sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_NOWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_NOWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         struct sockaddr_storage sa_store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, param_length, aparam_length;
 154         struct sockaddr *sa;
 155         int zero_address = 0;
 156         int bad_address = 0;
 157
 158 #ifdef INET
 159         struct sockaddr_in *sin;
 160         struct sctp_ipv4addr_param *v4addr;
 161
 162 #endif
 163 #ifdef INET6
 164         struct sockaddr_in6 *sin6;
 165         struct sctp_ipv6addr_param *v6addr;
 166
 167 #endif
 168
 169         aparam_length = ntohs(aph->ph.param_length);
 170         ph = (struct sctp_paramhdr *)(aph + 1);
 171         param_type = ntohs(ph->param_type);
 172         param_length = ntohs(ph->param_length);
 173
 174         sa = (struct sockaddr *)&sa_store;
 175         switch (param_type) {
 176 #ifdef INET
 177         case SCTP_IPV4_ADDRESS:
 178                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 179                         /* invalid param size */
 180                         return (NULL);
 181                 }
 182                 v4addr = (struct sctp_ipv4addr_param *)ph;
 183                 sin = (struct sockaddr_in *)&sa_store;
 184                 bzero(sin, sizeof(*sin));
 185                 sin->sin_family = AF_INET;
 186                 sin->sin_len = sizeof(struct sockaddr_in);
 187                 sin->sin_port = stcb->rport;
 188                 sin->sin_addr.s_addr = v4addr->addr;
 189                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 190                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 191                         bad_address = 1;
 192                 }
 193                 if (sin->sin_addr.s_addr == INADDR_ANY)
 194                         zero_address = 1;
 195                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 196                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 197                 break;
 198 #endif
 199 #ifdef INET6
 200         case SCTP_IPV6_ADDRESS:
 201                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 202                         /* invalid param size */
 203                         return (NULL);
 204                 }
 205                 v6addr = (struct sctp_ipv6addr_param *)ph;
 206                 sin6 = (struct sockaddr_in6 *)&sa_store;
 207                 bzero(sin6, sizeof(*sin6));
 208                 sin6->sin6_family = AF_INET6;
 209                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 210                 sin6->sin6_port = stcb->rport;
 211                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 212                     sizeof(struct in6_addr));
 213                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 214                         bad_address = 1;
 215                 }
 216                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 217                         zero_address = 1;
 218                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 219                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 220                 break;
 221 #endif
 222         default:
 223                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 224                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 225                     aparam_length);
 226                 return (m_reply);
 227         }                       /* end switch */
 228
 229         /* if 0.0.0.0/::0, add the source address instead */
 230         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 231                 sa = src;
 232                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 233                     "process_asconf_add_ip: using source addr ");
 234                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 235         }
 236         /* add the address */
 237         if (bad_address) {
 238                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 239                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 240                     aparam_length);
 241         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 242             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 243                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 244                     "process_asconf_add_ip: error adding address\n");
 245                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 246                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 247                     aparam_length);
 248         } else {
 249                 /* notify upper layer */
 250                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 251                 if (response_required) {
 252                         m_reply =
 253                             sctp_asconf_success_response(aph->correlation_id);
 254                 }
 255                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 256                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 257                     stcb, net);
 258                 if (send_hb) {
 259                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 260                 }
 261         }
 262         return (m_reply);
 263 }
 264
 265 static int
 266 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 267 {
 268         struct sctp_nets *src_net, *net;
 269
 270         /* make sure the source address exists as a destination net */
 271         src_net = sctp_findnet(stcb, src);
 272         if (src_net == NULL) {
 273                 /* not found */
 274                 return (-1);
 275         }
 276         /* delete all destination addresses except the source */
 277         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 278                 if (net != src_net) {
 279                         /* delete this address */
 280                         sctp_remove_net(stcb, net);
 281                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 282                             "asconf_del_remote_addrs_except: deleting ");
 283                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 284                             (struct sockaddr *)&net->ro._l_addr);
 285                         /* notify upper layer */
 286                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 287                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 288                 }
 289         }
 290         return (0);
 291 }
 292
 293 static struct mbuf *
 294 sctp_process_asconf_delete_ip(struct sockaddr *src,
 295     struct sctp_asconf_paramhdr *aph,
 296     struct sctp_tcb *stcb, int response_required)
 297 {
 298         struct mbuf *m_reply = NULL;
 299         struct sockaddr_storage sa_store;
 300         struct sctp_paramhdr *ph;
 301         uint16_t param_type, param_length, aparam_length;
 302         struct sockaddr *sa;
 303         int zero_address = 0;
 304         int result;
 305
 306 #ifdef INET
 307         struct sockaddr_in *sin;
 308         struct sctp_ipv4addr_param *v4addr;
 309
 310 #endif
 311 #ifdef INET6
 312         struct sockaddr_in6 *sin6;
 313         struct sctp_ipv6addr_param *v6addr;
 314
 315 #endif
 316
 317         aparam_length = ntohs(aph->ph.param_length);
 318         ph = (struct sctp_paramhdr *)(aph + 1);
 319         param_type = ntohs(ph->param_type);
 320         param_length = ntohs(ph->param_length);
 321
 322         sa = (struct sockaddr *)&sa_store;
 323         switch (param_type) {
 324 #ifdef INET
 325         case SCTP_IPV4_ADDRESS:
 326                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 327                         /* invalid param size */
 328                         return (NULL);
 329                 }
 330                 v4addr = (struct sctp_ipv4addr_param *)ph;
 331                 sin = (struct sockaddr_in *)&sa_store;
 332                 bzero(sin, sizeof(*sin));
 333                 sin->sin_family = AF_INET;
 334                 sin->sin_len = sizeof(struct sockaddr_in);
 335                 sin->sin_port = stcb->rport;
 336                 sin->sin_addr.s_addr = v4addr->addr;
 337                 if (sin->sin_addr.s_addr == INADDR_ANY)
 338                         zero_address = 1;
 339                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 340                     "process_asconf_delete_ip: deleting ");
 341                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 342                 break;
 343 #endif
 344 #ifdef INET6
 345         case SCTP_IPV6_ADDRESS:
 346                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 347                         /* invalid param size */
 348                         return (NULL);
 349                 }
 350                 v6addr = (struct sctp_ipv6addr_param *)ph;
 351                 sin6 = (struct sockaddr_in6 *)&sa_store;
 352                 bzero(sin6, sizeof(*sin6));
 353                 sin6->sin6_family = AF_INET6;
 354                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 355                 sin6->sin6_port = stcb->rport;
 356                 memcpy(&sin6->sin6_addr, v6addr->addr,
 357                     sizeof(struct in6_addr));
 358                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 359                         zero_address = 1;
 360                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 361                     "process_asconf_delete_ip: deleting ");
 362                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 363                 break;
 364 #endif
 365         default:
