sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_NOWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_NOWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         union sctp_sockstore store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, aparam_length;
 154
 155 #if defined(INET) || defined(INET6)
 156         uint16_t param_length;
 157
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162
 163 #ifdef INET
 164         struct sockaddr_in *sin;
 165         struct sctp_ipv4addr_param *v4addr;
 166
 167 #endif
 168 #ifdef INET6
 169         struct sockaddr_in6 *sin6;
 170         struct sctp_ipv6addr_param *v6addr;
 171
 172 #endif
 173
 174         aparam_length = ntohs(aph->ph.param_length);
 175         ph = (struct sctp_paramhdr *)(aph + 1);
 176         param_type = ntohs(ph->param_type);
 177 #if defined(INET) || defined(INET6)
 178         param_length = ntohs(ph->param_length);
 179 #endif
 180         sa = &store.sa;
 181         switch (param_type) {
 182 #ifdef INET
 183         case SCTP_IPV4_ADDRESS:
 184                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 185                         /* invalid param size */
 186                         return (NULL);
 187                 }
 188                 v4addr = (struct sctp_ipv4addr_param *)ph;
 189                 sin = &store.sin;
 190                 bzero(sin, sizeof(*sin));
 191                 sin->sin_family = AF_INET;
 192                 sin->sin_len = sizeof(struct sockaddr_in);
 193                 sin->sin_port = stcb->rport;
 194                 sin->sin_addr.s_addr = v4addr->addr;
 195                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 196                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 197                         bad_address = 1;
 198                 }
 199                 if (sin->sin_addr.s_addr == INADDR_ANY)
 200                         zero_address = 1;
 201                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 202                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 203                 break;
 204 #endif
 205 #ifdef INET6
 206         case SCTP_IPV6_ADDRESS:
 207                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 208                         /* invalid param size */
 209                         return (NULL);
 210                 }
 211                 v6addr = (struct sctp_ipv6addr_param *)ph;
 212                 sin6 = &store.sin6;
 213                 bzero(sin6, sizeof(*sin6));
 214                 sin6->sin6_family = AF_INET6;
 215                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 216                 sin6->sin6_port = stcb->rport;
 217                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 218                     sizeof(struct in6_addr));
 219                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 220                         bad_address = 1;
 221                 }
 222                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 223                         zero_address = 1;
 224                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 225                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 226                 break;
 227 #endif
 228         default:
 229                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 230                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 231                     aparam_length);
 232                 return (m_reply);
 233         }                       /* end switch */
 234
 235         /* if 0.0.0.0/::0, add the source address instead */
 236         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 237                 sa = src;
 238                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 239                     "process_asconf_add_ip: using source addr ");
 240                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 241         }
 242         /* add the address */
 243         if (bad_address) {
 244                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 245                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 246                     aparam_length);
 247         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 248             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 249                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 250                     "process_asconf_add_ip: error adding address\n");
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 253                     aparam_length);
 254         } else {
 255                 /* notify upper layer */
 256                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 257                 if (response_required) {
 258                         m_reply =
 259                             sctp_asconf_success_response(aph->correlation_id);
 260                 }
 261                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 262                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 263                     stcb, net);
 264                 if (send_hb) {
 265                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 266                 }
 267         }
 268         return (m_reply);
 269 }
 270
 271 static int
 272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 273 {
 274         struct sctp_nets *src_net, *net;
 275
 276         /* make sure the source address exists as a destination net */
 277         src_net = sctp_findnet(stcb, src);
 278         if (src_net == NULL) {
 279                 /* not found */
 280                 return (-1);
 281         }
 282         /* delete all destination addresses except the source */
 283         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 284                 if (net != src_net) {
 285                         /* delete this address */
 286                         sctp_remove_net(stcb, net);
 287                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 288                             "asconf_del_remote_addrs_except: deleting ");
 289                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 290                             (struct sockaddr *)&net->ro._l_addr);
 291                         /* notify upper layer */
 292                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 293                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 294                 }
 295         }
 296         return (0);
 297 }
 298
 299 static struct mbuf *
 300 sctp_process_asconf_delete_ip(struct sockaddr *src,
 301     struct sctp_asconf_paramhdr *aph,
 302     struct sctp_tcb *stcb, int response_required)
 303 {
 304         struct mbuf *m_reply = NULL;
 305         union sctp_sockstore store;
 306         struct sctp_paramhdr *ph;
 307         uint16_t param_type, aparam_length;
 308
 309 #if defined(INET) || defined(INET6)
 310         uint16_t param_length;
 311
 312 #endif
 313         struct sockaddr *sa;
 314         int zero_address = 0;
 315         int result;
 316
 317 #ifdef INET
 318         struct sockaddr_in *sin;
 319         struct sctp_ipv4addr_param *v4addr;
 320
 321 #endif
 322 #ifdef INET6
 323         struct sockaddr_in6 *sin6;
 324         struct sctp_ipv6addr_param *v6addr;
 325
 326 #endif
 327
 328         aparam_length = ntohs(aph->ph.param_length);
 329         ph = (struct sctp_paramhdr *)(aph + 1);
 330         param_type = ntohs(ph->param_type);
 331 #if defined(INET) || defined(INET6)
 332         param_length = ntohs(ph->param_length);
 333 #endif
 334         sa = &store.sa;
 335         switch (param_type) {
 336 #ifdef INET
 337         case SCTP_IPV4_ADDRESS:
 338                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 339                         /* invalid param size */
 340                         return (NULL);
 341                 }
 342                 v4addr = (struct sctp_ipv4addr_param *)ph;
 343                 sin = &store.sin;
 344                 bzero(sin, sizeof(*sin));
 345                 sin->sin_family = AF_INET;
 346                 sin->sin_len = sizeof(struct sockaddr_in);
 347                 sin->sin_port = stcb->rport;
 348                 sin->sin_addr.s_addr = v4addr->addr;
 349                 if (sin->sin_addr.s_addr == INADDR_ANY)
 350                         zero_address = 1;
 351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 352                     "process_asconf_delete_ip: deleting ");
 353                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 354                 break;
 355 #endif
 356 #ifdef INET6
 357         case SCTP_IPV6_ADDRESS:
 358                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 359                         /* invalid param size */
 360                         return (NULL);
 361                 }
 362                 v6addr = (struct sctp_ipv6addr_param *)ph;
 363                 sin6 = &store.sin6;
 364                 bzero(sin6, sizeof(*sin6));
 365                 sin6->sin6_family = AF_INET6;
 366                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 367                 sin6->sin6_port = stcb->rport;
 368                 memcpy(&sin6->sin6_addr, v6addr->addr,
 369                     sizeof(struct in6_addr));
 370                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 371                         zero_address = 1;
 372                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 373                     "process_asconf_delete_ip: deleting ");
 374                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 375                 break;
 376 #endif
 377         default:
 378                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 379                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 380                     aparam_length);
 381                 return (m_reply);
 382         }
 383
 384         /* make sure the source address is not being deleted */
 385         if (sctp_cmpaddr(sa, src)) {
 386                 /* trying to delete the source address! */
 387                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 388                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 389                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 390                     aparam_length);
 391                 return (m_reply);
 392         }
 393         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 394         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 395                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 396
 397                 if (result) {
 398                         /* src address did not exist? */
 399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 400                         /* what error to reply with?? */
 401                         m_reply =
 402                             sctp_asconf_error_response(aph->correlation_id,
 403                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 404                             aparam_length);
 405                 } else if (response_required) {
 406                         m_reply =
 407                             sctp_asconf_success_response(aph->correlation_id);
 408                 }
 409                 return (m_reply);
 410         }
 411         /* delete the address */
 412         result = sctp_del_remote_addr(stcb, sa);
 413         /*
 414          * note if result == -2, the address doesn't exist in the asoc but
 415          * since it's being deleted anyways, we just ack the delete -- but
 416          * this probably means something has already gone awry
 417          */
 418         if (result == -1) {
 419                 /* only one address in the asoc */
 420                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 421                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 422                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 423                     aparam_length);
 424         } else {
 425                 if (response_required) {
 426                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 427                 }
 428                 /* notify upper layer */
 429                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 430         }
 431         return (m_reply);
 432 }
 433
 434 static struct mbuf *
 435 sctp_process_asconf_set_primary(struct sockaddr *src,
 436     struct sctp_asconf_paramhdr *aph,
 437     struct sctp_tcb *stcb, int response_required)
 438 {
 439         struct mbuf *m_reply = NULL;
 440         union sctp_sockstore store;
 441         struct sctp_paramhdr *ph;
 442         uint16_t param_type, aparam_length;
 443
 444 #if defined(INET) || defined(INET6)
 445         uint16_t param_length;
 446
 447 #endif
 448         struct sockaddr *sa;
 449         int zero_address = 0;
 450
 451 #ifdef INET
 452         struct sockaddr_in *sin;
 453         struct sctp_ipv4addr_param *v4addr;
 454
 455 #endif
 456 #ifdef INET6
 457         struct sockaddr_in6 *sin6;
 458         struct sctp_ipv6addr_param *v6addr;
 459
 460 #endif
 461
 462         aparam_length = ntohs(aph->ph.param_length);
 463         ph = (struct sctp_paramhdr *)(aph + 1);
 464         param_type = ntohs(ph->param_type);
 465 #if defined(INET) || defined(INET6)
 466         param_length = ntohs(ph->param_length);
 467 #endif
 468         sa = &store.sa;
 469         switch (param_type) {
 470 #ifdef INET
 471         case SCTP_IPV4_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v4addr = (struct sctp_ipv4addr_param *)ph;
 477                 sin = &store.sin;
 478                 bzero(sin, sizeof(*sin));
 479                 sin->sin_family = AF_INET;
 480                 sin->sin_len = sizeof(struct sockaddr_in);
 481                 sin->sin_addr.s_addr = v4addr->addr;
 482                 if (sin->sin_addr.s_addr == INADDR_ANY)
 483                         zero_address = 1;
 484                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 485                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 486                 break;
 487 #endif
 488 #ifdef INET6
 489         case SCTP_IPV6_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 491                         /* invalid param size */
 492                         return (NULL);
 493                 }
 494                 v6addr = (struct sctp_ipv6addr_param *)ph;
 495                 sin6 = &store.sin6;
 496                 bzero(sin6, sizeof(*sin6));
 497                 sin6->sin6_family = AF_INET6;
 498                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 499                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 500                     sizeof(struct in6_addr));
 501                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 502                         zero_address = 1;
 503                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 504                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 505                 break;
 506 #endif
 507         default:
 508                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 509                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 510                     aparam_length);
 511                 return (m_reply);
 512         }
 513
 514         /* if 0.0.0.0/::0, use the source address instead */
 515         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 516                 sa = src;
 517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 518                     "process_asconf_set_primary: using source addr ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 520         }
 521         /* set the primary address */
 522         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 523                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 524                     "process_asconf_set_primary: primary address set\n");
 525                 /* notify upper layer */
 526                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 527                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 528                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 529                     (stcb->asoc.alternate)) {
 530                         sctp_free_remote_addr(stcb->asoc.alternate);
 531                         stcb->asoc.alternate = NULL;
 532                 }
 533                 if (response_required) {
 534                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 535                 }
 536                 /*
 537                  * Mobility adaptation. Ideally, when the reception of SET
 538                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 539                  * destination, unacknowledged DATA are retransmitted
 540                  * immediately to the new primary destination for seamless
 541                  * handover. If the destination is UNCONFIRMED and marked to
 542                  * REQ_PRIM, The retransmission occur when reception of the
 543                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 544                  * sctp_input.c) Also, when change of the primary
 545                  * destination, it is better that all subsequent new DATA
 546                  * containing already queued DATA are transmitted to the new
 547                  * primary destination. (by micchie)
 548                  */
 549                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 550                     SCTP_MOBILITY_BASE) ||
 551                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 552                     SCTP_MOBILITY_FASTHANDOFF)) &&
 553                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 554                     SCTP_MOBILITY_PRIM_DELETED) &&
 555                     (stcb->asoc.primary_destination->dest_state &
 556                     SCTP_ADDR_UNCONFIRMED) == 0) {
 557
 558                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 559                             stcb->sctp_ep, stcb, NULL,
 560                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 561                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 562                             SCTP_MOBILITY_FASTHANDOFF)) {
 563                                 sctp_assoc_immediate_retrans(stcb,
 564                                     stcb->asoc.primary_destination);
 565                         }
 566                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 567                             SCTP_MOBILITY_BASE)) {
 568                                 sctp_move_chunks_from_net(stcb,
 569                                     stcb->asoc.deleted_primary);
 570                         }
 571                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 572                             stcb->asoc.deleted_primary);
 573                 }
 574         } else {
 575                 /* couldn't set the requested primary address! */
 576                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 577                     "process_asconf_set_primary: set primary failed!\n");
 578                 /* must have been an invalid address, so report */
 579                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 580                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 581                     aparam_length);
 582         }
 583
 584         return (m_reply);
 585 }
 586
 587 /*
 588  * handles an ASCONF chunk.
