /*
1387          * if this is deleting the last address from the assoc, mark it as
1388          * pending.
1389          */
1390         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1391             (sctp_local_addr_count(stcb) < 2)) {
1392                 /* set the pending delete info only */
1393                 stcb->asoc.asconf_del_pending = 1;
1394                 stcb->asoc.asconf_addr_del_pending = ifa;
1395                 atomic_add_int(&ifa->refcount, 1);
1396                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1397                     "asconf_queue_add: mark delete last address pending\n");
1398                 return (-1);
1399         }
1400         /* queue an asconf parameter */
1401         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1402
1403         /*
1404          * if this is an add, and there is a delete also pending (i.e. the
1405          * last local address is being changed), queue the pending delete
1406          * too.
1407          */
1408         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1409                 /* queue in the pending delete */
1410                 if (sctp_asconf_queue_mgmt(stcb,
1411                     stcb->asoc.asconf_addr_del_pending,
1412                     SCTP_DEL_IP_ADDRESS) == 0) {
1413                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1414                         pending_delete_queued = 1;
1415                         /* clear out the pending delete info */
1416                         stcb->asoc.asconf_del_pending = 0;
1417                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1418                         stcb->asoc.asconf_addr_del_pending = NULL;
1419                 }
1420         }
1421         if (pending_delete_queued) {
1422                 struct sctp_nets *net;
1423
1424                 /*
1425                  * since we know that the only/last address is now being
1426                  * changed in this case, reset the cwnd/rto on all nets to
1427                  * start as a new address and path.  Also clear the error
1428                  * counts to give the assoc the best chance to complete the
1429                  * address change.
1430                  */
1431                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1432                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1433                             net);
1434                         net->RTO = 0;
1435                         net->error_count = 0;
1436                 }
1437                 stcb->asoc.overall_error_count = 0;
1438                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1439                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1440                             stcb->asoc.overall_error_count,
1441                             0,
1442                             SCTP_FROM_SCTP_ASCONF,
1443                             __LINE__);
1444                 }
1445                 /* queue in an advisory set primary too */
1446                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1447                 /* let caller know we should send this out immediately */
1448                 status = 1;
1449         }
1450         return (status);
1451 }
1452
1453 /*-
1454  * add an asconf delete IP address parameter to the queue by sockaddr and
1455  * possibly with no sctp_ifa available.  This is only called by the routine
1456  * that checks the addresses in an INIT-ACK against the current address list.
1457  * returns 0 if completed, non-zero if not completed.
1458  * NOTE: if an add is already scheduled (and not yet sent out), simply
1459  * remove it from queue.  If a duplicate operation is found, ignore the
1460  * new one.
1461  */
1462 static int
1463 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1464 {
1465         struct sctp_ifa *ifa;
1466         struct sctp_asconf_addr *aa, *aa_next;
1467         uint32_t vrf_id;
1468
1469         if (stcb == NULL) {
1470                 return (-1);
1471         }
1472         /* see if peer supports ASCONF */
1473         if (stcb->asoc.peer_supports_asconf == 0) {
1474                 return (-1);
1475         }
1476         /* make sure the request isn't already in the queue */
1477         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1478                 /* address match? */
1479                 if (sctp_asconf_addr_match(aa, sa) == 0)
1480                         continue;
1481                 /* is the request already in queue (sent or not) */
1482                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1483                         return (-1);
1484                 }
1485                 /* is the negative request already in queue, and not sent */
1486                 if (aa->sent == 1)
1487                         continue;
1488                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1489                         /* add already queued, so remove existing entry */
1490                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1491                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1492                         /* free the entry */
1493                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1494                         return (-1);
1495                 }
1496         }                       /* for each aa */
1497
1498         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1499         if (stcb) {
1500                 vrf_id = stcb->asoc.vrf_id;
1501         } else {
1502                 vrf_id = SCTP_DEFAULT_VRFID;
1503         }
1504         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1505
1506         /* adding new request to the queue */
1507         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1508             SCTP_M_ASC_ADDR);
1509         if (aa == NULL) {
1510                 /* didn't get memory */
1511                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1512                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1513                 return (-1);
1514         }
1515         aa->special_del = 0;
1516         /* fill in asconf address parameter fields */
1517         /* top level elements are "networked" during send */
1518         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1519         aa->ifa = ifa;
1520         if (ifa)
1521                 atomic_add_int(&ifa->refcount, 1);
1522         /* correlation_id filled in during send routine later... */
1523         if (sa->sa_family == AF_INET6) {
1524                 /* IPv6 address */
1525                 struct sockaddr_in6 *sin6;
1526
1527                 sin6 = (struct sockaddr_in6 *)sa;
1528                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1529                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1530                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1531                 memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1532                     sizeof(struct in6_addr));
1533         } else if (sa->sa_family == AF_INET) {
1534                 /* IPv4 address */
1535                 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1536
1537                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1538                 aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1539                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1540                 memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1541                     sizeof(struct in_addr));
1542         } else {
1543                 /* invalid family! */
1544                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1545                 if (ifa)
1546                         sctp_free_ifa(ifa);
1547                 return (-1);
1548         }
1549         aa->sent = 0;           /* clear sent flag */
1550
1551         /* delete goes to the back of the queue */
1552         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1553
1554         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1555         return (0);
1556 }
1557
1558 /*
1559  * find a specific asconf param on our "sent" queue
1560  */
1561 static struct sctp_asconf_addr *
1562 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1563 {
1564         struct sctp_asconf_addr *aa;
1565
1566         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1567                 if (aa->ap.aph.correlation_id == correlation_id &&
1568                     aa->sent == 1) {
1569                         /* found it */
1570                         return (aa);
1571                 }
1572         }
1573         /* didn't find it */
1574         return (NULL);
1575 }
1576
1577 /*
1578  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1579  * notifications based on the error response
1580  */
1581 static void
1582 sctp_asconf_process_error(struct sctp_tcb *stcb,
1583     struct sctp_asconf_paramhdr *aph)
1584 {
1585         struct sctp_error_cause *eh;
1586         struct sctp_paramhdr *ph;
1587         uint16_t param_type;
1588         uint16_t error_code;
1589
1590         eh = (struct sctp_error_cause *)(aph + 1);
1591         ph = (struct sctp_paramhdr *)(eh + 1);
1592         /* validate lengths */
1593         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1594             htons(aph->ph.param_length)) {
1595                 /* invalid error cause length */
1596                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1597                     "asconf_process_error: cause element too long\n");
1598                 return;
1599         }
1600         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1601             htons(eh->length)) {
1602                 /* invalid included TLV length */
1603                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1604                     "asconf_process_error: included TLV too long\n");
1605                 return;
1606         }
1607         /* which error code ? */
1608         error_code = ntohs(eh->code);
1609         param_type = ntohs(aph->ph.param_type);
1610         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1611         switch (error_code) {
1612         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1613                 /* we allow ourselves to "try again" for this error */
1614                 break;
1615         default:
1616                 /* peer can't handle it... */
1617                 switch (param_type) {
1618                 case SCTP_ADD_IP_ADDRESS:
1619                 case SCTP_DEL_IP_ADDRESS:
1620                         stcb->asoc.peer_supports_asconf = 0;
1621                         break;
1622                 case SCTP_SET_PRIM_ADDR:
1623                         stcb->asoc.peer_supports_asconf = 0;
1624                         break;
1625                 default:
1626                         break;
1627                 }
1628         }
1629 }
1630
1631 /*
1632  * process an asconf queue param.
1633  * aparam: parameter to process, will be removed from the queue.