 366                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 367                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 368                     aparam_length);
 369                 return (m_reply);
 370         }
 371
 372         /* make sure the source address is not being deleted */
 373         if (sctp_cmpaddr(sa, src)) {
 374                 /* trying to delete the source address! */
 375                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 376                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 377                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 378                     aparam_length);
 379                 return (m_reply);
 380         }
 381         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 382         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 383                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 384
 385                 if (result) {
 386                         /* src address did not exist? */
 387                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 388                         /* what error to reply with?? */
 389                         m_reply =
 390                             sctp_asconf_error_response(aph->correlation_id,
 391                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 392                             aparam_length);
 393                 } else if (response_required) {
 394                         m_reply =
 395                             sctp_asconf_success_response(aph->correlation_id);
 396                 }
 397                 return (m_reply);
 398         }
 399         /* delete the address */
 400         result = sctp_del_remote_addr(stcb, sa);
 401         /*
 402          * note if result == -2, the address doesn't exist in the asoc but
 403          * since it's being deleted anyways, we just ack the delete -- but
 404          * this probably means something has already gone awry
 405          */
 406         if (result == -1) {
 407                 /* only one address in the asoc */
 408                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 409                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 410                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 411                     aparam_length);
 412         } else {
 413                 if (response_required) {
 414                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 415                 }
 416                 /* notify upper layer */
 417                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 418         }
 419         return (m_reply);
 420 }
 421
 422 static struct mbuf *
 423 sctp_process_asconf_set_primary(struct sockaddr *src,
 424     struct sctp_asconf_paramhdr *aph,
 425     struct sctp_tcb *stcb, int response_required)
 426 {
 427         struct mbuf *m_reply = NULL;
 428         struct sockaddr_storage sa_store;
 429         struct sctp_paramhdr *ph;
 430         uint16_t param_type, param_length, aparam_length;
 431         struct sockaddr *sa;
 432         int zero_address = 0;
 433
 434 #ifdef INET
 435         struct sockaddr_in *sin;
 436         struct sctp_ipv4addr_param *v4addr;
 437
 438 #endif
 439 #ifdef INET6
 440         struct sockaddr_in6 *sin6;
 441         struct sctp_ipv6addr_param *v6addr;
 442
 443 #endif
 444
 445         aparam_length = ntohs(aph->ph.param_length);
 446         ph = (struct sctp_paramhdr *)(aph + 1);
 447         param_type = ntohs(ph->param_type);
 448         param_length = ntohs(ph->param_length);
 449
 450         sa = (struct sockaddr *)&sa_store;
 451         switch (param_type) {
 452 #ifdef INET
 453         case SCTP_IPV4_ADDRESS:
 454                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 455                         /* invalid param size */
 456                         return (NULL);
 457                 }
 458                 v4addr = (struct sctp_ipv4addr_param *)ph;
 459                 sin = (struct sockaddr_in *)&sa_store;
 460                 bzero(sin, sizeof(*sin));
 461                 sin->sin_family = AF_INET;
 462                 sin->sin_len = sizeof(struct sockaddr_in);
 463                 sin->sin_addr.s_addr = v4addr->addr;
 464                 if (sin->sin_addr.s_addr == INADDR_ANY)
 465                         zero_address = 1;
 466                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 467                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 468                 break;
 469 #endif
 470 #ifdef INET6
 471         case SCTP_IPV6_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v6addr = (struct sctp_ipv6addr_param *)ph;
 477                 sin6 = (struct sockaddr_in6 *)&sa_store;
 478                 bzero(sin6, sizeof(*sin6));
 479                 sin6->sin6_family = AF_INET6;
 480                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 481                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 482                     sizeof(struct in6_addr));
 483                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 484                         zero_address = 1;
 485                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 486                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 487                 break;
 488 #endif
 489         default:
 490                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 491                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 492                     aparam_length);
 493                 return (m_reply);
 494         }
 495
 496         /* if 0.0.0.0/::0, use the source address instead */
 497         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 498                 sa = src;
 499                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 500                     "process_asconf_set_primary: using source addr ");
 501                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 502         }
 503         /* set the primary address */
 504         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 505                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 506                     "process_asconf_set_primary: primary address set\n");
 507                 /* notify upper layer */
 508                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 509                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 510                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 511                     (stcb->asoc.alternate)) {
 512                         sctp_free_remote_addr(stcb->asoc.alternate);
 513                         stcb->asoc.alternate = NULL;
 514                 }
 515                 if (response_required) {
 516                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 517                 }
 518                 /*
 519                  * Mobility adaptation. Ideally, when the reception of SET
 520                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 521                  * destination, unacknowledged DATA are retransmitted
 522                  * immediately to the new primary destination for seamless
 523                  * handover. If the destination is UNCONFIRMED and marked to
 524                  * REQ_PRIM, The retransmission occur when reception of the
 525                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 526                  * sctp_input.c) Also, when change of the primary
 527                  * destination, it is better that all subsequent new DATA
 528                  * containing already queued DATA are transmitted to the new
 529                  * primary destination. (by micchie)
 530                  */
 531                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 532                     SCTP_MOBILITY_BASE) ||
 533                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 534                     SCTP_MOBILITY_FASTHANDOFF)) &&
 535                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 536                     SCTP_MOBILITY_PRIM_DELETED) &&
 537                     (stcb->asoc.primary_destination->dest_state &
 538                     SCTP_ADDR_UNCONFIRMED) == 0) {
 539
 540                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 541                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 542                             SCTP_MOBILITY_FASTHANDOFF)) {
 543                                 sctp_assoc_immediate_retrans(stcb,
 544                                     stcb->asoc.primary_destination);
 545                         }
 546                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 547                             SCTP_MOBILITY_BASE)) {
 548                                 sctp_move_chunks_from_net(stcb,
 549                                     stcb->asoc.deleted_primary);
 550                         }
 551                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 552                             stcb->asoc.deleted_primary);
 553                 }
 554         } else {
 555                 /* couldn't set the requested primary address! */
 556                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 557                     "process_asconf_set_primary: set primary failed!\n");
 558                 /* must have been an invalid address, so report */
 559                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 560                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 561                     aparam_length);
 562         }
 563
 564         return (m_reply);
 565 }
 566
 567 /*
 568  * handles an ASCONF chunk.