 589  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 590  */
 591 void
 592 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 593     struct sockaddr *src,
 594     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 595     int first)
 596 {
 597         struct sctp_association *asoc;
 598         uint32_t serial_num;
 599         struct mbuf *n, *m_ack, *m_result, *m_tail;
 600         struct sctp_asconf_ack_chunk *ack_cp;
 601         struct sctp_asconf_paramhdr *aph;
 602         struct sctp_ipv6addr_param *p_addr;
 603         unsigned int asconf_limit, cnt;
 604         int error = 0;          /* did an error occur? */
 605
 606         /* asconf param buffer */
 607         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 608         struct sctp_asconf_ack *ack, *ack_next;
 609
 610         /* verify minimum length */
 611         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 612                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 613                     "handle_asconf: chunk too small = %xh\n",
 614                     ntohs(cp->ch.chunk_length));
 615                 return;
 616         }
 617         asoc = &stcb->asoc;
 618         serial_num = ntohl(cp->serial_number);
 619
 620         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 621                 /* got a duplicate ASCONF */
 622                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 623                     "handle_asconf: got duplicate serial number = %xh\n",
 624                     serial_num);
 625                 return;
 626         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 627                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 628                     serial_num, asoc->asconf_seq_in + 1);
 629                 return;
 630         }
 631         /* it's the expected "next" sequence number, so process it */
 632         asoc->asconf_seq_in = serial_num;       /* update sequence */
 633         /* get length of all the param's in the ASCONF */
 634         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 635         SCTPDBG(SCTP_DEBUG_ASCONF1,
 636             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 637             asconf_limit, serial_num);
 638
 639         if (first) {
 640                 /* delete old cache */
 641                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 642
 643                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 644                         if (ack->serial_number == serial_num)
 645                                 break;
 646                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 647                             ack->serial_number, serial_num);
 648                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 649                         if (ack->data != NULL) {
 650                                 sctp_m_freem(ack->data);
 651                         }
 652                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 653                 }
 654         }
 655         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 656             M_NOWAIT, 1, MT_DATA);
 657         if (m_ack == NULL) {
 658                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 659                     "handle_asconf: couldn't get mbuf!\n");
 660                 return;
 661         }
 662         m_tail = m_ack;         /* current reply chain's tail */
 663
 664         /* fill in ASCONF-ACK header */
 665         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 666         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 667         ack_cp->ch.chunk_flags = 0;
 668         ack_cp->serial_number = htonl(serial_num);
 669         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 670         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 671         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 672
 673         /* skip the lookup address parameter */
 674         offset += sizeof(struct sctp_asconf_chunk);
 675         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 676         if (p_addr == NULL) {
 677                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 678                     "handle_asconf: couldn't get lookup addr!\n");
 679                 /* respond with a missing/invalid mandatory parameter error */
 680                 return;
 681         }
 682         /* param_length is already validated in process_control... */
 683         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 684         /* get pointer to first asconf param in ASCONF */
 685         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 686         if (aph == NULL) {
 687                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 688                 goto send_reply;
 689         }
 690         /* process through all parameters */
 691         cnt = 0;
 692         while (aph != NULL) {
 693                 unsigned int param_length, param_type;
 694
 695                 param_type = ntohs(aph->ph.param_type);
 696                 param_length = ntohs(aph->ph.param_length);
 697                 if (offset + param_length > asconf_limit) {
 698                         /* parameter goes beyond end of chunk! */
 699                         sctp_m_freem(m_ack);
 700                         return;
 701                 }
 702                 m_result = NULL;
 703
 704                 if (param_length > sizeof(aparam_buf)) {
 705                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 706                         sctp_m_freem(m_ack);
 707                         return;
 708                 }
 709                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 710                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 711                         sctp_m_freem(m_ack);
 712                 }
 713                 /* get the entire parameter */
 714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 715                 if (aph == NULL) {
 716                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 717                         sctp_m_freem(m_ack);
 718                         return;
 719                 }
 720                 switch (param_type) {
 721                 case SCTP_ADD_IP_ADDRESS:
 722                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 723                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 724                         cnt++;
 725                         break;
 726                 case SCTP_DEL_IP_ADDRESS:
 727                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 728                             error);
 729                         break;
 730                 case SCTP_ERROR_CAUSE_IND:
 731                         /* not valid in an ASCONF chunk */
 732                         break;
 733                 case SCTP_SET_PRIM_ADDR:
 734                         m_result = sctp_process_asconf_set_primary(src, aph,
 735                             stcb, error);
 736                         break;
 737                 case SCTP_NAT_VTAGS:
 738                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 739                         break;
 740                 case SCTP_SUCCESS_REPORT:
 741                         /* not valid in an ASCONF chunk */
 742                         break;
 743                 case SCTP_ULP_ADAPTATION:
 744                         /* FIX */
 745                         break;
 746                 default:
 747                         if ((param_type & 0x8000) == 0) {
 748                                 /* Been told to STOP at this param */
 749                                 asconf_limit = offset;
 750                                 /*
 751                                  * FIX FIX - We need to call
 752                                  * sctp_arethere_unrecognized_parameters()
 753                                  * to get a operr and send it for any
 754                                  * param's with the 0x4000 bit set OR do it
 755                                  * here ourselves... note we still must STOP
 756                                  * if the 0x8000 bit is clear.
 757                                  */
 758                         }
 759                         /* unknown/invalid param type */
 760                         break;
 761                 }               /* switch */
 762
 763                 /* add any (error) result to the reply mbuf chain */
 764                 if (m_result != NULL) {
 765                         SCTP_BUF_NEXT(m_tail) = m_result;
 766                         m_tail = m_result;
 767                         /* update lengths, make sure it's aligned too */
 768                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 769                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 770                         /* set flag to force success reports */
 771                         error = 1;
 772                 }
 773                 offset += SCTP_SIZE32(param_length);
 774                 /* update remaining ASCONF message length to process */
 775                 if (offset >= asconf_limit) {
 776                         /* no more data in the mbuf chain */
 777                         break;
 778                 }
 779                 /* get pointer to next asconf param */
 780                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 781                     sizeof(struct sctp_asconf_paramhdr),
 782                     (uint8_t *) & aparam_buf);
 783                 if (aph == NULL) {
 784                         /* can't get an asconf paramhdr */
 785                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 786                         /* FIX ME - add error here... */
 787                 }
 788         }
 789
 790 send_reply:
 791         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 792         /* save the ASCONF-ACK reply */
 793         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 794             struct sctp_asconf_ack);
 795         if (ack == NULL) {
 796                 sctp_m_freem(m_ack);
 797                 return;
 798         }
 799         ack->serial_number = serial_num;
 800         ack->last_sent_to = NULL;
 801         ack->data = m_ack;
 802         ack->len = 0;
 803         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 804                 ack->len += SCTP_BUF_LEN(n);
 805         }
 806         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 807
 808         /* see if last_control_chunk_from is set properly (use IP src addr) */
 809         if (stcb->asoc.last_control_chunk_from == NULL) {
 810                 /*
 811                  * this could happen if the source address was just newly
 812                  * added
 813                  */
 814                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 815                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 816                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 817                 /* look up the from address */
 818                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 819 #ifdef SCTP_DEBUG
 820                 if (stcb->asoc.last_control_chunk_from == NULL) {
 821                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 822                 }
 823 #endif
 824         }
 825 }
 826
 827 /*
 828  * does the address match? returns 0 if not, 1 if so
 829  */
 830 static uint32_t
 831 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 832 {
 833         switch (sa->sa_family) {
 834 #ifdef INET6
 835         case AF_INET6:
 836                 {
 837                         /* XXX scopeid */
 838                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 839
 840                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 841                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 842                             sizeof(struct in6_addr)) == 0)) {
 843                                 return (1);
 844                         }
 845                         break;
 846                 }
 847 #endif
 848 #ifdef INET
 849         case AF_INET:
 850                 {
 851                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 852
 853                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 854                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 855                             sizeof(struct in_addr)) == 0)) {
 856                                 return (1);
 857                         }
 858                         break;
 859                 }
 860 #endif
 861         default:
 862                 break;
 863         }
 864         return (0);
 865 }
 866
 867 /*
 868  * does the address match? returns 0 if not, 1 if so
 869  */
 870 static uint32_t
 871 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 872 {
 873 #if defined(INET) || defined(INET6)
 874         uint16_t param_type, param_length;
 875
 876         param_type = ntohs(ph->param_type);
 877         param_length = ntohs(ph->param_length);
 878 #endif
 879         switch (sa->sa_family) {
 880 #ifdef INET6
 881         case AF_INET6:
 882                 {
 883                         /* XXX scopeid */
 884                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 885                         struct sctp_ipv6addr_param *v6addr;
 886
 887                         v6addr = (struct sctp_ipv6addr_param *)ph;
 888                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 889                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 890                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 891                             sizeof(struct in6_addr)) == 0)) {
 892                                 return (1);
 893                         }
 894                         break;
 895                 }
 896 #endif
 897 #ifdef INET
 898         case AF_INET:
 899                 {
 900                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 901                         struct sctp_ipv4addr_param *v4addr;
 902
 903                         v4addr = (struct sctp_ipv4addr_param *)ph;
 904                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 905                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 906                             (memcmp(&v4addr->addr, &sin->sin_addr,
 907                             sizeof(struct in_addr)) == 0)) {
 908                                 return (1);
 909                         }
 910                         break;
 911                 }
 912 #endif
 913         default:
 914                 break;
 915         }
 916         return (0);
 917 }
 918
 919 /*
 920  * Cleanup for non-responded/OP ERR'd ASCONF
 921  */
 922 void
 923 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 924 {
 925         /*
 926          * clear out any existing asconfs going out
 927          */
 928         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 929             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 930         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 931         /* remove the old ASCONF on our outbound queue */
 932         sctp_toss_old_asconf(stcb);
 933 }
 934
 935 /*
 936  * cleanup any cached source addresses that may be topologically
 937  * incorrect after a new address has been added to this interface.
 938  */
 939 static void
 940 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 941 {
 942         struct sctp_nets *net;
 943
 944         /*
 945          * Ideally, we want to only clear cached routes and source addresses
 946          * that are topologically incorrect.  But since there is no easy way
 947          * to know whether the newly added address on the ifn would cause a
 948          * routing change (i.e. a new egress interface would be chosen)
 949          * without doing a new routing lookup and source address selection,
 950          * we will (for now) just flush any cached route using a different
 951          * ifn (and cached source addrs) and let output re-choose them
 952          * during the next send on that net.
 953          */
 954         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 955                 /*
 956                  * clear any cached route (and cached source address) if the
 957                  * route's interface is NOT the same as the address change.
 958                  * If it's the same interface, just clear the cached source
 959                  * address.