1634  * flag: 1=success case, 0=failure case
1635  */
1636 static void
1637 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1638     struct sctp_asconf_addr *aparam, uint32_t flag)
1639 {
1640         uint16_t param_type;
1641
1642         /* process this param */
1643         param_type = aparam->ap.aph.ph.param_type;
1644         switch (param_type) {
1645         case SCTP_ADD_IP_ADDRESS:
1646                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1647                     "process_param_ack: added IP address\n");
1648                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, param_type, flag);
1649                 break;
1650         case SCTP_DEL_IP_ADDRESS:
1651                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1652                     "process_param_ack: deleted IP address\n");
1653                 /* nothing really to do... lists already updated */
1654                 break;
1655         case SCTP_SET_PRIM_ADDR:
1656                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1657                     "process_param_ack: set primary IP address\n");
1658                 /* nothing to do... peer may start using this addr */
1659                 if (flag == 0)
1660                         stcb->asoc.peer_supports_asconf = 0;
1661                 break;
1662         default:
1663                 /* should NEVER happen */
1664                 break;
1665         }
1666
1667         /* remove the param and free it */
1668         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1669         if (aparam->ifa)
1670                 sctp_free_ifa(aparam->ifa);
1671         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1672 }
1673
1674 /*
1675  * cleanup from a bad asconf ack parameter
1676  */
1677 static void
1678 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1679 {
1680         /* assume peer doesn't really know how to do asconfs */
1681         stcb->asoc.peer_supports_asconf = 0;
1682         /* XXX we could free the pending queue here */
1683 }
1684
1685 void
1686 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1687     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1688     struct sctp_nets *net, int *abort_no_unlock)
1689 {
1690         struct sctp_association *asoc;
1691         uint32_t serial_num;
1692         uint16_t ack_length;
1693         struct sctp_asconf_paramhdr *aph;
1694         struct sctp_asconf_addr *aa, *aa_next;
1695         uint32_t last_error_id = 0;     /* last error correlation id */
1696         uint32_t id;
1697         struct sctp_asconf_addr *ap;
1698
1699         /* asconf param buffer */
1700         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1701
1702         /* verify minimum length */
1703         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1704                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1705                     "handle_asconf_ack: chunk too small = %xh\n",
1706                     ntohs(cp->ch.chunk_length));
1707                 return;
1708         }
1709         asoc = &stcb->asoc;
1710         serial_num = ntohl(cp->serial_number);
1711
1712         /*
1713          * NOTE: we may want to handle this differently- currently, we will
1714          * abort when we get an ack for the expected serial number + 1 (eg.
1715          * we didn't send it), process an ack normally if it is the expected
1716          * serial number, and re-send the previous ack for *ALL* other
1717          * serial numbers
1718          */
1719
1720         /*
1721          * if the serial number is the next expected, but I didn't send it,
1722          * abort the asoc, since someone probably just hijacked us...
1723          */
1724         if (serial_num == (asoc->asconf_seq_out + 1)) {
1725                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1726                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1727                     SCTP_CAUSE_ILLEGAL_ASCONF_ACK, NULL, SCTP_SO_NOT_LOCKED);
1728                 *abort_no_unlock = 1;
1729                 return;
1730         }
1731         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1732                 /* got a duplicate/unexpected ASCONF-ACK */
1733                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1734                     serial_num, asoc->asconf_seq_out_acked + 1);
1735                 return;
1736         }
1737         if (serial_num == asoc->asconf_seq_out - 1) {
1738                 /* stop our timer */
1739                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1740                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1741         }
1742         /* process the ASCONF-ACK contents */
1743         ack_length = ntohs(cp->ch.chunk_length) -
1744             sizeof(struct sctp_asconf_ack_chunk);
1745         offset += sizeof(struct sctp_asconf_ack_chunk);
1746         /* process through all parameters */
1747         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1748                 unsigned int param_length, param_type;
1749
1750                 /* get pointer to next asconf parameter */
1751                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1752                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1753                 if (aph == NULL) {
1754                         /* can't get an asconf paramhdr */
1755                         sctp_asconf_ack_clear(stcb);
1756                         return;
1757                 }
1758                 param_type = ntohs(aph->ph.param_type);
1759                 param_length = ntohs(aph->ph.param_length);
1760                 if (param_length > ack_length) {
1761                         sctp_asconf_ack_clear(stcb);
1762                         return;
1763                 }
1764                 if (param_length < sizeof(struct sctp_paramhdr)) {
1765                         sctp_asconf_ack_clear(stcb);
1766                         return;
1767                 }
1768                 /* get the complete parameter... */
1769                 if (param_length > sizeof(aparam_buf)) {
1770                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1771                             "param length (%u) larger than buffer size!\n", param_length);
1772                         sctp_asconf_ack_clear(stcb);
1773                         return;
1774                 }
1775                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1776                 if (aph == NULL) {
1777                         sctp_asconf_ack_clear(stcb);
1778                         return;
1779                 }
1780                 /* correlation_id is transparent to peer, no ntohl needed */
1781                 id = aph->correlation_id;
1782
1783                 switch (param_type) {
1784                 case SCTP_ERROR_CAUSE_IND:
1785                         last_error_id = id;
1786                         /* find the corresponding asconf param in our queue */
1787                         ap = sctp_asconf_find_param(stcb, id);
1788                         if (ap == NULL) {
1789                                 /* hmm... can't find this in our queue! */
1790                                 break;
1791                         }
1792                         /* process the parameter, failed flag */
1793                         sctp_asconf_process_param_ack(stcb, ap, 0);
1794                         /* process the error response */
1795                         sctp_asconf_process_error(stcb, aph);
1796                         break;
1797                 case SCTP_SUCCESS_REPORT:
1798                         /* find the corresponding asconf param in our queue */
1799                         ap = sctp_asconf_find_param(stcb, id);
1800                         if (ap == NULL) {
1801                                 /* hmm... can't find this in our queue! */
1802                                 break;
1803                         }
1804                         /* process the parameter, success flag */
1805                         sctp_asconf_process_param_ack(stcb, ap, 1);
1806                         break;
1807                 default:
1808                         break;
1809                 }               /* switch */
1810
1811                 /* update remaining ASCONF-ACK message length to process */
1812                 ack_length -= SCTP_SIZE32(param_length);
1813                 if (ack_length <= 0) {
1814                         /* no more data in the mbuf chain */
1815                         break;
1816                 }
1817                 offset += SCTP_SIZE32(param_length);
1818         }                       /* while */
1819
1820         /*
1821          * if there are any "sent" params still on the queue, these are
1822          * implicitly "success", or "failed" (if we got an error back) ...
1823          * so process these appropriately
1824          *
1825          * we assume that the correlation_id's are monotonically increasing
1826          * beginning from 1 and that we don't have *that* many outstanding
1827          * at any given time
1828          */
1829         if (last_error_id == 0)
1830                 last_error_id--;/* set to "max" value */
1831         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1832                 if (aa->sent == 1) {
1833                         /*
1834                          * implicitly successful or failed if correlation_id
1835                          * < last_error_id, then success else, failure
1836                          */
1837                         if (aa->ap.aph.correlation_id < last_error_id)
1838                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1839                         else
1840                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1841                 } else {
1842                         /*
1843                          * since we always process in order (FIFO queue) if
1844                          * we reach one that hasn't been sent, the rest
1845                          * should not have been sent either. so, we're
1846                          * done...