 569  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 570  */
 571 void
 572 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 573     struct sockaddr *src,
 574     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 575     int first)
 576 {
 577         struct sctp_association *asoc;
 578         uint32_t serial_num;
 579         struct mbuf *n, *m_ack, *m_result, *m_tail;
 580         struct sctp_asconf_ack_chunk *ack_cp;
 581         struct sctp_asconf_paramhdr *aph, *ack_aph;
 582         struct sctp_ipv6addr_param *p_addr;
 583         unsigned int asconf_limit, cnt;
 584         int error = 0;          /* did an error occur? */
 585
 586         /* asconf param buffer */
 587         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 588         struct sctp_asconf_ack *ack, *ack_next;
 589
 590         /* verify minimum length */
 591         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "handle_asconf: chunk too small = %xh\n",
 594                     ntohs(cp->ch.chunk_length));
 595                 return;
 596         }
 597         asoc = &stcb->asoc;
 598         serial_num = ntohl(cp->serial_number);
 599
 600         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 601                 /* got a duplicate ASCONF */
 602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 603                     "handle_asconf: got duplicate serial number = %xh\n",
 604                     serial_num);
 605                 return;
 606         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 607                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 608                     serial_num, asoc->asconf_seq_in + 1);
 609                 return;
 610         }
 611         /* it's the expected "next" sequence number, so process it */
 612         asoc->asconf_seq_in = serial_num;       /* update sequence */
 613         /* get length of all the param's in the ASCONF */
 614         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 615         SCTPDBG(SCTP_DEBUG_ASCONF1,
 616             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 617             asconf_limit, serial_num);
 618
 619         if (first) {
 620                 /* delete old cache */
 621                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 622
 623                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 624                         if (ack->serial_number == serial_num)
 625                                 break;
 626                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 627                             ack->serial_number, serial_num);
 628                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 629                         if (ack->data != NULL) {
 630                                 sctp_m_freem(ack->data);
 631                         }
 632                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 633                 }
 634         }
 635         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 636             M_NOWAIT, 1, MT_DATA);
 637         if (m_ack == NULL) {
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: couldn't get mbuf!\n");
 640                 return;
 641         }
 642         m_tail = m_ack;         /* current reply chain's tail */
 643
 644         /* fill in ASCONF-ACK header */
 645         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 646         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 647         ack_cp->ch.chunk_flags = 0;
 648         ack_cp->serial_number = htonl(serial_num);
 649         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 650         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 651         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 652
 653         /* skip the lookup address parameter */
 654         offset += sizeof(struct sctp_asconf_chunk);
 655         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 656         if (p_addr == NULL) {
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 658                     "handle_asconf: couldn't get lookup addr!\n");
 659                 /* respond with a missing/invalid mandatory parameter error */
 660                 return;
 661         }
 662         /* param_length is already validated in process_control... */
 663         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 664
 665         /* get pointer to first asconf param in ASCONF-ACK */
 666         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 667         if (ack_aph == NULL) {
 668                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 669                 return;
 670         }
 671         /* get pointer to first asconf param in ASCONF */
 672         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 673         if (aph == NULL) {
 674                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 675                 goto send_reply;
 676         }
 677         /* process through all parameters */
 678         cnt = 0;
 679         while (aph != NULL) {
 680                 unsigned int param_length, param_type;
 681
 682                 param_type = ntohs(aph->ph.param_type);
 683                 param_length = ntohs(aph->ph.param_length);
 684                 if (offset + param_length > asconf_limit) {
 685                         /* parameter goes beyond end of chunk! */
 686                         sctp_m_freem(m_ack);
 687                         return;
 688                 }
 689                 m_result = NULL;
 690
 691                 if (param_length > sizeof(aparam_buf)) {
 692                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 693                         sctp_m_freem(m_ack);
 694                         return;
 695                 }
 696                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 697                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 698                         sctp_m_freem(m_ack);
 699                 }
 700                 /* get the entire parameter */
 701                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 702                 if (aph == NULL) {
 703                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 704                         sctp_m_freem(m_ack);
 705                         return;
 706                 }
 707                 switch (param_type) {
 708                 case SCTP_ADD_IP_ADDRESS:
 709                         asoc->peer_supports_asconf = 1;
 710                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 711                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 712                         cnt++;
 713                         break;
 714                 case SCTP_DEL_IP_ADDRESS:
 715                         asoc->peer_supports_asconf = 1;
 716                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 717                             error);
 718                         break;
 719                 case SCTP_ERROR_CAUSE_IND:
 720                         /* not valid in an ASCONF chunk */
 721                         break;
 722                 case SCTP_SET_PRIM_ADDR:
 723                         asoc->peer_supports_asconf = 1;
 724                         m_result = sctp_process_asconf_set_primary(src, aph,
 725                             stcb, error);
 726                         break;
 727                 case SCTP_NAT_VTAGS:
 728                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 729                         break;
 730                 case SCTP_SUCCESS_REPORT:
 731                         /* not valid in an ASCONF chunk */
 732                         break;
 733                 case SCTP_ULP_ADAPTATION:
 734                         /* FIX */
 735                         break;
 736                 default:
 737                         if ((param_type & 0x8000) == 0) {
 738                                 /* Been told to STOP at this param */
 739                                 asconf_limit = offset;
 740                                 /*
 741                                  * FIX FIX - We need to call
 742                                  * sctp_arethere_unrecognized_parameters()
 743                                  * to get a operr and send it for any
 744                                  * param's with the 0x4000 bit set OR do it
 745                                  * here ourselves... note we still must STOP
 746                                  * if the 0x8000 bit is clear.