 960                  */
 961                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 962                     ((ifn == NULL) ||
 963                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 964                         /* clear any cached route */
 965                         RTFREE(net->ro.ro_rt);
 966                         net->ro.ro_rt = NULL;
 967                 }
 968                 /* clear any cached source address */
 969                 if (net->src_addr_selected) {
 970                         sctp_free_ifa(net->ro._s_addr);
 971                         net->ro._s_addr = NULL;
 972                         net->src_addr_selected = 0;
 973                 }
 974         }
 975 }
 976
 977
 978 void
 979 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 980 {
 981         int error;
 982
 983         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 984                 return;
 985         }
 986         if (stcb->asoc.deleted_primary == NULL) {
 987                 return;
 988         }
 989         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 990                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 991                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 992                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 993                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 994                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 995                     stcb->asoc.deleted_primary,
 996                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
 997                 stcb->asoc.num_send_timers_up--;
 998                 if (stcb->asoc.num_send_timers_up < 0) {
 999                         stcb->asoc.num_send_timers_up = 0;
1000                 }
1001                 SCTP_TCB_LOCK_ASSERT(stcb);
1002                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1003                     stcb->asoc.deleted_primary);
1004                 if (error) {
1005                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1006                         return;
1007                 }
1008                 SCTP_TCB_LOCK_ASSERT(stcb);
1009 #ifdef SCTP_AUDITING_ENABLED
1010                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1011 #endif
1012                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1013                 if ((stcb->asoc.num_send_timers_up == 0) &&
1014                     (stcb->asoc.sent_queue_cnt > 0)) {
1015                         struct sctp_tmit_chunk *chk;
1016
1017                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1018                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1019                             stcb, chk->whoTo);
1020                 }
1021         }
1022         return;
1023 }
1024
1025 static int
1026     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1027
1028 void
1029 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1030 {
1031         struct sctp_tmit_chunk *chk;
1032
1033         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1034         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1035             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1036         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1037         net->error_count = 0;
1038         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1039                 if (chk->whoTo == net) {
1040                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1041                                 chk->sent = SCTP_DATAGRAM_RESEND;
1042                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1043                                 sctp_flight_size_decrease(chk);
1044                                 sctp_total_flight_decrease(stcb, chk);
1045                                 net->marked_retrans++;
1046                                 stcb->asoc.marked_retrans++;
1047                         }
1048                 }
1049         }
1050         if (net->marked_retrans) {
1051                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1052         }
1053 }
1054
1055 static void
1056 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1057 {
1058         struct sctp_nets *net;
1059         int addrnum, changed;
1060
1061         /*
1062          * If number of local valid addresses is 1, the valid address is
1063          * probably newly added address. Several valid addresses in this
1064          * association.  A source address may not be changed.  Additionally,
1065          * they can be configured on a same interface as "alias" addresses.
1066          * (by micchie)
1067          */
1068         addrnum = sctp_local_addr_count(stcb);
1069         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1070             addrnum);
1071         if (addrnum == 1) {
1072                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1073                         /* clear any cached route and source address */
1074                         if (net->ro.ro_rt) {
1075                                 RTFREE(net->ro.ro_rt);
1076                                 net->ro.ro_rt = NULL;
1077                         }
1078                         if (net->src_addr_selected) {
1079                                 sctp_free_ifa(net->ro._s_addr);
1080                                 net->ro._s_addr = NULL;
1081                                 net->src_addr_selected = 0;
1082                         }
1083                         /* Retransmit unacknowledged DATA chunks immediately */
1084                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1085                             SCTP_MOBILITY_FASTHANDOFF)) {
1086                                 sctp_net_immediate_retrans(stcb, net);
1087                         }
1088                         /* also, SET PRIMARY is maybe already sent */
1089                 }
1090                 return;
1091         }
1092         /* Multiple local addresses exsist in the association.  */
1093         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1094                 /* clear any cached route and source address */
1095                 if (net->ro.ro_rt) {
1096                         RTFREE(net->ro.ro_rt);
1097                         net->ro.ro_rt = NULL;
1098                 }
1099                 if (net->src_addr_selected) {
1100                         sctp_free_ifa(net->ro._s_addr);
1101                         net->ro._s_addr = NULL;
1102                         net->src_addr_selected = 0;
1103                 }
1104                 /*
1105                  * Check if the nexthop is corresponding to the new address.
1106                  * If the new address is corresponding to the current
1107                  * nexthop, the path will be changed. If the new address is
1108                  * NOT corresponding to the current nexthop, the path will
1109                  * not be changed.
1110                  */
1111                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1112                     stcb->sctp_ep->def_vrf_id,
1113                     stcb->sctp_ep->fibnum);
1114                 if (net->ro.ro_rt == NULL)
1115                         continue;
1116
1117                 changed = 0;
1118                 switch (net->ro._l_addr.sa.sa_family) {
1119 #ifdef INET
1120                 case AF_INET:
1121                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1122                                 changed = 1;
1123                         }
1124                         break;
1125 #endif
1126 #ifdef INET6
1127                 case AF_INET6:
1128                         if (sctp_v6src_match_nexthop(
1129                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1130                                 changed = 1;
1131                         }
1132                         break;
1133 #endif
1134                 default:
1135                         break;
1136                 }
1137                 /*
1138                  * if the newly added address does not relate routing
1139                  * information, we skip.
1140                  */
1141                 if (changed == 0)
1142                         continue;
1143                 /* Retransmit unacknowledged DATA chunks immediately */
1144                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1145                     SCTP_MOBILITY_FASTHANDOFF)) {
1146                         sctp_net_immediate_retrans(stcb, net);
1147                 }
1148                 /* Send SET PRIMARY for this new address */
1149                 if (net == stcb->asoc.primary_destination) {
1150                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1151                             SCTP_SET_PRIM_ADDR);
1152                 }
1153         }
1154 }
1155
1156 /*
1157  * process an ADD/DELETE IP ack from peer.
1158  * addr: corresponding sctp_ifa to the address being added/deleted.
1159  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1160  * flag: 1=success, 0=failure.
1161  */
1162 static void
1163 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1164 {
1165         /*
1166          * do the necessary asoc list work- if we get a failure indication,
1167          * leave the address on the assoc's restricted list.  If we get a
1168          * success indication, remove the address from the restricted list.
1169          */
1170         /*
1171          * Note: this will only occur for ADD_IP_ADDRESS, since
1172          * DEL_IP_ADDRESS is never actually added to the list...
1173          */
1174         if (flag) {
1175                 /* success case, so remove from the restricted list */
1176                 sctp_del_local_addr_restricted(stcb, addr);
1177
1178                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1179                     SCTP_MOBILITY_BASE) ||
1180                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1181                     SCTP_MOBILITY_FASTHANDOFF)) {
1182                         sctp_path_check_and_react(stcb, addr);
1183                         return;
1184                 }
1185                 /* clear any cached/topologically incorrect source addresses */
1186                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1187         }
1188         /* else, leave it on the list */
1189 }
1190
1191 /*
1192  * add an asconf add/delete/set primary IP address parameter to the queue.
1193  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1194  * returns 0 if queued, -1 if not queued/removed.
1195  * NOTE: if adding, but a delete for the same address is already scheduled
1196  * (and not yet sent out), simply remove it from queue.  Same for deleting
1197  * an address already scheduled for add.  If a duplicate operation is found,
1198  * ignore the new one.
1199  */
1200 static int
1201 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1202     uint16_t type)
1203 {
1204         struct sctp_asconf_addr *aa, *aa_next;
1205
1206         /* make sure the request isn't already in the queue */
1207         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1208                 /* address match? */
1209                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1210                         continue;
1211                 /*
1212                  * is the request already in queue but not sent? pass the
1213                  * request already sent in order to resolve the following
1214                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1215                  * can't remove the ADD request already sent 3. arrival of
1216                  * ADD
1217                  */
1218                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1219                         return (-1);
1220                 }
1221                 /* is the negative request already in queue, and not sent */
1222                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1223                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1224                         /* add requested, delete already queued */
1225                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1226                         /* remove the ifa from the restricted list */
1227                         sctp_del_local_addr_restricted(stcb, ifa);
1228                         /* free the asconf param */
1229                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1230                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1231                         return (-1);
1232                 }
1233                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1234                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1235                         /* delete requested, add already queued */
1236                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1237                         /* remove the aa->ifa from the restricted list */
1238                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1239                         /* free the asconf param */
1240                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1241                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1242                         return (-1);
1243                 }
1244         }                       /* for each aa */
1245
1246         /* adding new request to the queue */
1247         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1248             SCTP_M_ASC_ADDR);
1249         if (aa == NULL) {
1250                 /* didn't get memory */
1251                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1252                 return (-1);
1253         }
1254         aa->special_del = 0;
1255         /* fill in asconf address parameter fields */
1256         /* top level elements are "networked" during send */
1257         aa->ap.aph.ph.param_type = type;
1258         aa->ifa = ifa;
1259         atomic_add_int(&ifa->refcount, 1);
1260         /* correlation_id filled in during send routine later... */
1261         switch (ifa->address.sa.sa_family) {
1262 #ifdef INET6
1263         case AF_INET6:
1264                 {
1265                         struct sockaddr_in6 *sin6;
1266
1267                         sin6 = &ifa->address.sin6;
1268                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1269                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1270                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1271                             sizeof(struct sctp_ipv6addr_param);
1272                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1273                             sizeof(struct in6_addr));
1274                         break;
1275                 }
1276 #endif
1277 #ifdef INET
1278         case AF_INET:
1279                 {
1280                         struct sockaddr_in *sin;
1281
1282                         sin = &ifa->address.sin;
1283                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1284                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1285                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1286                             sizeof(struct sctp_ipv4addr_param);
1287                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1288                             sizeof(struct in_addr));
1289                         break;
1290                 }
1291 #endif
1292         default:
1293                 /* invalid family! */
1294                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1295                 sctp_free_ifa(ifa);
1296                 return (-1);
1297         }
1298         aa->sent = 0;           /* clear sent flag */
1299
1300         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1301 #ifdef SCTP_DEBUG
1302         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1303                 if (type == SCTP_ADD_IP_ADDRESS) {
1304                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1306                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1307                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1308                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1309                 } else {
1310                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1311                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1312                 }
1313         }
1314 #endif
1315
1316         return (0);
1317 }
1318
1319
1320 /*
1321  * add an asconf operation for the given ifa and type.
1322  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1323  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1324  * advisable.
1325  */
1326 static int
1327 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1328     uint16_t type)
1329 {
1330         uint32_t status;
1331         int pending_delete_queued = 0;
1332         int last;
1333
1334         /* see if peer supports ASCONF */
1335         if (stcb->asoc.asconf_supported == 0) {
1336                 return (-1);
1337         }
1338         /*
1339          * if this is deleting the last address from the assoc, mark it as
1340          * pending.
1341          */
1342         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1343                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1344                         last = (sctp_local_addr_count(stcb) == 0);
1345                 } else {
1346                         last = (sctp_local_addr_count(stcb) == 1);
1347                 }
1348                 if (last) {
1349                         /* set the pending delete info only */
1350                         stcb->asoc.asconf_del_pending = 1;
1351                         stcb->asoc.asconf_addr_del_pending = ifa;
1352                         atomic_add_int(&ifa->refcount, 1);
1353                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1354                             "asconf_queue_add: mark delete last address pending\n");
1355                         return (-1);
1356                 }
1357         }
1358         /* queue an asconf parameter */
1359         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1360
1361         /*
1362          * if this is an add, and there is a delete also pending (i.e. the
1363          * last local address is being changed), queue the pending delete
1364          * too.
1365          */
1366         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1367                 /* queue in the pending delete */
1368                 if (sctp_asconf_queue_mgmt(stcb,
1369                     stcb->asoc.asconf_addr_del_pending,
1370                     SCTP_DEL_IP_ADDRESS) == 0) {
1371                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1372                         pending_delete_queued = 1;
1373                         /* clear out the pending delete info */
1374                         stcb->asoc.asconf_del_pending = 0;
1375                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1376                         stcb->asoc.asconf_addr_del_pending = NULL;
1377                 }
1378         }
1379         if (pending_delete_queued) {
1380                 struct sctp_nets *net;
1381
1382                 /*
1383                  * since we know that the only/last address is now being
1384                  * changed in this case, reset the cwnd/rto on all nets to
1385                  * start as a new address and path.  Also clear the error
1386                  * counts to give the assoc the best chance to complete the
1387                  * address change.
1388                  */
1389                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1390                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1391                             net);
1392                         net->RTO = 0;
1393                         net->error_count = 0;
1394                 }
1395                 stcb->asoc.overall_error_count = 0;
1396                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1397                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1398                             stcb->asoc.overall_error_count,
1399                             0,
1400                             SCTP_FROM_SCTP_ASCONF,
1401                             __LINE__);
1402                 }
1403                 /* queue in an advisory set primary too */
1404                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1405                 /* let caller know we should send this out immediately */
1406                 status = 1;
1407         }
1408         return (status);
1409 }
1410
1411 /*-
1412  * add an asconf delete IP address parameter to the queue by sockaddr and
1413  * possibly with no sctp_ifa available.  This is only called by the routine
1414  * that checks the addresses in an INIT-ACK against the current address list.