1847                          */
1848                         break;
1849                 }
1850         }
1851
1852         /* update the next sequence number to use */
1853         asoc->asconf_seq_out_acked++;
1854         /* remove the old ASCONF on our outbound queue */
1855         sctp_toss_old_asconf(stcb);
1856         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1857 #ifdef SCTP_TIMER_BASED_ASCONF
1858                 /* we have more params, so restart our timer */
1859                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1860                     stcb, net);
1861 #else
1862                 /* we have more params, so send out more */
1863                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1864 #endif
1865         }
1866 }
1867
1868 #ifdef INET6
1869 static uint32_t
1870 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1871 {
1872         struct sockaddr_in6 *sin6, *net6;
1873         struct sctp_nets *net;
1874
1875         if (sa->sa_family != AF_INET6) {
1876                 /* wrong family */
1877                 return (0);
1878         }
1879         sin6 = (struct sockaddr_in6 *)sa;
1880         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1881                 /* not link local address */
1882                 return (0);
1883         }
1884         /* hunt through our destination nets list for this scope_id */
1885         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1886                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1887                     AF_INET6)
1888                         continue;
1889                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1890                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1891                         continue;
1892                 if (sctp_is_same_scope(sin6, net6)) {
1893                         /* found one */
1894                         return (1);
1895                 }
1896         }
1897         /* didn't find one */
1898         return (0);
1899 }
1900
1901 #endif
1902
1903 /*
1904  * address management functions
1905  */
1906 static void
1907 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1908     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1909 {
1910         int status;
1911
1912
1913         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 &&
1914             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1915                 /* subset bound, no ASCONF allowed case, so ignore */
1916                 return;
1917         }
1918         /*
1919          * note: we know this is not the subset bound, no ASCONF case eg.
1920          * this is boundall or subset bound w/ASCONF allowed
1921          */
1922
1923         /* first, make sure it's a good address family */
1924         if (ifa->address.sa.sa_family != AF_INET6 &&
1925             ifa->address.sa.sa_family != AF_INET) {
1926                 return;
1927         }
1928         /* make sure we're "allowed" to add this type of addr */
1929         if (ifa->address.sa.sa_family == AF_INET6) {
1930                 /* invalid if we're not a v6 endpoint */
1931                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1932                         return;
1933                 /* is the v6 addr really valid ? */
1934                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1935                         return;
1936                 }
1937         }
1938         /* put this address on the "pending/do not use yet" list */
1939         sctp_add_local_addr_restricted(stcb, ifa);
1940         /*
1941          * check address scope if address is out of scope, don't queue
1942          * anything... note: this would leave the address on both inp and
1943          * asoc lists
1944          */
1945         switch (ifa->address.sa.sa_family) {
1946 #ifdef INET6
1947         case AF_INET6:
1948                 {
1949                         struct sockaddr_in6 *sin6;
1950
1951                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1952                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1953                                 /* we skip unspecifed addresses */
1954                                 return;
1955                         }
1956                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1957                                 if (stcb->asoc.local_scope == 0) {
1958                                         return;
1959                                 }
1960                                 /* is it the right link local scope? */
1961                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1962                                         return;
1963                                 }
1964                         }
1965                         if (stcb->asoc.site_scope == 0 &&
1966                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1967                                 return;
1968                         }
1969                         break;
1970                 }
1971 #endif
1972         case AF_INET:
1973                 {
1974                         struct sockaddr_in *sin;
1975                         struct in6pcb *inp6;
1976
1977                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1978                         /* invalid if we are a v6 only endpoint */
1979                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1980                             SCTP_IPV6_V6ONLY(inp6))
1981                                 return;
1982
1983                         sin = (struct sockaddr_in *)&ifa->address.sa;
1984                         if (sin->sin_addr.s_addr == 0) {
1985                                 /* we skip unspecifed addresses */
1986                                 return;
1987                         }
1988                         if (stcb->asoc.ipv4_local_scope == 0 &&
1989                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1990                                 return;
1991                         }
1992                         break;
1993                 }
1994         default:
1995                 /* else, not AF_INET or AF_INET6, so skip */
1996                 return;
1997         }
1998
1999         /* queue an asconf for this address add/delete */
2000         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
2001                 /* does the peer do asconf? */
2002                 if (stcb->asoc.peer_supports_asconf) {
2003                         /* queue an asconf for this addr */
2004                         status = sctp_asconf_queue_add(stcb, ifa, type);
2005
2006                         /*
2007                          * if queued ok, and in the open state, send out the
2008                          * ASCONF.  If in the non-open state, these will be
2009                          * sent when the state goes open.
2010                          */
2011                         if (status == 0 &&
2012                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2013 #ifdef SCTP_TIMER_BASED_ASCONF
2014                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2015                                     stcb, stcb->asoc.primary_destination);
2016 #else
2017                                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2018                                     addr_locked);
2019 #endif
2020                         }
2021                 }
2022         }
2023 }
2024
2025
2026 int
2027 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2028 {
2029         struct sctp_asconf_iterator *asc;
2030         struct sctp_ifa *ifa;
2031         struct sctp_laddr *l;
2032         int cnt_invalid = 0;
2033
2034         asc = (struct sctp_asconf_iterator *)ptr;
2035         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2036                 ifa = l->ifa;
2037                 if (ifa->address.sa.sa_family == AF_INET6) {
2038                         /* invalid if we're not a v6 endpoint */
2039                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2040                                 cnt_invalid++;
2041                                 if (asc->cnt == cnt_invalid)
2042                                         return (1);
2043                                 else
2044                                         continue;
2045                         }
2046                 } else if (ifa->address.sa.sa_family == AF_INET) {
2047                         /* invalid if we are a v6 only endpoint */
2048                         struct in6pcb *inp6;
2049
2050                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2051                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2052                             SCTP_IPV6_V6ONLY(inp6)) {
2053                                 cnt_invalid++;
2054                                 if (asc->cnt == cnt_invalid)
2055                                         return (1);
2056                                 else
2057                                         continue;
2058                         }
2059                 } else {
2060                         /* invalid address family */
2061                         cnt_invalid++;
2062                         if (asc->cnt == cnt_invalid)
2063                                 return (1);
2064                         else
2065                                 continue;
2066                 }
2067         }
2068         return (0);
2069 }
2070
2071 static int
2072 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2073 {
2074         struct sctp_ifa *ifa;
2075         struct sctp_asconf_iterator *asc;
2076         struct sctp_laddr *laddr, *nladdr, *l;
2077
2078         /* Only for specific case not bound all */
2079         asc = (struct sctp_asconf_iterator *)ptr;
2080         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2081                 ifa = l->ifa;
2082                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2083                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2084                             sctp_nxt_addr) {
2085                                 if (laddr->ifa == ifa) {
2086                                         laddr->action = 0;
2087                                         break;
2088                                 }
2089                         }
2090                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2091                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2092                                 /* remove only after all guys are done */
2093                                 if (laddr->ifa == ifa) {
2094                                         sctp_del_local_addr_ep(inp, ifa);
2095                                 }
2096                         }
2097                 }
2098         }
2099         return (0);
2100 }
2101
2102 void
2103 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2104     void *ptr, uint32_t val)
2105 {
2106         struct sctp_asconf_iterator *asc;
2107         struct sctp_ifa *ifa;
2108         struct sctp_laddr *l;
2109         int cnt_invalid = 0;
2110         int type, status;
2111         int num_queued = 0;
2112
2113         asc = (struct sctp_asconf_iterator *)ptr;
2114         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2115                 ifa = l->ifa;
2116                 type = l->action;
2117
2118                 /* address's vrf_id must be the vrf_id of the assoc */
2119                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2120                         continue;
2121                 }
2122                 /* Same checks again for assoc */
2123                 switch (ifa->address.sa.sa_family) {
2124 #ifdef INET6
2125                 case AF_INET6:
2126                         {
2127                                 /* invalid if we're not a v6 endpoint */
2128                                 struct sockaddr_in6 *sin6;
2129