 747                                  */
 748                         }
 749                         /* unknown/invalid param type */
 750                         break;
 751                 }               /* switch */
 752
 753                 /* add any (error) result to the reply mbuf chain */
 754                 if (m_result != NULL) {
 755                         SCTP_BUF_NEXT(m_tail) = m_result;
 756                         m_tail = m_result;
 757                         /* update lengths, make sure it's aligned too */
 758                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 759                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 760                         /* set flag to force success reports */
 761                         error = 1;
 762                 }
 763                 offset += SCTP_SIZE32(param_length);
 764                 /* update remaining ASCONF message length to process */
 765                 if (offset >= asconf_limit) {
 766                         /* no more data in the mbuf chain */
 767                         break;
 768                 }
 769                 /* get pointer to next asconf param */
 770                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 771                     sizeof(struct sctp_asconf_paramhdr),
 772                     (uint8_t *) & aparam_buf);
 773                 if (aph == NULL) {
 774                         /* can't get an asconf paramhdr */
 775                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 776                         /* FIX ME - add error here... */
 777                 }
 778         }
 779
 780 send_reply:
 781         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 782         /* save the ASCONF-ACK reply */
 783         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 784             struct sctp_asconf_ack);
 785         if (ack == NULL) {
 786                 sctp_m_freem(m_ack);
 787                 return;
 788         }
 789         ack->serial_number = serial_num;
 790         ack->last_sent_to = NULL;
 791         ack->data = m_ack;
 792         ack->len = 0;
 793         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 794                 ack->len += SCTP_BUF_LEN(n);
 795         }
 796         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 797
 798         /* see if last_control_chunk_from is set properly (use IP src addr) */
 799         if (stcb->asoc.last_control_chunk_from == NULL) {
 800                 /*
 801                  * this could happen if the source address was just newly
 802                  * added
 803                  */
 804                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 805                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 806                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 807                 /* look up the from address */
 808                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 809 #ifdef SCTP_DEBUG
 810                 if (stcb->asoc.last_control_chunk_from == NULL) {
 811                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 812                 }
 813 #endif
 814         }
 815 }
 816
 817 /*
 818  * does the address match? returns 0 if not, 1 if so
 819  */
 820 static uint32_t
 821 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 822 {
 823         switch (sa->sa_family) {
 824 #ifdef INET6
 825         case AF_INET6:
 826                 {
 827                         /* XXX scopeid */
 828                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 829
 830                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 831                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 832                             sizeof(struct in6_addr)) == 0)) {
 833                                 return (1);
 834                         }
 835                         break;
 836                 }
 837 #endif
 838 #ifdef INET
 839         case AF_INET:
 840                 {
 841                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 842
 843                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 844                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 845                             sizeof(struct in_addr)) == 0)) {
 846                                 return (1);
 847                         }
 848                         break;
 849                 }
 850 #endif
 851         default:
 852                 break;
 853         }
 854         return (0);
 855 }
 856
 857 /*
 858  * does the address match? returns 0 if not, 1 if so
 859  */
 860 static uint32_t
 861 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 862 {
 863         uint16_t param_type, param_length;
 864
 865         param_type = ntohs(ph->param_type);
 866         param_length = ntohs(ph->param_length);
 867         switch (sa->sa_family) {
 868 #ifdef INET6
 869         case AF_INET6:
 870                 {
 871                         /* XXX scopeid */
 872                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 873                         struct sctp_ipv6addr_param *v6addr;
 874
 875                         v6addr = (struct sctp_ipv6addr_param *)ph;
 876                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 877                             param_length == sizeof(struct sctp_ipv6addr_param) &&
 878                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 879                             sizeof(struct in6_addr)) == 0)) {
 880                                 return (1);
 881                         }
 882                         break;
 883                 }
 884 #endif
 885 #ifdef INET
 886         case AF_INET:
 887                 {
 888                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 889                         struct sctp_ipv4addr_param *v4addr;
 890
 891                         v4addr = (struct sctp_ipv4addr_param *)ph;
 892                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 893                             param_length == sizeof(struct sctp_ipv4addr_param) &&
 894                             (memcmp(&v4addr->addr, &sin->sin_addr,
 895                             sizeof(struct in_addr)) == 0)) {
 896                                 return (1);
 897                         }
 898                         break;
 899                 }
 900 #endif
 901         default:
 902                 break;
 903         }
 904         return (0);
 905 }
 906
 907 /*
 908  * Cleanup for non-responded/OP ERR'd ASCONF
 909  */
 910 void
 911 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 912 {
 913         /* mark peer as ASCONF incapable */
 914         stcb->asoc.peer_supports_asconf = 0;
 915         /*
 916          * clear out any existing asconfs going out
 917          */
 918         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 919             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 920         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 921         /* remove the old ASCONF on our outbound queue */
 922         sctp_toss_old_asconf(stcb);
 923 }
 924
 925 /*
 926  * cleanup any cached source addresses that may be topologically
 927  * incorrect after a new address has been added to this interface.
 928  */
 929 static void
 930 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 931 {
 932         struct sctp_nets *net;
 933
 934         /*
 935          * Ideally, we want to only clear cached routes and source addresses
 936          * that are topologically incorrect.  But since there is no easy way
 937          * to know whether the newly added address on the ifn would cause a
 938          * routing change (i.e. a new egress interface would be chosen)
 939          * without doing a new routing lookup and source address selection,
 940          * we will (for now) just flush any cached route using a different
 941          * ifn (and cached source addrs) and let output re-choose them
 942          * during the next send on that net.
 943          */
 944         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 945                 /*
 946                  * clear any cached route (and cached source address) if the
 947                  * route's interface is NOT the same as the address change.
 948                  * If it's the same interface, just clear the cached source
 949                  * address.