1415  * returns 0 if completed, non-zero if not completed.
1416  * NOTE: if an add is already scheduled (and not yet sent out), simply
1417  * remove it from queue.  If a duplicate operation is found, ignore the
1418  * new one.
1419  */
1420 static int
1421 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1422 {
1423         struct sctp_ifa *ifa;
1424         struct sctp_asconf_addr *aa, *aa_next;
1425
1426         if (stcb == NULL) {
1427                 return (-1);
1428         }
1429         /* see if peer supports ASCONF */
1430         if (stcb->asoc.asconf_supported == 0) {
1431                 return (-1);
1432         }
1433         /* make sure the request isn't already in the queue */
1434         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1435                 /* address match? */
1436                 if (sctp_asconf_addr_match(aa, sa) == 0)
1437                         continue;
1438                 /* is the request already in queue (sent or not) */
1439                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1440                         return (-1);
1441                 }
1442                 /* is the negative request already in queue, and not sent */
1443                 if (aa->sent == 1)
1444                         continue;
1445                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1446                         /* add already queued, so remove existing entry */
1447                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1448                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1449                         /* free the entry */
1450                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1451                         return (-1);
1452                 }
1453         }                       /* for each aa */
1454
1455         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1456         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1457
1458         /* adding new request to the queue */
1459         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1460             SCTP_M_ASC_ADDR);
1461         if (aa == NULL) {
1462                 /* didn't get memory */
1463                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1464                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1465                 return (-1);
1466         }
1467         aa->special_del = 0;
1468         /* fill in asconf address parameter fields */
1469         /* top level elements are "networked" during send */
1470         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1471         aa->ifa = ifa;
1472         if (ifa)
1473                 atomic_add_int(&ifa->refcount, 1);
1474         /* correlation_id filled in during send routine later... */
1475         switch (sa->sa_family) {
1476 #ifdef INET6
1477         case AF_INET6:
1478                 {
1479                         /* IPv6 address */
1480                         struct sockaddr_in6 *sin6;
1481
1482                         sin6 = (struct sockaddr_in6 *)sa;
1483                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1484                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1485                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1486                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1487                             sizeof(struct in6_addr));
1488                         break;
1489                 }
1490 #endif
1491 #ifdef INET
1492         case AF_INET:
1493                 {
1494                         /* IPv4 address */
1495                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1496
1497                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1498                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1499                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1500                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1501                             sizeof(struct in_addr));
1502                         break;
1503                 }
1504 #endif
1505         default:
1506                 /* invalid family! */
1507                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1508                 if (ifa)
1509                         sctp_free_ifa(ifa);
1510                 return (-1);
1511         }
1512         aa->sent = 0;           /* clear sent flag */
1513
1514         /* delete goes to the back of the queue */
1515         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1516
1517         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1518         return (0);
1519 }
1520
1521 /*
1522  * find a specific asconf param on our "sent" queue
1523  */
1524 static struct sctp_asconf_addr *
1525 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1526 {
1527         struct sctp_asconf_addr *aa;
1528
1529         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1530                 if (aa->ap.aph.correlation_id == correlation_id &&
1531                     aa->sent == 1) {
1532                         /* found it */
1533                         return (aa);
1534                 }
1535         }
1536         /* didn't find it */
1537         return (NULL);
1538 }
1539
1540 /*
1541  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1542  * notifications based on the error response
1543  */
1544 static void
1545 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1546     struct sctp_asconf_paramhdr *aph)
1547 {
1548         struct sctp_error_cause *eh;
1549         struct sctp_paramhdr *ph;
1550         uint16_t param_type;
1551         uint16_t error_code;
1552
1553         eh = (struct sctp_error_cause *)(aph + 1);
1554         ph = (struct sctp_paramhdr *)(eh + 1);
1555         /* validate lengths */
1556         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1557             htons(aph->ph.param_length)) {
1558                 /* invalid error cause length */
1559                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1560                     "asconf_process_error: cause element too long\n");
1561                 return;
1562         }
1563         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1564             htons(eh->length)) {
1565                 /* invalid included TLV length */
1566                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1567                     "asconf_process_error: included TLV too long\n");
1568                 return;
1569         }
1570         /* which error code ? */
1571         error_code = ntohs(eh->code);
1572         param_type = ntohs(aph->ph.param_type);
1573         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1574         switch (error_code) {
1575         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1576                 /* we allow ourselves to "try again" for this error */
1577                 break;
1578         default:
1579                 /* peer can't handle it... */
1580                 switch (param_type) {
1581                 case SCTP_ADD_IP_ADDRESS:
1582                 case SCTP_DEL_IP_ADDRESS:
1583                 case SCTP_SET_PRIM_ADDR:
1584                         break;
1585                 default:
1586                         break;
1587                 }
1588         }
1589 }
1590
1591 /*
1592  * process an asconf queue param.
1593  * aparam: parameter to process, will be removed from the queue.
1594  * flag: 1=success case, 0=failure case
1595  */
1596 static void
1597 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1598     struct sctp_asconf_addr *aparam, uint32_t flag)
1599 {
1600         uint16_t param_type;
1601
1602         /* process this param */
1603         param_type = aparam->ap.aph.ph.param_type;
1604         switch (param_type) {
1605         case SCTP_ADD_IP_ADDRESS:
1606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1607                     "process_param_ack: added IP address\n");
1608                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1609                 break;
1610         case SCTP_DEL_IP_ADDRESS:
1611                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1612                     "process_param_ack: deleted IP address\n");
1613                 /* nothing really to do... lists already updated */
1614                 break;
1615         case SCTP_SET_PRIM_ADDR:
1616                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1617                     "process_param_ack: set primary IP address\n");
1618                 /* nothing to do... peer may start using this addr */
1619                 break;
1620         default:
1621                 /* should NEVER happen */
1622                 break;
1623         }
1624
1625         /* remove the param and free it */
1626         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1627         if (aparam->ifa)
1628                 sctp_free_ifa(aparam->ifa);
1629         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1630 }
1631
1632 /*
1633  * cleanup from a bad asconf ack parameter
1634  */
1635 static void
1636 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1637 {
1638         /* assume peer doesn't really know how to do asconfs */
1639         /* XXX we could free the pending queue here */
1640
1641 }
1642
1643 void
1644 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1645     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1646     struct sctp_nets *net, int *abort_no_unlock)
1647 {
1648         struct sctp_association *asoc;
1649         uint32_t serial_num;
1650         uint16_t ack_length;
1651         struct sctp_asconf_paramhdr *aph;
1652         struct sctp_asconf_addr *aa, *aa_next;
1653         uint32_t last_error_id = 0;     /* last error correlation id */
1654         uint32_t id;
1655         struct sctp_asconf_addr *ap;
1656
1657         /* asconf param buffer */
1658         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1659
1660         /* verify minimum length */
1661         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1662                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1663                     "handle_asconf_ack: chunk too small = %xh\n",
1664                     ntohs(cp->ch.chunk_length));
1665                 return;
1666         }
1667         asoc = &stcb->asoc;
1668         serial_num = ntohl(cp->serial_number);
1669
1670         /*
1671          * NOTE: we may want to handle this differently- currently, we will
1672          * abort when we get an ack for the expected serial number + 1 (eg.
1673          * we didn't send it), process an ack normally if it is the expected
1674          * serial number, and re-send the previous ack for *ALL* other
1675          * serial numbers
1676          */
1677
1678         /*
1679          * if the serial number is the next expected, but I didn't send it,
1680          * abort the asoc, since someone probably just hijacked us...
1681          */
1682         if (serial_num == (asoc->asconf_seq_out + 1)) {
1683                 struct mbuf *op_err;
1684                 char msg[SCTP_DIAG_INFO_LEN];
1685
1686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1687                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1688                     serial_num);
1689                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1690                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1691                 *abort_no_unlock = 1;
1692                 return;
1693         }
1694         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1695                 /* got a duplicate/unexpected ASCONF-ACK */
1696                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1697                     serial_num, asoc->asconf_seq_out_acked + 1);
1698                 return;
1699         }
1700         if (serial_num == asoc->asconf_seq_out - 1) {
1701                 /* stop our timer */
1702                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1703                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1704         }
1705         /* process the ASCONF-ACK contents */
1706         ack_length = ntohs(cp->ch.chunk_length) -
1707             sizeof(struct sctp_asconf_ack_chunk);
1708         offset += sizeof(struct sctp_asconf_ack_chunk);
1709         /* process through all parameters */
1710         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1711                 unsigned int param_length, param_type;
1712
1713                 /* get pointer to next asconf parameter */
1714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1715                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1716                 if (aph == NULL) {
1717                         /* can't get an asconf paramhdr */
1718                         sctp_asconf_ack_clear(stcb);
1719                         return;
1720                 }
1721                 param_type = ntohs(aph->ph.param_type);
1722                 param_length = ntohs(aph->ph.param_length);
1723                 if (param_length > ack_length) {
1724                         sctp_asconf_ack_clear(stcb);
1725                         return;
1726                 }
1727                 if (param_length < sizeof(struct sctp_paramhdr)) {
1728                         sctp_asconf_ack_clear(stcb);
1729                         return;
1730                 }
1731                 /* get the complete parameter... */
1732                 if (param_length > sizeof(aparam_buf)) {
1733                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1734                             "param length (%u) larger than buffer size!\n", param_length);
1735                         sctp_asconf_ack_clear(stcb);
1736                         return;
1737                 }
1738                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1739                 if (aph == NULL) {
1740                         sctp_asconf_ack_clear(stcb);
1741                         return;
1742                 }
1743                 /* correlation_id is transparent to peer, no ntohl needed */
1744                 id = aph->correlation_id;
1745
1746                 switch (param_type) {
1747                 case SCTP_ERROR_CAUSE_IND:
1748                         last_error_id = id;
1749                         /* find the corresponding asconf param in our queue */
1750                         ap = sctp_asconf_find_param(stcb, id);
1751                         if (ap == NULL) {
1752                                 /* hmm... can't find this in our queue! */
1753                                 break;
1754                         }
1755                         /* process the parameter, failed flag */
1756                         sctp_asconf_process_param_ack(stcb, ap, 0);
1757                         /* process the error response */
1758                         sctp_asconf_process_error(stcb, aph);
1759                         break;
1760                 case SCTP_SUCCESS_REPORT:
1761                         /* find the corresponding asconf param in our queue */
1762                         ap = sctp_asconf_find_param(stcb, id);
1763                         if (ap == NULL) {
1764                                 /* hmm... can't find this in our queue! */
1765                                 break;
1766                         }
1767                         /* process the parameter, success flag */
1768                         sctp_asconf_process_param_ack(stcb, ap, 1);
1769                         break;
1770                 default:
1771                         break;
1772                 }               /* switch */
1773
1774                 /* update remaining ASCONF-ACK message length to process */
1775                 ack_length -= SCTP_SIZE32(param_length);
1776                 if (ack_length <= 0) {
1777                         /* no more data in the mbuf chain */
1778                         break;
1779                 }
1780                 offset += SCTP_SIZE32(param_length);
1781         }                       /* while */
1782
1783         /*
1784          * if there are any "sent" params still on the queue, these are
1785          * implicitly "success", or "failed" (if we got an error back) ...
1786          * so process these appropriately
1787          *
1788          * we assume that the correlation_id's are monotonically increasing
1789          * beginning from 1 and that we don't have *that* many outstanding
1790          * at any given time
1791          */
1792         if (last_error_id == 0)
1793                 last_error_id--;/* set to "max" value */
1794         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1795                 if (aa->sent == 1) {
1796                         /*
1797                          * implicitly successful or failed if correlation_id
1798                          * < last_error_id, then success else, failure
1799                          */
1800                         if (aa->ap.aph.correlation_id < last_error_id)
1801                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1802                         else
1803                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1804                 } else {
1805                         /*
1806                          * since we always process in order (FIFO queue) if
1807                          * we reach one that hasn't been sent, the rest
1808                          * should not have been sent either. so, we're
1809                          * done...