2130                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2131                                         cnt_invalid++;
2132                                         if (asc->cnt == cnt_invalid)
2133                                                 return;
2134                                         else
2135                                                 continue;
2136                                 }
2137                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2138                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2139                                         /* we skip unspecifed addresses */
2140                                         continue;
2141                                 }
2142                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2143                                         if (stcb->asoc.local_scope == 0) {
2144                                                 continue;
2145                                         }
2146                                         /* is it the right link local scope? */
2147                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2148                                                 continue;
2149                                         }
2150                                 }
2151                                 break;
2152                         }
2153 #endif
2154                 case AF_INET:
2155                         {
2156                                 /* invalid if we are a v6 only endpoint */
2157                                 struct in6pcb *inp6;
2158                                 struct sockaddr_in *sin;
2159
2160                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2161                                 /* invalid if we are a v6 only endpoint */
2162                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2163                                     SCTP_IPV6_V6ONLY(inp6))
2164                                         continue;
2165
2166                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2167                                 if (sin->sin_addr.s_addr == 0) {
2168                                         /* we skip unspecifed addresses */
2169                                         continue;
2170                                 }
2171                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2172                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2173                                         continue;
2174                                 }
2175                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2176                                     SCTP_IPV6_V6ONLY(inp6)) {
2177                                         cnt_invalid++;
2178                                         if (asc->cnt == cnt_invalid)
2179                                                 return;
2180                                         else
2181                                                 continue;
2182                                 }
2183                                 break;
2184                         }
2185                 default:
2186                         /* invalid address family */
2187                         cnt_invalid++;
2188                         if (asc->cnt == cnt_invalid)
2189                                 return;
2190                         else
2191                                 continue;
2192                         break;
2193                 }
2194
2195                 if (type == SCTP_ADD_IP_ADDRESS) {
2196                         /* prevent this address from being used as a source */
2197                         sctp_add_local_addr_restricted(stcb, ifa);
2198                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2199                         struct sctp_nets *net;
2200
2201                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2202                                 sctp_rtentry_t *rt;
2203
2204                                 /* delete this address if cached */
2205                                 if (net->ro._s_addr == ifa) {
2206                                         sctp_free_ifa(net->ro._s_addr);
2207                                         net->ro._s_addr = NULL;
2208                                         net->src_addr_selected = 0;
2209                                         rt = net->ro.ro_rt;
2210                                         if (rt) {
2211                                                 RTFREE(rt);
2212                                                 net->ro.ro_rt = NULL;
2213                                         }
2214                                         /*
2215                                          * Now we deleted our src address,
2216                                          * should we not also now reset the
2217                                          * cwnd/rto to start as if its a new
2218                                          * address?
2219                                          */
2220                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2221                                         net->RTO = 0;
2222
2223                                 }
2224                         }
2225                 } else if (type == SCTP_SET_PRIM_ADDR) {
2226                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2227                                 /* must validate the ifa is in the ep */
2228                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2229                                         continue;
2230                                 }
2231                         } else {
2232                                 /* Need to check scopes for this guy */
2233                                 if (sctp_is_address_in_scope(ifa,
2234                                     stcb->asoc.ipv4_addr_legal,
2235                                     stcb->asoc.ipv6_addr_legal,
2236                                     stcb->asoc.loopback_scope,
2237                                     stcb->asoc.ipv4_local_scope,
2238                                     stcb->asoc.local_scope,
2239                                     stcb->asoc.site_scope, 0) == 0) {
2240                                         continue;
2241                                 }
2242                         }
2243                 }
2244                 /* queue an asconf for this address add/delete */
2245                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2246                     stcb->asoc.peer_supports_asconf) {
2247                         /* queue an asconf for this addr */
2248                         status = sctp_asconf_queue_add(stcb, ifa, type);
2249                         /*
2250                          * if queued ok, and in the open state, update the
2251                          * count of queued params.  If in the non-open
2252                          * state, these get sent when the assoc goes open.
2253                          */
2254                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2255                                 if (status >= 0) {
2256                                         num_queued++;
2257                                 }
2258                         }
2259                 }
2260         }
2261         /*
2262          * If we have queued params in the open state, send out an ASCONF.
2263          */
2264         if (num_queued > 0) {
2265                 sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2266                     SCTP_ADDR_NOT_LOCKED);
2267         }
2268 }
2269
2270 void
2271 sctp_asconf_iterator_end(void *ptr, uint32_t val)
2272 {
2273         struct sctp_asconf_iterator *asc;
2274         struct sctp_ifa *ifa;
2275         struct sctp_laddr *l, *nl;
2276
2277         asc = (struct sctp_asconf_iterator *)ptr;
2278         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2279                 ifa = l->ifa;
2280                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2281                         /* Clear the defer use flag */
2282                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2283                 }
2284                 sctp_free_ifa(ifa);
2285                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2286                 SCTP_DECR_LADDR_COUNT();
2287         }
2288         SCTP_FREE(asc, SCTP_M_ASC_IT);
2289 }
2290
2291 /*
2292  * sa is the sockaddr to ask the peer to set primary to.
2293  * returns: 0 = completed, -1 = error
2294  */
2295 int32_t
2296 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2297 {
2298         uint32_t vrf_id;
2299         struct sctp_ifa *ifa;
2300
2301         /* find the ifa for the desired set primary */
2302         vrf_id = stcb->asoc.vrf_id;
2303         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2304         if (ifa == NULL) {
2305                 /* Invalid address */
2306                 return (-1);
2307         }
2308         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2309         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2310                 /* set primary queuing succeeded */
2311                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2312                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2313                     stcb);
2314                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2315                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2316 #ifdef SCTP_TIMER_BASED_ASCONF
2317                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2318                             stcb->sctp_ep, stcb,
2319                             stcb->asoc.primary_destination);
2320 #else
2321                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2322                             SCTP_ADDR_NOT_LOCKED);
2323 #endif
2324                 }
2325         } else {
2326                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2327                     stcb);
2328                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2329                 return (-1);
2330         }
2331         return (0);
2332 }
2333
2334 void
2335 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2336 {
2337         struct sctp_inpcb *inp;
2338
2339         /* go through all our PCB's */
2340         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2341                 struct sctp_tcb *stcb;
2342
2343                 /* process for all associations for this endpoint */
2344                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2345                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2346                         if (!sctp_asconf_queue_add(stcb, ifa,
2347                             SCTP_SET_PRIM_ADDR)) {
2348                                 /* set primary queuing succeeded */
2349                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2350                                     stcb);
2351                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2352                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2353 #ifdef SCTP_TIMER_BASED_ASCONF
2354                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2355                                             stcb->sctp_ep, stcb,
2356                                             stcb->asoc.primary_destination);
2357 #else
2358                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2359                                             SCTP_ADDR_NOT_LOCKED);
2360 #endif
2361                                 }
2362                         }
2363                 }               /* for each stcb */
2364         }                       /* for each inp */
2365 }
2366
2367 int
2368 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2369 {
2370         struct sctp_tmit_chunk *chk, *nchk;
2371         unsigned int offset, asconf_limit;