 950                  */
 951                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 952                     ((ifn == NULL) ||
 953                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 954                         /* clear any cached route */
 955                         RTFREE(net->ro.ro_rt);
 956                         net->ro.ro_rt = NULL;
 957                 }
 958                 /* clear any cached source address */
 959                 if (net->src_addr_selected) {
 960                         sctp_free_ifa(net->ro._s_addr);
 961                         net->ro._s_addr = NULL;
 962                         net->src_addr_selected = 0;
 963                 }
 964         }
 965 }
 966
 967
 968 void
 969 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 970 {
 971         int error;
 972
 973         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 974                 return;
 975         }
 976         if (stcb->asoc.deleted_primary == NULL) {
 977                 return;
 978         }
 979         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 980                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 981                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 982                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 983                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 984                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 985                     stcb->asoc.deleted_primary,
 986                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
 987                 stcb->asoc.num_send_timers_up--;
 988                 if (stcb->asoc.num_send_timers_up < 0) {
 989                         stcb->asoc.num_send_timers_up = 0;
 990                 }
 991                 SCTP_TCB_LOCK_ASSERT(stcb);
 992                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 993                     stcb->asoc.deleted_primary);
 994                 if (error) {
 995                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 996                         return;
 997                 }
 998                 SCTP_TCB_LOCK_ASSERT(stcb);
 999 #ifdef SCTP_AUDITING_ENABLED
1000                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1001 #endif
1002                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1003                 if ((stcb->asoc.num_send_timers_up == 0) &&
1004                     (stcb->asoc.sent_queue_cnt > 0)) {
1005                         struct sctp_tmit_chunk *chk;
1006
1007                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1008                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1009                             stcb, chk->whoTo);
1010                 }
1011         }
1012         return;
1013 }
1014
1015 static int
1016     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1017
1018 void
1019 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1020 {
1021         struct sctp_tmit_chunk *chk;
1022
1023         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1024         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1025             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1026         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1027         net->error_count = 0;
1028         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1029                 if (chk->whoTo == net) {
1030                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1031                                 chk->sent = SCTP_DATAGRAM_RESEND;
1032                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1033                                 sctp_flight_size_decrease(chk);
1034                                 sctp_total_flight_decrease(stcb, chk);
1035                                 net->marked_retrans++;
1036                                 stcb->asoc.marked_retrans++;
1037                         }
1038                 }
1039         }
1040         if (net->marked_retrans) {
1041                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1042         }
1043 }
1044
1045 static void
1046 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1047 {
1048         struct sctp_nets *net;
1049         int addrnum, changed;
1050
1051         /*
1052          * If number of local valid addresses is 1, the valid address is
1053          * probably newly added address. Several valid addresses in this
1054          * association.  A source address may not be changed.  Additionally,
1055          * they can be configured on a same interface as "alias" addresses.
1056          * (by micchie)
1057          */
1058         addrnum = sctp_local_addr_count(stcb);
1059         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1060             addrnum);
1061         if (addrnum == 1) {
1062                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1063                         /* clear any cached route and source address */
1064                         if (net->ro.ro_rt) {
1065                                 RTFREE(net->ro.ro_rt);
1066                                 net->ro.ro_rt = NULL;
1067                         }
1068                         if (net->src_addr_selected) {
1069                                 sctp_free_ifa(net->ro._s_addr);
1070                                 net->ro._s_addr = NULL;
1071                                 net->src_addr_selected = 0;
1072                         }
1073                         /* Retransmit unacknowledged DATA chunks immediately */
1074                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1075                             SCTP_MOBILITY_FASTHANDOFF)) {
1076                                 sctp_net_immediate_retrans(stcb, net);
1077                         }
1078                         /* also, SET PRIMARY is maybe already sent */
1079                 }
1080                 return;
1081         }
1082         /* Multiple local addresses exsist in the association.  */
1083         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1084                 /* clear any cached route and source address */
1085                 if (net->ro.ro_rt) {
1086                         RTFREE(net->ro.ro_rt);
1087                         net->ro.ro_rt = NULL;
1088                 }
1089                 if (net->src_addr_selected) {
1090                         sctp_free_ifa(net->ro._s_addr);
1091                         net->ro._s_addr = NULL;
1092                         net->src_addr_selected = 0;
1093                 }
1094                 /*
1095                  * Check if the nexthop is corresponding to the new address.
1096                  * If the new address is corresponding to the current
1097                  * nexthop, the path will be changed. If the new address is
1098                  * NOT corresponding to the current nexthop, the path will
1099                  * not be changed.
1100                  */
1101                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1102                     stcb->sctp_ep->def_vrf_id);
1103                 if (net->ro.ro_rt == NULL)
1104                         continue;
1105
1106                 changed = 0;
1107                 switch (net->ro._l_addr.sa.sa_family) {
1108 #ifdef INET
1109                 case AF_INET:
1110                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1111                                 changed = 1;
1112                         }
1113                         break;
1114 #endif
1115 #ifdef INET6
1116                 case AF_INET6:
1117                         if (sctp_v6src_match_nexthop(
1118                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1119                                 changed = 1;
1120                         }
1121                         break;
1122 #endif
1123                 default:
1124                         break;
1125                 }
1126                 /*
1127                  * if the newly added address does not relate routing
1128                  * information, we skip.
1129                  */
1130                 if (changed == 0)
1131                         continue;
1132                 /* Retransmit unacknowledged DATA chunks immediately */
1133                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1134                     SCTP_MOBILITY_FASTHANDOFF)) {
1135                         sctp_net_immediate_retrans(stcb, net);
1136                 }
1137                 /* Send SET PRIMARY for this new address */
1138                 if (net == stcb->asoc.primary_destination) {
1139                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1140                             SCTP_SET_PRIM_ADDR);
1141                 }
1142         }
1143 }
1144
1145 /*
1146  * process an ADD/DELETE IP ack from peer.
1147  * addr: corresponding sctp_ifa to the address being added/deleted.
1148  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1149  * flag: 1=success, 0=failure.
1150  */
1151 static void
1152 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1153 {
1154         /*
1155          * do the necessary asoc list work- if we get a failure indication,
1156          * leave the address on the assoc's restricted list.  If we get a
1157          * success indication, remove the address from the restricted list.
1158          */
1159         /*
1160          * Note: this will only occur for ADD_IP_ADDRESS, since
1161          * DEL_IP_ADDRESS is never actually added to the list...