1810                          */
1811                         break;
1812                 }
1813         }
1814
1815         /* update the next sequence number to use */
1816         asoc->asconf_seq_out_acked++;
1817         /* remove the old ASCONF on our outbound queue */
1818         sctp_toss_old_asconf(stcb);
1819         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1820 #ifdef SCTP_TIMER_BASED_ASCONF
1821                 /* we have more params, so restart our timer */
1822                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1823                     stcb, net);
1824 #else
1825                 /* we have more params, so send out more */
1826                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1827 #endif
1828         }
1829 }
1830
1831 #ifdef INET6
1832 static uint32_t
1833 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1834 {
1835         struct sockaddr_in6 *sin6, *net6;
1836         struct sctp_nets *net;
1837
1838         if (sa->sa_family != AF_INET6) {
1839                 /* wrong family */
1840                 return (0);
1841         }
1842         sin6 = (struct sockaddr_in6 *)sa;
1843         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1844                 /* not link local address */
1845                 return (0);
1846         }
1847         /* hunt through our destination nets list for this scope_id */
1848         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1849                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1850                     AF_INET6)
1851                         continue;
1852                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1853                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1854                         continue;
1855                 if (sctp_is_same_scope(sin6, net6)) {
1856                         /* found one */
1857                         return (1);
1858                 }
1859         }
1860         /* didn't find one */
1861         return (0);
1862 }
1863
1864 #endif
1865
1866 /*
1867  * address management functions
1868  */
1869 static void
1870 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1871     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1872 {
1873         int status;
1874
1875         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1876             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1877                 /* subset bound, no ASCONF allowed case, so ignore */
1878                 return;
1879         }
1880         /*
1881          * note: we know this is not the subset bound, no ASCONF case eg.
1882          * this is boundall or subset bound w/ASCONF allowed
1883          */
1884
1885         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1886         switch (ifa->address.sa.sa_family) {
1887 #ifdef INET6
1888         case AF_INET6:
1889                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1890                     &ifa->address.sin6.sin6_addr) != 0) {
1891                         return;
1892                 }
1893                 break;
1894 #endif
1895 #ifdef INET
1896         case AF_INET:
1897                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1898                     &ifa->address.sin.sin_addr) != 0) {
1899                         return;
1900                 }
1901                 break;
1902 #endif
1903         default:
1904                 return;
1905         }
1906 #ifdef INET6
1907         /* make sure we're "allowed" to add this type of addr */
1908         if (ifa->address.sa.sa_family == AF_INET6) {
1909                 /* invalid if we're not a v6 endpoint */
1910                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1911                         return;
1912                 /* is the v6 addr really valid ? */
1913                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1914                         return;
1915                 }
1916         }
1917 #endif
1918         /* put this address on the "pending/do not use yet" list */
1919         sctp_add_local_addr_restricted(stcb, ifa);
1920         /*
1921          * check address scope if address is out of scope, don't queue
1922          * anything... note: this would leave the address on both inp and
1923          * asoc lists
1924          */
1925         switch (ifa->address.sa.sa_family) {
1926 #ifdef INET6
1927         case AF_INET6:
1928                 {
1929                         struct sockaddr_in6 *sin6;
1930
1931                         sin6 = &ifa->address.sin6;
1932                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1933                                 /* we skip unspecifed addresses */
1934                                 return;
1935                         }
1936                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1937                                 if (stcb->asoc.scope.local_scope == 0) {
1938                                         return;
1939                                 }
1940                                 /* is it the right link local scope? */
1941                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1942                                         return;
1943                                 }
1944                         }
1945                         if (stcb->asoc.scope.site_scope == 0 &&
1946                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1947                                 return;
1948                         }
1949                         break;
1950                 }
1951 #endif
1952 #ifdef INET
1953         case AF_INET:
1954                 {
1955                         struct sockaddr_in *sin;
1956                         struct in6pcb *inp6;
1957
1958                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1959                         /* invalid if we are a v6 only endpoint */
1960                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1961                             SCTP_IPV6_V6ONLY(inp6))
1962                                 return;
1963
1964                         sin = &ifa->address.sin;
1965                         if (sin->sin_addr.s_addr == 0) {
1966                                 /* we skip unspecifed addresses */
1967                                 return;
1968                         }
1969                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1970                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1971                                 return;
1972                         }
1973                         break;
1974                 }
1975 #endif
1976         default:
1977                 /* else, not AF_INET or AF_INET6, so skip */
1978                 return;
1979         }
1980
1981         /* queue an asconf for this address add/delete */
1982         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1983                 /* does the peer do asconf? */
1984                 if (stcb->asoc.asconf_supported) {
1985                         /* queue an asconf for this addr */
1986                         status = sctp_asconf_queue_add(stcb, ifa, type);
1987
1988                         /*
1989                          * if queued ok, and in the open state, send out the
1990                          * ASCONF.  If in the non-open state, these will be
1991                          * sent when the state goes open.
1992                          */
1993                         if (status == 0 &&
1994                             ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
1995                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1996 #ifdef SCTP_TIMER_BASED_ASCONF
1997                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1998                                     stcb, stcb->asoc.primary_destination);
1999 #else
2000                                 sctp_send_asconf(stcb, NULL, addr_locked);
2001 #endif
2002                         }
2003                 }
2004         }
2005 }
2006
2007
2008 int
2009 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2010 {
2011         struct sctp_asconf_iterator *asc;
2012         struct sctp_ifa *ifa;
2013         struct sctp_laddr *l;
2014         int cnt_invalid = 0;
2015
2016         asc = (struct sctp_asconf_iterator *)ptr;
2017         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2018                 ifa = l->ifa;
2019                 switch (ifa->address.sa.sa_family) {
2020 #ifdef INET6
2021                 case AF_INET6:
2022                         /* invalid if we're not a v6 endpoint */
2023                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2024                                 cnt_invalid++;
2025                                 if (asc->cnt == cnt_invalid)
2026                                         return (1);
2027                         }
2028                         break;
2029 #endif
2030 #ifdef INET
2031                 case AF_INET:
2032                         {
2033                                 /* invalid if we are a v6 only endpoint */
2034                                 struct in6pcb *inp6;
2035
2036                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2037                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2038                                     SCTP_IPV6_V6ONLY(inp6)) {
2039                                         cnt_invalid++;
2040                                         if (asc->cnt == cnt_invalid)
2041                                                 return (1);
2042                                 }
2043                                 break;
2044                         }
2045 #endif
2046                 default:
2047                         /* invalid address family */
2048                         cnt_invalid++;
2049                         if (asc->cnt == cnt_invalid)
2050                                 return (1);
2051                 }
2052         }
2053         return (0);
2054 }
2055
2056 static int
2057 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2058 {
2059         struct sctp_ifa *ifa;
2060         struct sctp_asconf_iterator *asc;
2061         struct sctp_laddr *laddr, *nladdr, *l;
2062
2063         /* Only for specific case not bound all */
2064         asc = (struct sctp_asconf_iterator *)ptr;
2065         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2066                 ifa = l->ifa;
2067                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2068                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2069                             sctp_nxt_addr) {
2070                                 if (laddr->ifa == ifa) {
2071                                         laddr->action = 0;
2072                                         break;
2073                                 }
2074                         }
2075                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2076                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2077                                 /* remove only after all guys are done */
2078                                 if (laddr->ifa == ifa) {
2079                                         sctp_del_local_addr_ep(inp, ifa);
2080                                 }
2081                         }
2082                 }
2083         }
2084         return (0);
2085 }
2086
2087 void
2088 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2089     void *ptr, uint32_t val SCTP_UNUSED)
2090 {
2091         struct sctp_asconf_iterator *asc;
2092         struct sctp_ifa *ifa;
2093         struct sctp_laddr *l;
2094         int cnt_invalid = 0;
2095         int type, status;
2096         int num_queued = 0;
2097
2098         asc = (struct sctp_asconf_iterator *)ptr;
2099         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2100                 ifa = l->ifa;
2101                 type = l->action;
2102
2103                 /* address's vrf_id must be the vrf_id of the assoc */
2104                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2105                         continue;
2106                 }
2107                 /* Same checks again for assoc */
2108                 switch (ifa->address.sa.sa_family) {
2109 #ifdef INET6
2110                 case AF_INET6:
2111                         {
2112                                 /* invalid if we're not a v6 endpoint */
2113                                 struct sockaddr_in6 *sin6;
2114
2115                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2116                                         cnt_invalid++;
2117                                         if (asc->cnt == cnt_invalid)
2118                                                 return;
2119                                         else
2120                                                 continue;
2121                                 }
2122                                 sin6 = &ifa->address.sin6;
2123                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2124                                         /* we skip unspecifed addresses */
2125                                         continue;
2126                                 }
2127                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2128                                     &sin6->sin6_addr) != 0) {
2129                                         continue;
2130                                 }
2131                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2132                                         if (stcb->asoc.scope.local_scope == 0) {
2133                                                 continue;
2134                                         }
2135                                         /* is it the right link local scope? */
2136                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2137                                                 continue;
2138                                         }
2139                                 }
2140                                 break;
2141                         }
2142 #endif
2143 #ifdef INET
2144                 case AF_INET:
2145                         {
2146                                 /* invalid if we are a v6 only endpoint */
2147                                 struct in6pcb *inp6;
2148                                 struct sockaddr_in *sin;
2149
2150                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2151                                 /* invalid if we are a v6 only endpoint */
2152                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2153                                     SCTP_IPV6_V6ONLY(inp6))
2154                                         continue;
2155
2156                                 sin = &ifa->address.sin;
2157                                 if (sin->sin_addr.s_addr == 0) {
2158                                         /* we skip unspecifed addresses */
2159                                         continue;
2160                                 }
2161                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2162                                     &sin->sin_addr) != 0) {
2163                                         continue;
2164                                 }
2165                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2166                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2167                                         continue;
2168                                 }
2169                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2170                                     SCTP_IPV6_V6ONLY(inp6)) {
2171                                         cnt_invalid++;
2172                                         if (asc->cnt == cnt_invalid)
2173                                                 return;
2174                                         else
2175                                                 continue;
2176                                 }
2177                                 break;
2178                         }
2179 #endif
2180                 default:
2181                         /* invalid address family */
2182                         cnt_invalid++;
2183                         if (asc->cnt == cnt_invalid)
2184                                 return;
2185                         else
2186                                 continue;
2187                         break;
2188                 }
2189
2190                 if (type == SCTP_ADD_IP_ADDRESS) {
2191                         /* prevent this address from being used as a source */
2192                         sctp_add_local_addr_restricted(stcb, ifa);
2193                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2194                         struct sctp_nets *net;
2195
2196                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2197                                 sctp_rtentry_t *rt;
2198
2199                                 /* delete this address if cached */
2200                                 if (net->ro._s_addr == ifa) {
2201                                         sctp_free_ifa(net->ro._s_addr);
2202                                         net->ro._s_addr = NULL;
2203                                         net->src_addr_selected = 0;
2204                                         rt = net->ro.ro_rt;
2205                                         if (rt) {
2206                                                 RTFREE(rt);
2207                                                 net->ro.ro_rt = NULL;
2208                                         }
2209                                         /*
2210                                          * Now we deleted our src address,
2211                                          * should we not also now reset the
2212                                          * cwnd/rto to start as if its a new
2213                                          * address?
2214                                          */
2215                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2216                                         net->RTO = 0;
2217
2218                                 }
2219                         }
2220                 } else if (type == SCTP_SET_PRIM_ADDR) {
2221                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2222                                 /* must validate the ifa is in the ep */
2223                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2224                                         continue;
2225                                 }
2226                         } else {
2227                                 /* Need to check scopes for this guy */
2228                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2229                                         continue;
2230                                 }
2231                         }
2232                 }
2233                 /* queue an asconf for this address add/delete */
2234                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2235                     stcb->asoc.asconf_supported == 1) {
2236                         /* queue an asconf for this addr */
2237                         status = sctp_asconf_queue_add(stcb, ifa, type);
2238                         /*
2239                          * if queued ok, and in the open state, update the
2240                          * count of queued params.  If in the non-open
2241                          * state, these get sent when the assoc goes open.
2242                          */
2243                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2244                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2245                                 if (status >= 0) {
2246                                         num_queued++;
2247                                 }
2248                         }
2249                 }
2250         }
2251         /*
2252          * If we have queued params in the open state, send out an ASCONF.