2372         struct sctp_asconf_chunk *acp;
2373         struct sctp_asconf_paramhdr *aph;
2374         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2375         struct sctp_ipv6addr_param *p_addr;
2376         int add_cnt, del_cnt;
2377         uint16_t last_param_type;
2378
2379         add_cnt = del_cnt = 0;
2380         last_param_type = 0;
2381         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2382                 if (chk->data == NULL) {
2383                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2384                         continue;
2385                 }
2386                 offset = 0;
2387                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2388                 offset += sizeof(struct sctp_asconf_chunk);
2389                 asconf_limit = ntohs(acp->ch.chunk_length);
2390                 p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2391                 if (p_addr == NULL) {
2392                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2393                         continue;
2394                 }
2395                 offset += ntohs(p_addr->ph.param_length);
2396
2397                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2398                 if (aph == NULL) {
2399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2400                         continue;
2401                 }
2402                 while (aph != NULL) {
2403                         unsigned int param_length, param_type;
2404
2405                         param_type = ntohs(aph->ph.param_type);
2406                         param_length = ntohs(aph->ph.param_length);
2407                         if (offset + param_length > asconf_limit) {
2408                                 /* parameter goes beyond end of chunk! */
2409                                 break;
2410                         }
2411                         if (param_length > sizeof(aparam_buf)) {
2412                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2413                                 break;
2414                         }
2415                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2416                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2417                                 break;
2418                         }
2419                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2420                         if (aph == NULL) {
2421                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2422                                 break;
2423                         }
2424                         p_addr = (struct sctp_ipv6addr_param *)(aph + 1);
2425                         if (sctp_addr_match(p_addr, &sctp_ifa->address.sa) != 0) {
2426                                 switch (param_type) {
2427                                 case SCTP_ADD_IP_ADDRESS:
2428                                         add_cnt++;
2429                                         break;
2430                                 case SCTP_DEL_IP_ADDRESS:
2431                                         del_cnt++;
2432                                         break;
2433                                 default:
2434                                         break;
2435                                 }
2436                                 last_param_type = param_type;
2437                         }
2438                         offset += SCTP_SIZE32(param_length);
2439                         if (offset >= asconf_limit) {
2440                                 /* no more data in the mbuf chain */
2441                                 break;
2442                         }
2443                         /* get pointer to next asconf param */
2444                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2445                 }
2446         }
2447
2448         /*
2449          * we want to find the sequences which consist of ADD -> DEL -> ADD
2450          * or DEL -> ADD
2451          */
2452         if (add_cnt > del_cnt ||
2453             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2454                 return 1;
2455         }
2456         return 0;
2457 }
2458
2459 static struct sockaddr *
2460 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2461 {
2462         struct sctp_vrf *vrf = NULL;
2463         struct sctp_ifn *sctp_ifn;
2464         struct sctp_ifa *sctp_ifa;
2465
2466         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2467                 SCTP_IPI_ADDR_RLOCK();
2468         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2469         if (vrf == NULL) {
2470                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2471                         SCTP_IPI_ADDR_RUNLOCK();
2472                 return (NULL);
2473         }
2474         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2475                 if (stcb->asoc.loopback_scope == 0 &&
2476                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2477                         /* Skip if loopback_scope not set */
2478                         continue;
2479                 }
2480                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2481                         if (sctp_ifa->address.sa.sa_family == AF_INET &&
2482                             stcb->asoc.ipv4_addr_legal) {
2483                                 struct sockaddr_in *sin;
2484
2485                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2486                                 if (sin->sin_addr.s_addr == 0) {
2487                                         /* skip unspecifed addresses */
2488                                         continue;
2489                                 }
2490                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2491                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2492                                         continue;
2493
2494                                 if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2495                                     (!sctp_is_addr_pending(stcb, sctp_ifa)))
2496                                         continue;
2497                                 /* found a valid local v4 address to use */
2498                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2499                                         SCTP_IPI_ADDR_RUNLOCK();
2500                                 return (&sctp_ifa->address.sa);
2501                         } else if (sctp_ifa->address.sa.sa_family == AF_INET6 &&
2502                             stcb->asoc.ipv6_addr_legal) {
2503                                 struct sockaddr_in6 *sin6;
2504
2505                                 if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2506                                         continue;
2507                                 }
2508                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2509                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2510                                         /* we skip unspecifed addresses */
2511                                         continue;
2512                                 }
2513                                 if (stcb->asoc.local_scope == 0 &&
2514                                     IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2515                                         continue;
2516                                 if (stcb->asoc.site_scope == 0 &&
2517                                     IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2518                                         continue;
2519
2520                                 if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2521                                     (!sctp_is_addr_pending(stcb, sctp_ifa)))
2522                                         continue;
2523                                 /* found a valid local v6 address to use */
2524                                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2525                                         SCTP_IPI_ADDR_RUNLOCK();
2526                                 return (&sctp_ifa->address.sa);
2527                         }
2528                 }
2529         }
2530         /* no valid addresses found */
2531         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2532                 SCTP_IPI_ADDR_RUNLOCK();
2533         return (NULL);
2534 }
2535
2536 static struct sockaddr *
2537 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2538 {
2539         struct sctp_laddr *laddr;
2540
2541         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2542                 if (laddr->ifa == NULL) {
2543                         continue;
2544                 }
2545                 /* is the address restricted ? */
2546                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2547                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2548                         continue;
2549
2550                 /* found a valid local address to use */
2551                 return (&laddr->ifa->address.sa);
2552         }
2553         /* no valid addresses found */
2554         return (NULL);
2555 }
2556
2557 /*
2558  * builds an ASCONF chunk from queued ASCONF params.
2559  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2560  */
2561 struct mbuf *
2562 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2563 {
2564         struct mbuf *m_asconf, *m_asconf_chk;
2565         struct sctp_asconf_addr *aa;
2566         struct sctp_asconf_chunk *acp;
2567         struct sctp_asconf_paramhdr *aph;
2568         struct sctp_asconf_addr_param *aap;
2569         uint32_t p_length;
2570         uint32_t correlation_id = 1;    /* 0 is reserved... */
2571         caddr_t ptr, lookup_ptr;
2572         uint8_t lookup_used = 0;
2573
2574         /* are there any asconf params to send? */
2575         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2576                 if (aa->sent == 0)
2577                         break;
2578         }
2579         if (aa == NULL)
2580                 return (NULL);
2581
2582         /*
2583          * get a chunk header mbuf and a cluster for the asconf params since
2584          * it's simpler to fill in the asconf chunk header lookup address on
2585          * the fly
2586          */
2587         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2588         if (m_asconf_chk == NULL) {
2589                 /* no mbuf's */
2590                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2591                     "compose_asconf: couldn't get chunk mbuf!\n");
2592                 return (NULL);
2593         }
2594         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2595         if (m_asconf == NULL) {
2596                 /* no mbuf's */
2597                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2598                     "compose_asconf: couldn't get mbuf!\n");
2599                 sctp_m_freem(m_asconf_chk);
2600                 return (NULL);
2601         }
2602         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2603         SCTP_BUF_LEN(m_asconf) = 0;
2604         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2605         bzero(acp, sizeof(struct sctp_asconf_chunk));
2606         /* save pointers to lookup address and asconf params */
2607         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2608         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2609
2610         /* fill in chunk header info */
2611         acp->ch.chunk_type = SCTP_ASCONF;
2612         acp->ch.chunk_flags = 0;
2613         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2614         stcb->asoc.asconf_seq_out++;
2615
2616         /* add parameters... up to smallest MTU allowed */
2617         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2618                 if (aa->sent)
2619                         continue;
2620                 /* get the parameter length */