1162          */
1163         if (flag) {
1164                 /* success case, so remove from the restricted list */
1165                 sctp_del_local_addr_restricted(stcb, addr);
1166
1167                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1168                     SCTP_MOBILITY_BASE) ||
1169                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1170                     SCTP_MOBILITY_FASTHANDOFF)) {
1171                         sctp_path_check_and_react(stcb, addr);
1172                         return;
1173                 }
1174                 /* clear any cached/topologically incorrect source addresses */
1175                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1176         }
1177         /* else, leave it on the list */
1178 }
1179
1180 /*
1181  * add an asconf add/delete/set primary IP address parameter to the queue.
1182  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1183  * returns 0 if queued, -1 if not queued/removed.
1184  * NOTE: if adding, but a delete for the same address is already scheduled
1185  * (and not yet sent out), simply remove it from queue.  Same for deleting
1186  * an address already scheduled for add.  If a duplicate operation is found,
1187  * ignore the new one.
1188  */
1189 static int
1190 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1191     uint16_t type)
1192 {
1193         struct sctp_asconf_addr *aa, *aa_next;
1194
1195         /* make sure the request isn't already in the queue */
1196         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1197                 /* address match? */
1198                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1199                         continue;
1200                 /*
1201                  * is the request already in queue but not sent? pass the
1202                  * request already sent in order to resolve the following
1203                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1204                  * can't remove the ADD request already sent 3. arrival of
1205                  * ADD
1206                  */
1207                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1208                         return (-1);
1209                 }
1210                 /* is the negative request already in queue, and not sent */
1211                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1212                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1213                         /* add requested, delete already queued */
1214                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1215                         /* remove the ifa from the restricted list */
1216                         sctp_del_local_addr_restricted(stcb, ifa);
1217                         /* free the asconf param */
1218                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1219                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1220                         return (-1);
1221                 }
1222                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1223                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1224                         /* delete requested, add already queued */
1225                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1226                         /* remove the aa->ifa from the restricted list */
1227                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1228                         /* free the asconf param */
1229                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1230                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1231                         return (-1);
1232                 }
1233         }                       /* for each aa */
1234
1235         /* adding new request to the queue */
1236         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1237             SCTP_M_ASC_ADDR);
1238         if (aa == NULL) {
1239                 /* didn't get memory */
1240                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1241                 return (-1);
1242         }
1243         aa->special_del = 0;
1244         /* fill in asconf address parameter fields */
1245         /* top level elements are "networked" during send */
1246         aa->ap.aph.ph.param_type = type;
1247         aa->ifa = ifa;
1248         atomic_add_int(&ifa->refcount, 1);
1249         /* correlation_id filled in during send routine later... */
1250         switch (ifa->address.sa.sa_family) {
1251 #ifdef INET6
1252         case AF_INET6:
1253                 {
1254                         struct sockaddr_in6 *sin6;
1255
1256                         sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1257                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1258                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1259                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1260                             sizeof(struct sctp_ipv6addr_param);
1261                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1262                             sizeof(struct in6_addr));
1263                         break;
1264                 }
1265 #endif
1266 #ifdef INET
1267         case AF_INET:
1268                 {
1269                         struct sockaddr_in *sin;
1270
1271                         sin = (struct sockaddr_in *)&ifa->address.sa;
1272                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1273                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1274                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1275                             sizeof(struct sctp_ipv4addr_param);
1276                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1277                             sizeof(struct in_addr));
1278                         break;
1279                 }
1280 #endif
1281         default:
1282                 /* invalid family! */
1283                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1284                 sctp_free_ifa(ifa);
1285                 return (-1);
1286         }
1287         aa->sent = 0;           /* clear sent flag */
1288
1289         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1290 #ifdef SCTP_DEBUG
1291         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1292                 if (type == SCTP_ADD_IP_ADDRESS) {
1293                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1294                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1295                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1296                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1297                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1298                 } else {
1299                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1300                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1301                 }
1302         }
1303 #endif
1304
1305         return (0);
1306 }
1307
1308
1309 /*
1310  * add an asconf operation for the given ifa and type.
1311  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1312  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1313  * advisable.
1314  */
1315 static int
1316 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1317     uint16_t type)
1318 {
1319         uint32_t status;
1320         int pending_delete_queued = 0;
1321
1322         /* see if peer supports ASCONF */
1323         if (stcb->asoc.peer_supports_asconf == 0) {
1324                 return (-1);
1325         }
1326         /*
1327          * if this is deleting the last address from the assoc, mark it as
1328          * pending.
1329          */
1330         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1331             (sctp_local_addr_count(stcb) < 2)) {
1332                 /* set the pending delete info only */
1333                 stcb->asoc.asconf_del_pending = 1;
1334                 stcb->asoc.asconf_addr_del_pending = ifa;
1335                 atomic_add_int(&ifa->refcount, 1);
1336                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1337                     "asconf_queue_add: mark delete last address pending\n");
1338                 return (-1);
1339         }
1340         /* queue an asconf parameter */
1341         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1342
1343         /*
1344          * if this is an add, and there is a delete also pending (i.e. the
1345          * last local address is being changed), queue the pending delete
1346          * too.
1347          */
1348         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1349                 /* queue in the pending delete */
1350                 if (sctp_asconf_queue_mgmt(stcb,
1351                     stcb->asoc.asconf_addr_del_pending,
1352                     SCTP_DEL_IP_ADDRESS) == 0) {
1353                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1354                         pending_delete_queued = 1;
1355                         /* clear out the pending delete info */
1356                         stcb->asoc.asconf_del_pending = 0;
1357                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1358                         stcb->asoc.asconf_addr_del_pending = NULL;
1359                 }
1360         }
1361         if (pending_delete_queued) {
1362                 struct sctp_nets *net;
1363
1364                 /*
1365                  * since we know that the only/last address is now being
1366                  * changed in this case, reset the cwnd/rto on all nets to
1367                  * start as a new address and path.  Also clear the error
1368                  * counts to give the assoc the best chance to complete the
1369                  * address change.