2253          */
2254         if (num_queued > 0) {
2255                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2256         }
2257 }
2258
2259 void
2260 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2261 {
2262         struct sctp_asconf_iterator *asc;
2263         struct sctp_ifa *ifa;
2264         struct sctp_laddr *l, *nl;
2265
2266         asc = (struct sctp_asconf_iterator *)ptr;
2267         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2268                 ifa = l->ifa;
2269                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2270                         /* Clear the defer use flag */
2271                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2272                 }
2273                 sctp_free_ifa(ifa);
2274                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2275                 SCTP_DECR_LADDR_COUNT();
2276         }
2277         SCTP_FREE(asc, SCTP_M_ASC_IT);
2278 }
2279
2280 /*
2281  * sa is the sockaddr to ask the peer to set primary to.
2282  * returns: 0 = completed, -1 = error
2283  */
2284 int32_t
2285 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2286 {
2287         uint32_t vrf_id;
2288         struct sctp_ifa *ifa;
2289
2290         /* find the ifa for the desired set primary */
2291         vrf_id = stcb->asoc.vrf_id;
2292         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2293         if (ifa == NULL) {
2294                 /* Invalid address */
2295                 return (-1);
2296         }
2297         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2298         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2299                 /* set primary queuing succeeded */
2300                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2301                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2302                     (void *)stcb);
2303                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2304                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2305                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2306 #ifdef SCTP_TIMER_BASED_ASCONF
2307                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2308                             stcb->sctp_ep, stcb,
2309                             stcb->asoc.primary_destination);
2310 #else
2311                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2312 #endif
2313                 }
2314         } else {
2315                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2316                     (void *)stcb);
2317                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2318                 return (-1);
2319         }
2320         return (0);
2321 }
2322
2323 void
2324 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2325 {
2326         struct sctp_inpcb *inp;
2327
2328         /* go through all our PCB's */
2329         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2330                 struct sctp_tcb *stcb;
2331
2332                 /* process for all associations for this endpoint */
2333                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2334                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2335                         if (!sctp_asconf_queue_add(stcb, ifa,
2336                             SCTP_SET_PRIM_ADDR)) {
2337                                 /* set primary queuing succeeded */
2338                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2339                                     (void *)stcb);
2340                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2341                                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2342                                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2343 #ifdef SCTP_TIMER_BASED_ASCONF
2344                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2345                                             stcb->sctp_ep, stcb,
2346                                             stcb->asoc.primary_destination);
2347 #else
2348                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2349 #endif
2350                                 }
2351                         }
2352                 }               /* for each stcb */
2353         }                       /* for each inp */
2354 }
2355
2356 int
2357 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2358 {
2359         struct sctp_tmit_chunk *chk, *nchk;
2360         unsigned int offset, asconf_limit;
2361         struct sctp_asconf_chunk *acp;
2362         struct sctp_asconf_paramhdr *aph;
2363         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2364         struct sctp_paramhdr *ph;
2365         int add_cnt, del_cnt;
2366         uint16_t last_param_type;
2367
2368         add_cnt = del_cnt = 0;
2369         last_param_type = 0;
2370         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2371                 if (chk->data == NULL) {
2372                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2373                         continue;
2374                 }
2375                 offset = 0;
2376                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2377                 offset += sizeof(struct sctp_asconf_chunk);
2378                 asconf_limit = ntohs(acp->ch.chunk_length);
2379                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2380                 if (ph == NULL) {
2381                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2382                         continue;
2383                 }
2384                 offset += ntohs(ph->param_length);
2385
2386                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2387                 if (aph == NULL) {
2388                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2389                         continue;
2390                 }
2391                 while (aph != NULL) {
2392                         unsigned int param_length, param_type;
2393
2394                         param_type = ntohs(aph->ph.param_type);
2395                         param_length = ntohs(aph->ph.param_length);
2396                         if (offset + param_length > asconf_limit) {
2397                                 /* parameter goes beyond end of chunk! */
2398                                 break;
2399                         }
2400                         if (param_length > sizeof(aparam_buf)) {
2401                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2402                                 break;
2403                         }
2404                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2405                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2406                                 break;
2407                         }
2408                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2409                         if (aph == NULL) {
2410                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2411                                 break;
2412                         }
2413                         ph = (struct sctp_paramhdr *)(aph + 1);
2414                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2415                                 switch (param_type) {
2416                                 case SCTP_ADD_IP_ADDRESS:
2417                                         add_cnt++;
2418                                         break;
2419                                 case SCTP_DEL_IP_ADDRESS:
2420                                         del_cnt++;
2421                                         break;
2422                                 default:
2423                                         break;
2424                                 }
2425                                 last_param_type = param_type;
2426                         }
2427                         offset += SCTP_SIZE32(param_length);
2428                         if (offset >= asconf_limit) {
2429                                 /* no more data in the mbuf chain */
2430                                 break;
2431                         }
2432                         /* get pointer to next asconf param */
2433                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2434                 }
2435         }
2436
2437         /*
2438          * we want to find the sequences which consist of ADD -> DEL -> ADD
2439          * or DEL -> ADD
2440          */
2441         if (add_cnt > del_cnt ||
2442             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2443                 return (1);
2444         }
2445         return (0);
2446 }
2447
2448 static struct sockaddr *
2449 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2450 {
2451         struct sctp_vrf *vrf = NULL;
2452         struct sctp_ifn *sctp_ifn;
2453         struct sctp_ifa *sctp_ifa;
2454
2455         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2456                 SCTP_IPI_ADDR_RLOCK();
2457         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2458         if (vrf == NULL) {
2459                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2460                         SCTP_IPI_ADDR_RUNLOCK();
2461                 return (NULL);
2462         }
2463         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2464                 if (stcb->asoc.scope.loopback_scope == 0 &&
2465                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2466                         /* Skip if loopback_scope not set */
2467                         continue;
2468                 }
2469                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2470                         switch (sctp_ifa->address.sa.sa_family) {
2471 #ifdef INET
2472                         case AF_INET:
2473                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2474                                         struct sockaddr_in *sin;
2475
2476                                         sin = &sctp_ifa->address.sin;
2477                                         if (sin->sin_addr.s_addr == 0) {
2478                                                 /* skip unspecifed addresses */
2479                                                 continue;
2480                                         }
2481                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2482                                             &sin->sin_addr) != 0) {
2483                                                 continue;
2484                                         }
2485                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2486                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2487                                                 continue;
2488
2489                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2490                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2491                                                 continue;
2492                                         /*
2493                                          * found a valid local v4 address to
2494                                          * use
2495                                          */
2496                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2497                                                 SCTP_IPI_ADDR_RUNLOCK();
2498                                         return (&sctp_ifa->address.sa);
2499                                 }
2500                                 break;
2501 #endif
2502 #ifdef INET6
2503                         case AF_INET6:
2504                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2505                                         struct sockaddr_in6 *sin6;
2506
2507                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2508                                                 continue;
2509                                         }
2510                                         sin6 = &sctp_ifa->address.sin6;
2511                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2512                                                 /*
2513                                                  * we skip unspecifed
2514                                                  * addresses
2515                                                  */
2516                                                 continue;
2517                                         }
2518                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2519                                             &sin6->sin6_addr) != 0) {
2520                                                 continue;
2521                                         }
2522                                         if (stcb->asoc.scope.local_scope == 0 &&
2523                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2524                                                 continue;
2525                                         if (stcb->asoc.scope.site_scope == 0 &&
2526                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2527                                                 continue;
2528
2529                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2530                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2531                                                 continue;
2532                                         /*
2533                                          * found a valid local v6 address to
2534                                          * use
2535                                          */
2536                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2537                                                 SCTP_IPI_ADDR_RUNLOCK();
2538                                         return (&sctp_ifa->address.sa);
2539                                 }
2540                                 break;
2541 #endif
2542                         default:
2543                                 break;
2544                         }
2545                 }
2546         }
2547         /* no valid addresses found */
2548         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2549                 SCTP_IPI_ADDR_RUNLOCK();
2550         return (NULL);
2551 }
2552
2553 static struct sockaddr *
2554 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2555 {
2556         struct sctp_laddr *laddr;
2557
2558         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2559                 if (laddr->ifa == NULL) {
2560                         continue;
2561                 }
2562                 /* is the address restricted ? */
2563                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2564                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2565                         continue;
2566
2567                 /* found a valid local address to use */
2568                 return (&laddr->ifa->address.sa);
2569         }
2570         /* no valid addresses found */
2571         return (NULL);
2572 }
2573
2574 /*
2575  * builds an ASCONF chunk from queued ASCONF params.