2621                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2622                 /* will it fit in current chunk? */
2623                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2624                         /* won't fit, so we're done with this chunk */
2625                         break;
2626                 }
2627                 /* assign (and store) a correlation id */
2628                 aa->ap.aph.correlation_id = correlation_id++;
2629
2630                 /*
2631                  * fill in address if we're doing a delete this is a simple
2632                  * way for us to fill in the correlation address, which
2633                  * should only be used by the peer if we're deleting our
2634                  * source address and adding a new address (e.g. renumbering
2635                  * case)
2636                  */
2637                 if (lookup_used == 0 &&
2638                     (aa->special_del == 0) &&
2639                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2640                         struct sctp_ipv6addr_param *lookup;
2641                         uint16_t p_size, addr_size;
2642
2643                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2644                         lookup->ph.param_type =
2645                             htons(aa->ap.addrp.ph.param_type);
2646                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2647                                 /* copy IPv6 address */
2648                                 p_size = sizeof(struct sctp_ipv6addr_param);
2649                                 addr_size = sizeof(struct in6_addr);
2650                         } else {
2651                                 /* copy IPv4 address */
2652                                 p_size = sizeof(struct sctp_ipv4addr_param);
2653                                 addr_size = sizeof(struct in_addr);
2654                         }
2655                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2656                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2657                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2658                         lookup_used = 1;
2659                 }
2660                 /* copy into current space */
2661                 memcpy(ptr, &aa->ap, p_length);
2662
2663                 /* network elements and update lengths */
2664                 aph = (struct sctp_asconf_paramhdr *)ptr;
2665                 aap = (struct sctp_asconf_addr_param *)ptr;
2666                 /* correlation_id is transparent to peer, no htonl needed */
2667                 aph->ph.param_type = htons(aph->ph.param_type);
2668                 aph->ph.param_length = htons(aph->ph.param_length);
2669                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2670                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2671
2672                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2673                 ptr += SCTP_SIZE32(p_length);
2674
2675                 /*
2676                  * these params are removed off the pending list upon
2677                  * getting an ASCONF-ACK back from the peer, just set flag
2678                  */
2679                 aa->sent = 1;
2680         }
2681         /* check to see if the lookup addr has been populated yet */
2682         if (lookup_used == 0) {
2683                 /* NOTE: if the address param is optional, can skip this... */
2684                 /* add any valid (existing) address... */
2685                 struct sctp_ipv6addr_param *lookup;
2686                 uint16_t p_size, addr_size;
2687                 struct sockaddr *found_addr;
2688                 caddr_t addr_ptr;
2689
2690                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2691                         found_addr = sctp_find_valid_localaddr(stcb,
2692                             addr_locked);
2693                 else
2694                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2695
2696                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2697                 if (found_addr != NULL) {
2698                         if (found_addr->sa_family == AF_INET6) {
2699                                 /* copy IPv6 address */
2700                                 lookup->ph.param_type =
2701                                     htons(SCTP_IPV6_ADDRESS);
2702                                 p_size = sizeof(struct sctp_ipv6addr_param);
2703                                 addr_size = sizeof(struct in6_addr);
2704                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2705                                     found_addr)->sin6_addr;
2706                         } else {
2707                                 /* copy IPv4 address */
2708                                 lookup->ph.param_type =
2709                                     htons(SCTP_IPV4_ADDRESS);
2710                                 p_size = sizeof(struct sctp_ipv4addr_param);
2711                                 addr_size = sizeof(struct in_addr);
2712                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2713                                     found_addr)->sin_addr;
2714                         }
2715                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2716                         memcpy(lookup->addr, addr_ptr, addr_size);
2717                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2718                         lookup_used = 1;
2719                 } else {
2720                         /* uh oh... don't have any address?? */
2721                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2722                             "compose_asconf: no lookup addr!\n");
2723                         /* for now, we send a IPv4 address of 0.0.0.0 */
2724                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2725                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2726                         bzero(lookup->addr, sizeof(struct in_addr));
2727                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2728                         lookup_used = 1;
2729                 }
2730         }
2731         /* chain it all together */
2732         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2733         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2734         acp->ch.chunk_length = ntohs(*retlen);
2735
2736         return (m_asconf_chk);
2737 }
2738
2739 /*
2740  * section to handle address changes before an association is up eg. changes
2741  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2742  */
2743
2744 /*
2745  * processes the (local) addresses in the INIT-ACK chunk
2746  */
2747 static void
2748 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2749     unsigned int offset, unsigned int length)
2750 {
2751         struct sctp_paramhdr tmp_param, *ph;
2752         uint16_t plen, ptype;
2753         struct sctp_ifa *sctp_ifa;
2754         struct sctp_ipv6addr_param addr_store;
2755         struct sockaddr_in6 sin6;
2756         struct sockaddr_in sin;
2757         struct sockaddr *sa;
2758         uint32_t vrf_id;
2759
2760         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2761         if (stcb == NULL)       /* Un-needed check for SA */
2762                 return;
2763
2764         /* convert to upper bound */
2765         length += offset;
2766
2767         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2768                 return;
2769         }
2770         /* init the addresses */
2771         bzero(&sin6, sizeof(sin6));
2772         sin6.sin6_family = AF_INET6;
2773         sin6.sin6_len = sizeof(sin6);
2774         sin6.sin6_port = stcb->rport;
2775
2776         bzero(&sin, sizeof(sin));
2777         sin.sin_len = sizeof(sin);
2778         sin.sin_family = AF_INET;
2779         sin.sin_port = stcb->rport;
2780
2781         /* go through the addresses in the init-ack */
2782         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2783             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2784         while (ph != NULL) {
2785                 ptype = ntohs(ph->param_type);
2786                 plen = ntohs(ph->param_length);
2787                 if (ptype == SCTP_IPV6_ADDRESS) {
2788                         struct sctp_ipv6addr_param *a6p;
2789
2790                         /* get the entire IPv6 address param */
2791                         a6p = (struct sctp_ipv6addr_param *)
2792                             sctp_m_getptr(m, offset,
2793                             sizeof(struct sctp_ipv6addr_param),
2794                             (uint8_t *) & addr_store);
2795                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2796                             a6p == NULL) {
2797                                 return;
2798                         }
2799                         memcpy(&sin6.sin6_addr, a6p->addr,
2800                             sizeof(struct in6_addr));
2801                         sa = (struct sockaddr *)&sin6;
2802                 } else if (ptype == SCTP_IPV4_ADDRESS) {
2803                         struct sctp_ipv4addr_param *a4p;
2804
2805                         /* get the entire IPv4 address param */
2806                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2807                             sizeof(struct sctp_ipv4addr_param),
2808                             (uint8_t *) & addr_store);
2809                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2810                             a4p == NULL) {
2811                                 return;
2812                         }
2813                         sin.sin_addr.s_addr = a4p->addr;
2814                         sa = (struct sockaddr *)&sin;
2815                 } else {
2816                         goto next_addr;
2817                 }
2818
2819                 /* see if this address really (still) exists */
2820                 if (stcb) {
2821                         vrf_id = stcb->asoc.vrf_id;
2822                 } else {
2823                         vrf_id = SCTP_DEFAULT_VRFID;
2824                 }
2825                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2826                     SCTP_ADDR_NOT_LOCKED);
2827                 if (sctp_ifa == NULL) {
2828                         /* address doesn't exist anymore */
2829                         int status;
2830
2831                         /* are ASCONFs allowed ? */
2832                         if ((sctp_is_feature_on(stcb->sctp_ep,
2833                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2834                             stcb->asoc.peer_supports_asconf) {
2835                                 /* queue an ASCONF DEL_IP_ADDRESS */
2836                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2837                                 /*
2838                                  * if queued ok, and in correct state, send
2839                                  * out the ASCONF.
2840                                  */
2841                                 if (status == 0 &&
2842                                     SCTP_GET_STATE(&stcb->asoc) ==
2843                                     SCTP_STATE_OPEN) {
2844 #ifdef SCTP_TIMER_BASED_ASCONF
2845                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2846                                             stcb->sctp_ep, stcb,
2847                                             stcb->asoc.primary_destination);
2848 #else
2849                                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2850                                             SCTP_ADDR_NOT_LOCKED);
2851 #endif
2852                                 }
2853                         }
2854                 }
2855 next_addr:
2856                 /*
2857                  * Sanity check:  Make sure the length isn't 0, otherwise
2858                  * we'll be stuck in this loop for a long time...