1370                  */
1371                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1372                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1373                             net);
1374                         net->RTO = 0;
1375                         net->error_count = 0;
1376                 }
1377                 stcb->asoc.overall_error_count = 0;
1378                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1379                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1380                             stcb->asoc.overall_error_count,
1381                             0,
1382                             SCTP_FROM_SCTP_ASCONF,
1383                             __LINE__);
1384                 }
1385                 /* queue in an advisory set primary too */
1386                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1387                 /* let caller know we should send this out immediately */
1388                 status = 1;
1389         }
1390         return (status);
1391 }
1392
1393 /*-
1394  * add an asconf delete IP address parameter to the queue by sockaddr and
1395  * possibly with no sctp_ifa available.  This is only called by the routine
1396  * that checks the addresses in an INIT-ACK against the current address list.
1397  * returns 0 if completed, non-zero if not completed.
1398  * NOTE: if an add is already scheduled (and not yet sent out), simply
1399  * remove it from queue.  If a duplicate operation is found, ignore the
1400  * new one.
1401  */
1402 static int
1403 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1404 {
1405         struct sctp_ifa *ifa;
1406         struct sctp_asconf_addr *aa, *aa_next;
1407         uint32_t vrf_id;
1408
1409         if (stcb == NULL) {
1410                 return (-1);
1411         }
1412         /* see if peer supports ASCONF */
1413         if (stcb->asoc.peer_supports_asconf == 0) {
1414                 return (-1);
1415         }
1416         /* make sure the request isn't already in the queue */
1417         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1418                 /* address match? */
1419                 if (sctp_asconf_addr_match(aa, sa) == 0)
1420                         continue;
1421                 /* is the request already in queue (sent or not) */
1422                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1423                         return (-1);
1424                 }
1425                 /* is the negative request already in queue, and not sent */
1426                 if (aa->sent == 1)
1427                         continue;
1428                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1429                         /* add already queued, so remove existing entry */
1430                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1431                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1432                         /* free the entry */
1433                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1434                         return (-1);
1435                 }
1436         }                       /* for each aa */
1437
1438         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1439         if (stcb) {
1440                 vrf_id = stcb->asoc.vrf_id;
1441         } else {
1442                 vrf_id = SCTP_DEFAULT_VRFID;
1443         }
1444         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1445
1446         /* adding new request to the queue */
1447         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1448             SCTP_M_ASC_ADDR);
1449         if (aa == NULL) {
1450                 /* didn't get memory */
1451                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1452                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1453                 return (-1);
1454         }
1455         aa->special_del = 0;
1456         /* fill in asconf address parameter fields */
1457         /* top level elements are "networked" during send */
1458         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1459         aa->ifa = ifa;
1460         if (ifa)
1461                 atomic_add_int(&ifa->refcount, 1);
1462         /* correlation_id filled in during send routine later... */
1463         switch (sa->sa_family) {
1464 #ifdef INET6
1465         case AF_INET6:
1466                 {
1467                         /* IPv6 address */
1468                         struct sockaddr_in6 *sin6;
1469
1470                         sin6 = (struct sockaddr_in6 *)sa;
1471                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1472                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1473                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1474                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1475                             sizeof(struct in6_addr));
1476                         break;
1477                 }
1478 #endif
1479 #ifdef INET
1480         case AF_INET:
1481                 {
1482                         /* IPv4 address */
1483                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1484
1485                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1486                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1487                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1488                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1489                             sizeof(struct in_addr));
1490                         break;
1491                 }
1492 #endif
1493         default:
1494                 /* invalid family! */
1495                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1496                 if (ifa)
1497                         sctp_free_ifa(ifa);
1498                 return (-1);
1499         }
1500         aa->sent = 0;           /* clear sent flag */
1501
1502         /* delete goes to the back of the queue */
1503         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1504
1505         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1506         return (0);
1507 }
1508
1509 /*
1510  * find a specific asconf param on our "sent" queue
1511  */
1512 static struct sctp_asconf_addr *
1513 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1514 {
1515         struct sctp_asconf_addr *aa;
1516
1517         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1518                 if (aa->ap.aph.correlation_id == correlation_id &&
1519                     aa->sent == 1) {
1520                         /* found it */
1521                         return (aa);
1522                 }
1523         }
1524         /* didn't find it */
1525         return (NULL);
1526 }
1527
1528 /*
1529  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1530  * notifications based on the error response
1531  */
1532 static void
1533 sctp_asconf_process_error(struct sctp_tcb *stcb,
1534     struct sctp_asconf_paramhdr *aph)
1535 {
1536         struct sctp_error_cause *eh;
1537         struct sctp_paramhdr *ph;
1538         uint16_t param_type;
1539         uint16_t error_code;
1540
1541         eh = (struct sctp_error_cause *)(aph + 1);
1542         ph = (struct sctp_paramhdr *)(eh + 1);
1543         /* validate lengths */
1544         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1545             htons(aph->ph.param_length)) {
1546                 /* invalid error cause length */
1547                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1548                     "asconf_process_error: cause element too long\n");
1549                 return;
1550         }
1551         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1552             htons(eh->length)) {
1553                 /* invalid included TLV length */
1554                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1555                     "asconf_process_error: included TLV too long\n");
1556                 return;
1557         }
1558         /* which error code ? */
1559         error_code = ntohs(eh->code);
1560         param_type = ntohs(aph->ph.param_type);
1561         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1562         switch (error_code) {
1563         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1564                 /* we allow ourselves to "try again" for this error */
1565                 break;
1566         default:
1567                 /* peer can't handle it... */
1568                 switch (param_type) {
1569                 case SCTP_ADD_IP_ADDRESS:
1570                 case SCTP_DEL_IP_ADDRESS:
1571                         stcb->asoc.peer_supports_asconf = 0;
1572                         break;
1573                 case SCTP_SET_PRIM_ADDR:
1574                         stcb->asoc.peer_supports_asconf = 0;
1575                         break;
1576                 default:
1577                         break;
1578                 }
1579         }
1580 }
1581
1582 /*
1583  * process an asconf queue param.
1584  * aparam: parameter to process, will be removed from the queue.