2576  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2577  */
2578 struct mbuf *
2579 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2580 {
2581         struct mbuf *m_asconf, *m_asconf_chk;
2582         struct sctp_asconf_addr *aa;
2583         struct sctp_asconf_chunk *acp;
2584         struct sctp_asconf_paramhdr *aph;
2585         struct sctp_asconf_addr_param *aap;
2586         uint32_t p_length;
2587         uint32_t correlation_id = 1;    /* 0 is reserved... */
2588         caddr_t ptr, lookup_ptr;
2589         uint8_t lookup_used = 0;
2590
2591         /* are there any asconf params to send? */
2592         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2593                 if (aa->sent == 0)
2594                         break;
2595         }
2596         if (aa == NULL)
2597                 return (NULL);
2598
2599         /*
2600          * get a chunk header mbuf and a cluster for the asconf params since
2601          * it's simpler to fill in the asconf chunk header lookup address on
2602          * the fly
2603          */
2604         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2605         if (m_asconf_chk == NULL) {
2606                 /* no mbuf's */
2607                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2608                     "compose_asconf: couldn't get chunk mbuf!\n");
2609                 return (NULL);
2610         }
2611         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2612         if (m_asconf == NULL) {
2613                 /* no mbuf's */
2614                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2615                     "compose_asconf: couldn't get mbuf!\n");
2616                 sctp_m_freem(m_asconf_chk);
2617                 return (NULL);
2618         }
2619         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2620         SCTP_BUF_LEN(m_asconf) = 0;
2621         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2622         bzero(acp, sizeof(struct sctp_asconf_chunk));
2623         /* save pointers to lookup address and asconf params */
2624         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2625         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2626
2627         /* fill in chunk header info */
2628         acp->ch.chunk_type = SCTP_ASCONF;
2629         acp->ch.chunk_flags = 0;
2630         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2631         stcb->asoc.asconf_seq_out++;
2632
2633         /* add parameters... up to smallest MTU allowed */
2634         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2635                 if (aa->sent)
2636                         continue;
2637                 /* get the parameter length */
2638                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2639                 /* will it fit in current chunk? */
2640                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2641                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2642                         /* won't fit, so we're done with this chunk */
2643                         break;
2644                 }
2645                 /* assign (and store) a correlation id */
2646                 aa->ap.aph.correlation_id = correlation_id++;
2647
2648                 /*
2649                  * fill in address if we're doing a delete this is a simple
2650                  * way for us to fill in the correlation address, which
2651                  * should only be used by the peer if we're deleting our
2652                  * source address and adding a new address (e.g. renumbering
2653                  * case)
2654                  */
2655                 if (lookup_used == 0 &&
2656                     (aa->special_del == 0) &&
2657                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2658                         struct sctp_ipv6addr_param *lookup;
2659                         uint16_t p_size, addr_size;
2660
2661                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2662                         lookup->ph.param_type =
2663                             htons(aa->ap.addrp.ph.param_type);
2664                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2665                                 /* copy IPv6 address */
2666                                 p_size = sizeof(struct sctp_ipv6addr_param);
2667                                 addr_size = sizeof(struct in6_addr);
2668                         } else {
2669                                 /* copy IPv4 address */
2670                                 p_size = sizeof(struct sctp_ipv4addr_param);
2671                                 addr_size = sizeof(struct in_addr);
2672                         }
2673                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2674                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2675                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2676                         lookup_used = 1;
2677                 }
2678                 /* copy into current space */
2679                 memcpy(ptr, &aa->ap, p_length);
2680
2681                 /* network elements and update lengths */
2682                 aph = (struct sctp_asconf_paramhdr *)ptr;
2683                 aap = (struct sctp_asconf_addr_param *)ptr;
2684                 /* correlation_id is transparent to peer, no htonl needed */
2685                 aph->ph.param_type = htons(aph->ph.param_type);
2686                 aph->ph.param_length = htons(aph->ph.param_length);
2687                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2688                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2689
2690                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2691                 ptr += SCTP_SIZE32(p_length);
2692
2693                 /*
2694                  * these params are removed off the pending list upon
2695                  * getting an ASCONF-ACK back from the peer, just set flag
2696                  */
2697                 aa->sent = 1;
2698         }
2699         /* check to see if the lookup addr has been populated yet */
2700         if (lookup_used == 0) {
2701                 /* NOTE: if the address param is optional, can skip this... */
2702                 /* add any valid (existing) address... */
2703                 struct sctp_ipv6addr_param *lookup;
2704                 uint16_t p_size, addr_size;
2705                 struct sockaddr *found_addr;
2706                 caddr_t addr_ptr;
2707
2708                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2709                         found_addr = sctp_find_valid_localaddr(stcb,
2710                             addr_locked);
2711                 else
2712                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2713
2714                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2715                 if (found_addr != NULL) {
2716                         switch (found_addr->sa_family) {
2717 #ifdef INET6
2718                         case AF_INET6:
2719                                 /* copy IPv6 address */
2720                                 lookup->ph.param_type =
2721                                     htons(SCTP_IPV6_ADDRESS);
2722                                 p_size = sizeof(struct sctp_ipv6addr_param);
2723                                 addr_size = sizeof(struct in6_addr);
2724                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2725                                     found_addr)->sin6_addr;
2726                                 break;
2727 #endif
2728 #ifdef INET
2729                         case AF_INET:
2730                                 /* copy IPv4 address */
2731                                 lookup->ph.param_type =
2732                                     htons(SCTP_IPV4_ADDRESS);
2733                                 p_size = sizeof(struct sctp_ipv4addr_param);
2734                                 addr_size = sizeof(struct in_addr);
2735                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2736                                     found_addr)->sin_addr;
2737                                 break;
2738 #endif
2739                         default:
2740                                 p_size = 0;
2741                                 addr_size = 0;
2742                                 addr_ptr = NULL;
2743                                 break;
2744                         }
2745                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2746                         memcpy(lookup->addr, addr_ptr, addr_size);
2747                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2748                 } else {
2749                         /* uh oh... don't have any address?? */
2750                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2751                             "compose_asconf: no lookup addr!\n");
2752                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2753                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2754                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2755                         bzero(lookup->addr, sizeof(struct in_addr));
2756                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2757                 }
2758         }
2759         /* chain it all together */
2760         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2761         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2762         acp->ch.chunk_length = htons(*retlen);
2763
2764         return (m_asconf_chk);
2765 }
2766
2767 /*
2768  * section to handle address changes before an association is up eg. changes
2769  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2770  */
2771
2772 /*
2773  * processes the (local) addresses in the INIT-ACK chunk
2774  */
2775 static void
2776 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2777     unsigned int offset, unsigned int length)
2778 {
2779         struct sctp_paramhdr tmp_param, *ph;
2780         uint16_t plen, ptype;
2781         struct sctp_ifa *sctp_ifa;
2782         union sctp_sockstore store;
2783
2784 #ifdef INET6
2785         struct sctp_ipv6addr_param addr6_store;
2786
2787 #endif
2788 #ifdef INET
2789         struct sctp_ipv4addr_param addr4_store;
2790
2791 #endif
2792
2793         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2794         if (stcb == NULL)       /* Un-needed check for SA */
2795                 return;
2796
2797         /* convert to upper bound */
2798         length += offset;
2799
2800         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2801                 return;
2802         }
2803         /* go through the addresses in the init-ack */
2804         ph = (struct sctp_paramhdr *)
2805             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2806             (uint8_t *) & tmp_param);
2807         while (ph != NULL) {
2808                 ptype = ntohs(ph->param_type);
2809                 plen = ntohs(ph->param_length);
2810                 switch (ptype) {
2811 #ifdef INET6
2812                 case SCTP_IPV6_ADDRESS:
2813                         {
2814                                 struct sctp_ipv6addr_param *a6p;
2815
2816                                 /* get the entire IPv6 address param */
2817                                 a6p = (struct sctp_ipv6addr_param *)
2818                                     sctp_m_getptr(m, offset,
2819                                     sizeof(struct sctp_ipv6addr_param),
2820                                     (uint8_t *) & addr6_store);
2821                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2822                                     a6p == NULL) {
2823                                         return;
2824                                 }
2825                                 memset(&store, 0, sizeof(union sctp_sockstore));
2826                                 store.sin6.sin6_family = AF_INET6;
2827                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2828                                 store.sin6.sin6_port = stcb->rport;
2829                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2830                                 break;
2831                         }
2832 #endif
2833 #ifdef INET
2834                 case SCTP_IPV4_ADDRESS:
2835                         {
2836                                 struct sctp_ipv4addr_param *a4p;
2837
2838                                 /* get the entire IPv4 address param */
2839                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2840                                     sizeof(struct sctp_ipv4addr_param),
2841                                     (uint8_t *) & addr4_store);
2842                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2843                                     a4p == NULL) {
2844                                         return;
2845                                 }
2846                                 memset(&store, 0, sizeof(union sctp_sockstore));
2847                                 store.sin.sin_family = AF_INET;
2848                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2849                                 store.sin.sin_port = stcb->rport;
2850                                 store.sin.sin_addr.s_addr = a4p->addr;
2851                                 break;
2852                         }
2853 #endif
2854                 default:
2855                         goto next_addr;
2856                 }
2857
2858                 /* see if this address really (still) exists */
2859                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2860                     SCTP_ADDR_NOT_LOCKED);
2861                 if (sctp_ifa == NULL) {
2862                         /* address doesn't exist anymore */
2863                         int status;
2864
2865                         /* are ASCONFs allowed ? */
2866                         if ((sctp_is_feature_on(stcb->sctp_ep,
2867                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2868                             stcb->asoc.asconf_supported) {
2869                                 /* queue an ASCONF DEL_IP_ADDRESS */
2870                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2871                                 /*
2872                                  * if queued ok, and in correct state, send
2873                                  * out the ASCONF.
2874                                  */
2875                                 if (status == 0 &&
2876                                     SCTP_GET_STATE(&stcb->asoc) ==
2877                                     SCTP_STATE_OPEN) {
2878 #ifdef SCTP_TIMER_BASED_ASCONF
2879                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2880                                             stcb->sctp_ep, stcb,
2881                                             stcb->asoc.primary_destination);
2882 #else
2883                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2884 #endif
2885                                 }
2886                         }
2887                 }
2888 next_addr:
2889                 /*
2890                  * Sanity check:  Make sure the length isn't 0, otherwise
2891                  * we'll be stuck in this loop for a long time...
2892                  */
2893                 if (SCTP_SIZE32(plen) == 0) {
2894                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2895                             plen, ptype);
2896                         return;
2897                 }
2898                 /* get next parameter */
2899                 offset += SCTP_SIZE32(plen);
2900                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2901                         return;
2902                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2903                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2904         }                       /* while */
2905 }
2906
2907 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2908 /*
2909  * checks to see if a specific address is in the initack address list returns
2910  * 1 if found, 0 if not
2911  */
2912 static uint32_t
2913 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2914 {
2915         struct sctp_paramhdr tmp_param, *ph;
2916         uint16_t plen, ptype;
2917
2918 #ifdef INET
2919         struct sockaddr_in *sin;
2920         struct sctp_ipv4addr_param *a4p;
2921         struct sctp_ipv6addr_param addr4_store;
2922
2923 #endif
2924 #ifdef INET6
2925         struct sockaddr_in6 *sin6;
2926         struct sctp_ipv6addr_param *a6p;
2927         struct sctp_ipv6addr_param addr6_store;
2928         struct sockaddr_in6 sin6_tmp;
2929
2930 #endif
2931
2932         switch (sa->sa_family) {
2933 #ifdef INET
2934         case AF_INET:
2935                 break;
2936 #endif
2937 #ifdef INET6
2938         case AF_INET6:
2939                 break;
2940 #endif
2941         default:
2942                 return (0);
2943         }
2944
2945         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2946         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2947         /* convert to upper bound */
2948         length += offset;
2949
2950         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2951                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2952                     "find_initack_addr: invalid offset?\n");
2953                 return (0);
2954         }
2955         /* go through the addresses in the init-ack */
2956         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2957             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2958         while (ph != NULL) {
2959                 ptype = ntohs(ph->param_type);
2960                 plen = ntohs(ph->param_length);
2961                 switch (ptype) {
2962 #ifdef INET6
2963                 case SCTP_IPV6_ADDRESS:
2964                         if (sa->sa_family == AF_INET6) {
2965                                 /* get the entire IPv6 address param */
2966                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2967                                         break;
2968                                 }
2969                                 /* get the entire IPv6 address param */
2970                                 a6p = (struct sctp_ipv6addr_param *)
2971                                     sctp_m_getptr(m, offset,
2972                                     sizeof(struct sctp_ipv6addr_param),
2973                                     (uint8_t *) & addr6_store);
2974                                 if (a6p == NULL) {
2975                                         return (0);
2976                                 }
2977                                 sin6 = (struct sockaddr_in6 *)sa;
2978                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2979                                         /* create a copy and clear scope */
2980                                         memcpy(&sin6_tmp, sin6,
2981                                             sizeof(struct sockaddr_in6));
2982                                         sin6 = &sin6_tmp;
2983                                         in6_clearscope(&sin6->sin6_addr);
2984                                 }
2985                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2986                                     sizeof(struct in6_addr)) == 0) {
2987                                         /* found it */
2988                                         return (1);
2989                                 }
2990                         }
2991                         break;
2992 #endif                          /* INET6 */
2993 #ifdef INET
2994                 case SCTP_IPV4_ADDRESS:
2995                         if (sa->sa_family == AF_INET) {
2996                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2997                                         break;
2998                                 }
2999                                 /* get the entire IPv4 address param */
3000                                 a4p = (struct sctp_ipv4addr_param *)
3001                                     sctp_m_getptr(m, offset,
3002                                     sizeof(struct sctp_ipv4addr_param),
3003                                     (uint8_t *) & addr4_store);
3004                                 if (a4p == NULL) {
3005                                         return (0);
3006                                 }
3007                                 sin = (struct sockaddr_in *)sa;
3008                                 if (sin->sin_addr.s_addr == a4p->addr) {
3009                                         /* found it */
3010                                         return (1);
3011                                 }
3012                         }
3013                         break;
3014 #endif
3015                 default:
3016                         break;
3017                 }
3018                 /* get next parameter */
3019                 offset += SCTP_SIZE32(plen);
3020                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3021                         return (0);
3022                 }
3023                 ph = (struct sctp_paramhdr *)
3024                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3025                     (uint8_t *) & tmp_param);
3026         }                       /* while */
3027         /* not found! */
3028         return (0);
3029 }
3030
3031 /*
3032  * makes sure that the current endpoint local addr list is consistent with
3033  * the new association (eg. subset bound, asconf allowed) adds addresses as
3034  * necessary
3035  */
3036 static void
3037 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3038     int length, struct sockaddr *init_addr)
3039 {
3040         struct sctp_laddr *laddr;
3041
3042         /* go through the endpoint list */
3043         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3044                 /* be paranoid and validate the laddr */
3045                 if (laddr->ifa == NULL) {
3046                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3047                             "check_addr_list_ep: laddr->ifa is NULL");
3048                         continue;
3049                 }
3050                 if (laddr->ifa == NULL) {