2859                  */
2860                 if (SCTP_SIZE32(plen) == 0) {
2861                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2862                             plen, ptype);
2863                         return;
2864                 }
2865                 /* get next parameter */
2866                 offset += SCTP_SIZE32(plen);
2867                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2868                         return;
2869                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2870                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2871         }                       /* while */
2872 }
2873
2874 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2875 /*
2876  * checks to see if a specific address is in the initack address list returns
2877  * 1 if found, 0 if not
2878  */
2879 static uint32_t
2880 sctp_addr_in_initack(struct sctp_tcb *stcb, struct mbuf *m, uint32_t offset,
2881     uint32_t length, struct sockaddr *sa)
2882 {
2883         struct sctp_paramhdr tmp_param, *ph;
2884         uint16_t plen, ptype;
2885         struct sctp_ipv6addr_param addr_store;
2886         struct sockaddr_in *sin;
2887         struct sctp_ipv4addr_param *a4p;
2888
2889 #ifdef INET6
2890         struct sockaddr_in6 *sin6;
2891         struct sctp_ipv6addr_param *a6p;
2892         struct sockaddr_in6 sin6_tmp;
2893
2894 #endif                          /* INET6 */
2895
2896         if (
2897 #ifdef INET6
2898             (sa->sa_family != AF_INET6) &&
2899 #endif                          /* INET6 */
2900             (sa->sa_family != AF_INET))
2901                 return (0);
2902
2903         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2904         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2905         /* convert to upper bound */
2906         length += offset;
2907
2908         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2909                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2910                     "find_initack_addr: invalid offset?\n");
2911                 return (0);
2912         }
2913         /* go through the addresses in the init-ack */
2914         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2915             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2916         while (ph != NULL) {
2917                 ptype = ntohs(ph->param_type);
2918                 plen = ntohs(ph->param_length);
2919 #ifdef INET6
2920                 if (ptype == SCTP_IPV6_ADDRESS && sa->sa_family == AF_INET6) {
2921                         /* get the entire IPv6 address param */
2922                         a6p = (struct sctp_ipv6addr_param *)
2923                             sctp_m_getptr(m, offset,
2924                             sizeof(struct sctp_ipv6addr_param),
2925                             (uint8_t *) & addr_store);
2926                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
2927                             (ph == NULL) ||
2928                             (a6p == NULL)) {
2929                                 return (0);
2930                         }
2931                         sin6 = (struct sockaddr_in6 *)sa;
2932                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2933                                 /* create a copy and clear scope */
2934                                 memcpy(&sin6_tmp, sin6,
2935                                     sizeof(struct sockaddr_in6));
2936                                 sin6 = &sin6_tmp;
2937                                 in6_clearscope(&sin6->sin6_addr);
2938                         }
2939                         if (memcmp(&sin6->sin6_addr, a6p->addr,
2940                             sizeof(struct in6_addr)) == 0) {
2941                                 /* found it */
2942                                 return (1);
2943                         }
2944                 } else
2945 #endif                          /* INET6 */
2946
2947                         if (ptype == SCTP_IPV4_ADDRESS &&
2948                     sa->sa_family == AF_INET) {
2949                         /* get the entire IPv4 address param */
2950                         a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m,
2951                             offset, sizeof(struct sctp_ipv4addr_param),
2952                             (uint8_t *) & addr_store);
2953                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
2954                             (ph == NULL) ||
2955                             (a4p == NULL)) {
2956                                 return (0);
2957                         }
2958                         sin = (struct sockaddr_in *)sa;
2959                         if (sin->sin_addr.s_addr == a4p->addr) {
2960                                 /* found it */
2961                                 return (1);
2962                         }
2963                 }
2964                 /* get next parameter */
2965                 offset += SCTP_SIZE32(plen);
2966                 if (offset + sizeof(struct sctp_paramhdr) > length)
2967                         return (0);
2968                 ph = (struct sctp_paramhdr *)
2969                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2970                     (uint8_t *) & tmp_param);
2971         }                       /* while */
2972         /* not found! */
2973         return (0);
2974 }
2975
2976 /*
2977  * makes sure that the current endpoint local addr list is consistent with
2978  * the new association (eg. subset bound, asconf allowed) adds addresses as
2979  * necessary
2980  */
2981 static void
2982 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2983     int length, struct sockaddr *init_addr)
2984 {
2985         struct sctp_laddr *laddr;
2986
2987         /* go through the endpoint list */
2988         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2989                 /* be paranoid and validate the laddr */
2990                 if (laddr->ifa == NULL) {
2991                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2992                             "check_addr_list_ep: laddr->ifa is NULL");
2993                         continue;
2994                 }
2995                 if (laddr->ifa == NULL) {
2996                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
2997                         continue;
2998                 }
2999                 /* do i have it implicitly? */
3000                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3001                         continue;
3002                 }
3003                 /* check to see if in the init-ack */
3004                 if (!sctp_addr_in_initack(stcb, m, offset, length,
3005                     &laddr->ifa->address.sa)) {
3006                         /* try to add it */
3007                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3008                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3009                 }
3010         }
3011 }
3012
3013 /*
3014  * makes sure that the current kernel address list is consistent with the new
3015  * association (with all addrs bound) adds addresses as necessary
3016  */
3017 static void
3018 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3019     int length, struct sockaddr *init_addr,
3020     uint16_t local_scope, uint16_t site_scope,
3021     uint16_t ipv4_scope, uint16_t loopback_scope)
3022 {
3023         struct sctp_vrf *vrf = NULL;
3024         struct sctp_ifn *sctp_ifn;
3025         struct sctp_ifa *sctp_ifa;
3026         uint32_t vrf_id;
3027
3028         if (stcb) {
3029                 vrf_id = stcb->asoc.vrf_id;
3030         } else {
3031                 return;
3032         }
3033         SCTP_IPI_ADDR_RLOCK();
3034         vrf = sctp_find_vrf(vrf_id);
3035         if (vrf == NULL) {
3036                 SCTP_IPI_ADDR_RUNLOCK();
3037                 return;
3038         }
3039         /* go through all our known interfaces */
3040         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3041                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3042                         /* skip loopback interface */
3043                         continue;
3044                 }
3045                 /* go through each interface address */
3046                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3047                         /* do i have it implicitly? */
3048                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3049                                 continue;
3050                         }
3051                         /* check to see if in the init-ack */
3052                         if (!sctp_addr_in_initack(stcb, m, offset, length,
3053                             &sctp_ifa->address.sa)) {
3054                                 /* try to add it */
3055                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3056                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3057                                     SCTP_ADDR_LOCKED);
3058                         }
3059                 }               /* end foreach ifa */
3060         }                       /* end foreach ifn */
3061         SCTP_IPI_ADDR_RUNLOCK();
3062 }
3063
3064 /*
3065  * validates an init-ack chunk (from a cookie-echo) with current addresses
3066  * adds addresses from the init-ack into our local address list, if needed
3067  * queues asconf adds/deletes addresses as needed and makes appropriate list
3068  * changes for source address selection m, offset: points to the start of the
3069  * address list in an init-ack chunk length: total length of the address
3070  * params only init_addr: address where my INIT-ACK was sent from
3071  */
3072 void
3073 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3074     int length, struct sockaddr *init_addr,
3075     uint16_t local_scope, uint16_t site_scope,
3076     uint16_t ipv4_scope, uint16_t loopback_scope)
3077 {
3078         /* process the local addresses in the initack */
3079         sctp_process_initack_addresses(stcb, m, offset, length);
3080
3081         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3082                 /* bound all case */
3083                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3084                     local_scope, site_scope, ipv4_scope, loopback_scope);
3085         } else {
3086                 /* subset bound case */
3087                 if (sctp_is_feature_on(stcb->sctp_ep,
3088                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3089                         /* asconf's allowed */
3090                         sctp_check_address_list_ep(stcb, m, offset, length,
3091                             init_addr);
3092                 }
3093                 /* else, no asconfs allowed, so what we sent is what we get */
3094         }
3095 }
3096
3097 /*
3098  * sctp_bindx() support
3099  */
3100 uint32_t
3101 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3102     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3103 {
3104         struct sctp_ifa *ifa;
3105
3106         if (sa->sa_len == 0) {
3107                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3108                 return (EINVAL);
3109         }
3110         if (sctp_ifap) {
3111                 ifa = sctp_ifap;
3112         } else if (type == SCTP_ADD_IP_ADDRESS) {
3113                 /* For an add the address MUST be on the system */
3114                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3115         } else if (type == SCTP_DEL_IP_ADDRESS) {
3116                 /* For a delete we need to find it in the inp */
3117                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3118         } else {
3119                 ifa = NULL;
3120         }
3121         if (ifa != NULL) {
3122                 if (type == SCTP_ADD_IP_ADDRESS) {
3123                         sctp_add_local_addr_ep(inp, ifa, type);
3124                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3125                         struct sctp_laddr *laddr;
3126
3127                         if (inp->laddr_count < 2) {
3128                                 /* can't delete the last local address */
3129                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3130                                 return (EINVAL);
3131                         }
3132                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3133                             sctp_nxt_addr) {
3134                                 if (ifa == laddr->ifa) {
3135                                         /* Mark in the delete */
3136                                         laddr->action = type;
3137                                 }
3138                         }
3139                 }
3140                 if (!LIST_EMPTY(&inp->sctp_asoc_list)) {
3141                         /*
3142                          * There is no need to start the iterator if the inp
3143                          * has no associations.