3051                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3052                         continue;
3053                 }
3054                 /* do i have it implicitly? */
3055                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3056                         continue;
3057                 }
3058                 /* check to see if in the init-ack */
3059                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3060                         /* try to add it */
3061                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3062                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3063                 }
3064         }
3065 }
3066
3067 /*
3068  * makes sure that the current kernel address list is consistent with the new
3069  * association (with all addrs bound) adds addresses as necessary
3070  */
3071 static void
3072 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3073     int length, struct sockaddr *init_addr,
3074     uint16_t local_scope, uint16_t site_scope,
3075     uint16_t ipv4_scope, uint16_t loopback_scope)
3076 {
3077         struct sctp_vrf *vrf = NULL;
3078         struct sctp_ifn *sctp_ifn;
3079         struct sctp_ifa *sctp_ifa;
3080         uint32_t vrf_id;
3081
3082 #ifdef INET
3083         struct sockaddr_in *sin;
3084
3085 #endif
3086 #ifdef INET6
3087         struct sockaddr_in6 *sin6;
3088
3089 #endif
3090
3091         if (stcb) {
3092                 vrf_id = stcb->asoc.vrf_id;
3093         } else {
3094                 return;
3095         }
3096         SCTP_IPI_ADDR_RLOCK();
3097         vrf = sctp_find_vrf(vrf_id);
3098         if (vrf == NULL) {
3099                 SCTP_IPI_ADDR_RUNLOCK();
3100                 return;
3101         }
3102         /* go through all our known interfaces */
3103         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3104                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3105                         /* skip loopback interface */
3106                         continue;
3107                 }
3108                 /* go through each interface address */
3109                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3110                         /* do i have it implicitly? */
3111                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3112                                 continue;
3113                         }
3114                         switch (sctp_ifa->address.sa.sa_family) {
3115 #ifdef INET
3116                         case AF_INET:
3117                                 sin = &sctp_ifa->address.sin;
3118                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3119                                     &sin->sin_addr) != 0) {
3120                                         continue;
3121                                 }
3122                                 if ((ipv4_scope == 0) &&
3123                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3124                                         /* private address not in scope */
3125                                         continue;
3126                                 }
3127                                 break;
3128 #endif
3129 #ifdef INET6
3130                         case AF_INET6:
3131                                 sin6 = &sctp_ifa->address.sin6;
3132                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3133                                     &sin6->sin6_addr) != 0) {
3134                                         continue;
3135                                 }
3136                                 if ((local_scope == 0) &&
3137                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3138                                         continue;
3139                                 }
3140                                 if ((site_scope == 0) &&
3141                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3142                                         continue;
3143                                 }
3144                                 break;
3145 #endif
3146                         default:
3147                                 break;
3148                         }
3149                         /* check to see if in the init-ack */
3150                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3151                                 /* try to add it */
3152                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3153                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3154                                     SCTP_ADDR_LOCKED);
3155                         }
3156                 }               /* end foreach ifa */
3157         }                       /* end foreach ifn */
3158         SCTP_IPI_ADDR_RUNLOCK();
3159 }
3160
3161 /*
3162  * validates an init-ack chunk (from a cookie-echo) with current addresses
3163  * adds addresses from the init-ack into our local address list, if needed
3164  * queues asconf adds/deletes addresses as needed and makes appropriate list
3165  * changes for source address selection m, offset: points to the start of the
3166  * address list in an init-ack chunk length: total length of the address
3167  * params only init_addr: address where my INIT-ACK was sent from
3168  */
3169 void
3170 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3171     int length, struct sockaddr *init_addr,
3172     uint16_t local_scope, uint16_t site_scope,
3173     uint16_t ipv4_scope, uint16_t loopback_scope)
3174 {
3175         /* process the local addresses in the initack */
3176         sctp_process_initack_addresses(stcb, m, offset, length);
3177
3178         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3179                 /* bound all case */
3180                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3181                     local_scope, site_scope, ipv4_scope, loopback_scope);
3182         } else {
3183                 /* subset bound case */
3184                 if (sctp_is_feature_on(stcb->sctp_ep,
3185                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3186                         /* asconf's allowed */
3187                         sctp_check_address_list_ep(stcb, m, offset, length,
3188                             init_addr);
3189                 }
3190                 /* else, no asconfs allowed, so what we sent is what we get */
3191         }
3192 }
3193
3194 /*
3195  * sctp_bindx() support
3196  */
3197 uint32_t
3198 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3199     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3200 {
3201         struct sctp_ifa *ifa;
3202         struct sctp_laddr *laddr, *nladdr;
3203
3204         if (sa->sa_len == 0) {
3205                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3206                 return (EINVAL);
3207         }
3208         if (sctp_ifap) {
3209                 ifa = sctp_ifap;
3210         } else if (type == SCTP_ADD_IP_ADDRESS) {
3211                 /* For an add the address MUST be on the system */
3212                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3213         } else if (type == SCTP_DEL_IP_ADDRESS) {
3214                 /* For a delete we need to find it in the inp */
3215                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3216         } else {
3217                 ifa = NULL;
3218         }
3219         if (ifa != NULL) {
3220                 if (type == SCTP_ADD_IP_ADDRESS) {
3221                         sctp_add_local_addr_ep(inp, ifa, type);
3222                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3223                         if (inp->laddr_count < 2) {
3224                                 /* can't delete the last local address */
3225                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3226                                 return (EINVAL);
3227                         }
3228                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3229                             sctp_nxt_addr) {
3230                                 if (ifa == laddr->ifa) {
3231                                         /* Mark in the delete */
3232                                         laddr->action = type;
3233                                 }
3234                         }
3235                 }
3236                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3237                         /*
3238                          * There is no need to start the iterator if the inp
3239                          * has no associations.
3240                          */
3241                         if (type == SCTP_DEL_IP_ADDRESS) {
3242                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3243                                         if (laddr->ifa == ifa) {
3244                                                 sctp_del_local_addr_ep(inp, ifa);
3245                                         }
3246                                 }
3247                         }
3248                 } else {
3249                         struct sctp_asconf_iterator *asc;
3250                         struct sctp_laddr *wi;
3251                         int ret;
3252
3253                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3254                             sizeof(struct sctp_asconf_iterator),
3255                             SCTP_M_ASC_IT);
3256                         if (asc == NULL) {
3257                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3258                                 return (ENOMEM);
3259                         }
3260                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3261                         if (wi == NULL) {
3262                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3263                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3264                                 return (ENOMEM);
3265                         }
3266                         LIST_INIT(&asc->list_of_work);
3267                         asc->cnt = 1;
3268                         SCTP_INCR_LADDR_COUNT();
3269                         wi->ifa = ifa;
3270                         wi->action = type;
3271                         atomic_add_int(&ifa->refcount, 1);
3272                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3273                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3274                             sctp_asconf_iterator_stcb,
3275                             sctp_asconf_iterator_ep_end,
3276                             SCTP_PCB_ANY_FLAGS,
3277                             SCTP_PCB_ANY_FEATURES,
3278                             SCTP_ASOC_ANY_STATE,
3279                             (void *)asc, 0,
3280                             sctp_asconf_iterator_end, inp, 0);
3281                         if (ret) {
3282                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3283                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3284                                 sctp_asconf_iterator_end(asc, 0);
3285                                 return (EFAULT);
3286                         }
3287                 }
3288                 return (0);
3289         } else {
3290                 /* invalid address! */
3291                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3292                 return (EADDRNOTAVAIL);
3293         }
3294 }
3295
3296 void
3297 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3298     struct sctp_nets *net)
3299 {
3300         struct sctp_asconf_addr *aa;
3301         struct sctp_ifa *sctp_ifap;
3302         struct sctp_asconf_tag_param *vtag;
3303
3304 #ifdef INET
3305         struct sockaddr_in *to;
3306
3307 #endif
3308 #ifdef INET6
3309         struct sockaddr_in6 *to6;
3310
3311 #endif
3312         if (net == NULL) {
3313                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3314                 return;
3315         }
3316         if (stcb == NULL) {
3317                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3318                 return;
3319         }
3320         /*
3321          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3322          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3323          */
3324         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3325             SCTP_M_ASC_ADDR);
3326         if (aa == NULL) {
3327                 /* didn't get memory */
3328                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3329                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3330                 return;
3331         }
3332         aa->special_del = 0;
3333         /* fill in asconf address parameter fields */
3334         /* top level elements are "networked" during send */
3335         aa->ifa = NULL;
3336         aa->sent = 0;           /* clear sent flag */
3337         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3338         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3339         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3340         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3341         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3342         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3343
3344         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3345             SCTP_M_ASC_ADDR);
3346         if (aa == NULL) {
3347                 /* didn't get memory */
3348                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3349                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3350                 return;
3351         }
3352         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3353         /* fill in asconf address parameter fields */
3354         /* ADD(0.0.0.0) */
3355         switch (net->ro._l_addr.sa.sa_family) {
3356 #ifdef INET
3357         case AF_INET:
3358                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3359                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3360                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3361                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3362                 /* No need to add an address, we are using 0.0.0.0 */
3363                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3364                 break;
3365 #endif
3366 #ifdef INET6
3367         case AF_INET6:
3368                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3369                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3370                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3371                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3372                 /* No need to add an address, we are using 0.0.0.0 */
3373                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3374                 break;
3375 #endif
3376         default:
3377                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3378                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3379                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3380                 return;
3381         }
3382         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3383             SCTP_M_ASC_ADDR);
3384         if (aa == NULL) {
3385                 /* didn't get memory */
3386                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3387                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3388                 return;
3389         }
3390         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3391         /* fill in asconf address parameter fields */
3392         /* ADD(0.0.0.0) */
3393         switch (net->ro._l_addr.sa.sa_family) {
3394 #ifdef INET
3395         case AF_INET:
3396                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3397                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3398                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3399                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3400                 /* No need to add an address, we are using 0.0.0.0 */
3401                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3402                 break;
3403 #endif
3404 #ifdef INET6
3405         case AF_INET6:
3406                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3407                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3408                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3409                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3410                 /* No need to add an address, we are using 0.0.0.0 */
3411                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3412                 break;
3413 #endif
3414         default:
3415                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3416                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3417                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3418                 return;
3419         }
3420         /* Now we must hunt the addresses and add all global addresses */
3421         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3422                 struct sctp_vrf *vrf = NULL;
3423                 struct sctp_ifn *sctp_ifnp;
3424                 uint32_t vrf_id;
3425
3426                 vrf_id = stcb->sctp_ep->def_vrf_id;
3427                 vrf = sctp_find_vrf(vrf_id);
3428                 if (vrf == NULL) {
3429                         goto skip_rest;
3430                 }
3431                 SCTP_IPI_ADDR_RLOCK();
3432                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3433                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3434                                 switch (sctp_ifap->address.sa.sa_family) {
3435 #ifdef INET
3436                                 case AF_INET:
3437                                         to = &sctp_ifap->address.sin;
3438                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3439                                             &to->sin_addr) != 0) {
3440                                                 continue;
3441                                         }
3442                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3443                                                 continue;
3444                                         }
3445                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3446                                                 continue;
3447                                         }
3448                                         break;
3449 #endif
3450 #ifdef INET6
3451                                 case AF_INET6:
3452                                         to6 = &sctp_ifap->address.sin6;
3453                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3454                                             &to6->sin6_addr) != 0) {
3455                                                 continue;
3456                                         }
3457                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3458                                                 continue;
3459                                         }
3460                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3461                                                 continue;
3462                                         }
3463                                         break;
3464 #endif
3465                                 default:
3466                                         continue;
3467                                 }
3468                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3469                         }
3470                 }
3471                 SCTP_IPI_ADDR_RUNLOCK();
3472         } else {
3473                 struct sctp_laddr *laddr;
3474
3475                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3476                         if (laddr->ifa == NULL) {
3477                                 continue;
3478                         }
3479                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3480                                 /*
3481                                  * Address being deleted by the system, dont
3482                                  * list.
3483                                  */
3484                                 continue;
3485                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3486                                 /*
3487                                  * Address being deleted on this ep don't
3488                                  * list.
3489                                  */
3490                                 continue;
3491                         }
3492                         sctp_ifap = laddr->ifa;
3493                         switch (sctp_ifap->address.sa.sa_family) {
3494 #ifdef INET
3495                         case AF_INET:
3496                                 to = &sctp_ifap->address.sin;
3497                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3498                                         continue;
3499                                 }
3500                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3501                                         continue;
3502                                 }
3503                                 break;
3504 #endif
3505 #ifdef INET6
3506                         case AF_INET6:
3507                                 to6 = &sctp_ifap->address.sin6;
3508                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3509                                         continue;
3510                                 }
3511                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3512                                         continue;
3513                                 }
3514                                 break;
3515 #endif
3516                         default:
3517                                 continue;
3518                         }
3519                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3520                 }
3521         }
3522 skip_rest:
3523         /* Now we must send the asconf into the queue */
3524         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3525 }