3144                          */
3145                         struct sctp_asconf_iterator *asc;
3146                         struct sctp_laddr *wi;
3147
3148                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3149                             sizeof(struct sctp_asconf_iterator),
3150                             SCTP_M_ASC_IT);
3151                         if (asc == NULL) {
3152                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3153                                 return (ENOMEM);
3154                         }
3155                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3156                         if (wi == NULL) {
3157                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3158                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3159                                 return (ENOMEM);
3160                         }
3161                         LIST_INIT(&asc->list_of_work);
3162                         asc->cnt = 1;
3163                         SCTP_INCR_LADDR_COUNT();
3164                         wi->ifa = ifa;
3165                         wi->action = type;
3166                         atomic_add_int(&ifa->refcount, 1);
3167                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3168                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3169                             sctp_asconf_iterator_stcb,
3170                             sctp_asconf_iterator_ep_end,
3171                             SCTP_PCB_ANY_FLAGS,
3172                             SCTP_PCB_ANY_FEATURES,
3173                             SCTP_ASOC_ANY_STATE,
3174                             (void *)asc, 0,
3175                             sctp_asconf_iterator_end, inp, 0);
3176                 }
3177                 return (0);
3178         } else {
3179                 /* invalid address! */
3180                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3181                 return (EADDRNOTAVAIL);
3182         }
3183 }
3184
3185 void
3186 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3187     struct sctp_nets *net)
3188 {
3189         struct sctp_asconf_addr *aa;
3190         struct sctp_ifa *sctp_ifap;
3191         struct sctp_asconf_tag_param *vtag;
3192         struct sockaddr_in *to;
3193
3194 #ifdef INET6
3195         struct sockaddr_in6 *to6;
3196
3197 #endif
3198         if (net == NULL) {
3199                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3200                 return;
3201         }
3202         if (stcb == NULL) {
3203                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3204                 return;
3205         }
3206         /*
3207          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3208          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3209          */
3210         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3211             SCTP_M_ASC_ADDR);
3212         if (aa == NULL) {
3213                 /* didn't get memory */
3214                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3215                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3216                 return;
3217         }
3218         aa->special_del = 0;
3219         /* fill in asconf address parameter fields */
3220         /* top level elements are "networked" during send */
3221         aa->ifa = NULL;
3222         aa->sent = 0;           /* clear sent flag */
3223         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3224         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3225         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3226         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3227         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3228         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3229
3230         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3231             SCTP_M_ASC_ADDR);
3232         if (aa == NULL) {
3233                 /* didn't get memory */
3234                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3235                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3236                 return;
3237         }
3238         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3239         /* fill in asconf address parameter fields */
3240         /* ADD(0.0.0.0) */
3241         if (net->ro._l_addr.sa.sa_family == AF_INET) {
3242                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3243                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3244                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3245                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3246                 /* No need to add an address, we are using 0.0.0.0 */
3247                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3248         }
3249 #ifdef INET6
3250         else if (net->ro._l_addr.sa.sa_family == AF_INET6) {
3251                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3252                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3253                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3254                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3255                 /* No need to add an address, we are using 0.0.0.0 */
3256                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3257         }
3258 #endif                          /* INET6 */
3259         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3260             SCTP_M_ASC_ADDR);
3261         if (aa == NULL) {
3262                 /* didn't get memory */
3263                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3264                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3265                 return;
3266         }
3267         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3268         /* fill in asconf address parameter fields */
3269         /* ADD(0.0.0.0) */
3270         if (net->ro._l_addr.sa.sa_family == AF_INET) {
3271                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3272                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3273                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3274                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3275                 /* No need to add an address, we are using 0.0.0.0 */
3276                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3277         }
3278 #ifdef INET6
3279         else if (net->ro._l_addr.sa.sa_family == AF_INET6) {
3280                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3281                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3282                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3283                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3284                 /* No need to add an address, we are using 0.0.0.0 */
3285                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3286         }
3287 #endif                          /* INET6 */
3288         /* Now we must hunt the addresses and add all global addresses */
3289         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3290                 struct sctp_vrf *vrf = NULL;
3291                 struct sctp_ifn *sctp_ifnp;
3292                 uint32_t vrf_id;
3293
3294                 vrf_id = stcb->sctp_ep->def_vrf_id;
3295                 vrf = sctp_find_vrf(vrf_id);
3296                 if (vrf == NULL) {
3297                         goto skip_rest;
3298                 }
3299                 SCTP_IPI_ADDR_RLOCK();
3300                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3301                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3302                                 if (sctp_ifap->address.sa.sa_family == AF_INET) {
3303                                         to = &sctp_ifap->address.sin;
3304
3305                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3306                                                 continue;
3307                                         }
3308                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3309                                                 continue;
3310                                         }
3311                                 }
3312 #ifdef INET6
3313                                 else if (sctp_ifap->address.sa.sa_family == AF_INET6) {
3314                                         to6 = &sctp_ifap->address.sin6;
3315                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3316                                                 continue;
3317                                         }
3318                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3319                                                 continue;
3320                                         }
3321                                 }
3322 #endif
3323                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3324                         }
3325                 }
3326                 SCTP_IPI_ADDR_RUNLOCK();
3327         } else {
3328                 struct sctp_laddr *laddr;
3329
3330                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3331                         if (laddr->ifa == NULL) {
3332                                 continue;
3333                         }
3334                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3335                                 /*
3336                                  * Address being deleted by the system, dont
3337                                  * list.
3338                                  */
3339                                 continue;
3340                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3341                                 /*
3342                                  * Address being deleted on this ep don't
3343                                  * list.
3344                                  */
3345                                 continue;
3346                         }
3347                         sctp_ifap = laddr->ifa;
3348                         if (sctp_ifap->address.sa.sa_family == AF_INET) {
3349                                 to = &sctp_ifap->address.sin;
3350
3351                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3352                                         continue;
3353                                 }
3354                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3355                                         continue;
3356                                 }
3357                         }
3358 #ifdef INET6
3359                         else if (sctp_ifap->address.sa.sa_family == AF_INET6) {
3360                                 to6 = &sctp_ifap->address.sin6;
3361                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3362                                         continue;
3363                                 }
3364                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3365                                         continue;
3366                                 }
3367                         }
3368 #endif
3369                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3370                 }
3371         }
3372 skip_rest:
3373         /* Now we must send the asconf into the queue */
3374         sctp_send_asconf(stcb, net, 0);
3375 }