1585  * flag: 1=success case, 0=failure case
1586  */
1587 static void
1588 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1589     struct sctp_asconf_addr *aparam, uint32_t flag)
1590 {
1591         uint16_t param_type;
1592
1593         /* process this param */
1594         param_type = aparam->ap.aph.ph.param_type;
1595         switch (param_type) {
1596         case SCTP_ADD_IP_ADDRESS:
1597                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1598                     "process_param_ack: added IP address\n");
1599                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1600                 break;
1601         case SCTP_DEL_IP_ADDRESS:
1602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1603                     "process_param_ack: deleted IP address\n");
1604                 /* nothing really to do... lists already updated */
1605                 break;
1606         case SCTP_SET_PRIM_ADDR:
1607                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1608                     "process_param_ack: set primary IP address\n");
1609                 /* nothing to do... peer may start using this addr */
1610                 if (flag == 0)
1611                         stcb->asoc.peer_supports_asconf = 0;
1612                 break;
1613         default:
1614                 /* should NEVER happen */
1615                 break;
1616         }
1617
1618         /* remove the param and free it */
1619         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1620         if (aparam->ifa)
1621                 sctp_free_ifa(aparam->ifa);
1622         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1623 }
1624
1625 /*
1626  * cleanup from a bad asconf ack parameter
1627  */
1628 static void
1629 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1630 {
1631         /* assume peer doesn't really know how to do asconfs */
1632         stcb->asoc.peer_supports_asconf = 0;
1633         /* XXX we could free the pending queue here */
1634 }
1635
1636 void
1637 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1638     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1639     struct sctp_nets *net, int *abort_no_unlock)
1640 {
1641         struct sctp_association *asoc;
1642         uint32_t serial_num;
1643         uint16_t ack_length;
1644         struct sctp_asconf_paramhdr *aph;
1645         struct sctp_asconf_addr *aa, *aa_next;
1646         uint32_t last_error_id = 0;     /* last error correlation id */
1647         uint32_t id;
1648         struct sctp_asconf_addr *ap;
1649
1650         /* asconf param buffer */
1651         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1652
1653         /* verify minimum length */
1654         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1655                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1656                     "handle_asconf_ack: chunk too small = %xh\n",
1657                     ntohs(cp->ch.chunk_length));
1658                 return;
1659         }
1660         asoc = &stcb->asoc;
1661         serial_num = ntohl(cp->serial_number);
1662
1663         /*
1664          * NOTE: we may want to handle this differently- currently, we will
1665          * abort when we get an ack for the expected serial number + 1 (eg.
1666          * we didn't send it), process an ack normally if it is the expected
1667          * serial number, and re-send the previous ack for *ALL* other
1668          * serial numbers
1669          */
1670
1671         /*
1672          * if the serial number is the next expected, but I didn't send it,
1673          * abort the asoc, since someone probably just hijacked us...
1674          */
1675         if (serial_num == (asoc->asconf_seq_out + 1)) {
1676                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1677                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1678                 *abort_no_unlock = 1;
1679                 return;
1680         }
1681         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1682                 /* got a duplicate/unexpected ASCONF-ACK */
1683                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1684                     serial_num, asoc->asconf_seq_out_acked + 1);
1685                 return;
1686         }
1687         if (serial_num == asoc->asconf_seq_out - 1) {
1688                 /* stop our timer */
1689                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1690                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1691         }
1692         /* process the ASCONF-ACK contents */
1693         ack_length = ntohs(cp->ch.chunk_length) -
1694             sizeof(struct sctp_asconf_ack_chunk);
1695         offset += sizeof(struct sctp_asconf_ack_chunk);
1696         /* process through all parameters */
1697         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1698                 unsigned int param_length, param_type;
1699
1700                 /* get pointer to next asconf parameter */
1701                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1702                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1703                 if (aph == NULL) {
1704                         /* can't get an asconf paramhdr */
1705                         sctp_asconf_ack_clear(stcb);
1706                         return;
1707                 }
1708                 param_type = ntohs(aph->ph.param_type);
1709                 param_length = ntohs(aph->ph.param_length);
1710                 if (param_length > ack_length) {
1711                         sctp_asconf_ack_clear(stcb);
1712                         return;
1713                 }
1714                 if (param_length < sizeof(struct sctp_paramhdr)) {
1715                         sctp_asconf_ack_clear(stcb);
1716                         return;
1717                 }
1718                 /* get the complete parameter... */
1719                 if (param_length > sizeof(aparam_buf)) {
1720                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1721                             "param length (%u) larger than buffer size!\n", param_length);
1722                         sctp_asconf_ack_clear(stcb);
1723                         return;
1724                 }
1725                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1726                 if (aph == NULL) {
1727                         sctp_asconf_ack_clear(stcb);
1728                         return;
1729                 }
1730                 /* correlation_id is transparent to peer, no ntohl needed */
1731                 id = aph->correlation_id;
1732
1733                 switch (param_type) {
1734                 case SCTP_ERROR_CAUSE_IND:
1735                         last_error_id = id;
1736                         /* find the corresponding asconf param in our queue */
1737                         ap = sctp_asconf_find_param(stcb, id);
1738                         if (ap == NULL) {
1739                                 /* hmm... can't find this in our queue! */
1740                                 break;
1741                         }
1742                         /* process the parameter, failed flag */
1743                         sctp_asconf_process_param_ack(stcb, ap, 0);
1744                         /* process the error response */
1745                         sctp_asconf_process_error(stcb, aph);
1746                         break;
1747                 case SCTP_SUCCESS_REPORT:
1748                         /* find the corresponding asconf param in our queue */
1749                         ap = sctp_asconf_find_param(stcb, id);
1750                         if (ap == NULL) {
1751                                 /* hmm... can't find this in our queue! */
1752                                 break;
1753                         }
1754                         /* process the parameter, success flag */
1755                         sctp_asconf_process_param_ack(stcb, ap, 1);
1756                         break;
1757                 default:
1758                         break;
1759                 }               /* switch */
1760
1761                 /* update remaining ASCONF-ACK message length to process */
1762                 ack_length -= SCTP_SIZE32(param_length);
1763                 if (ack_length <= 0) {
1764                         /* no more data in the mbuf chain */
1765                         break;
1766                 }
1767                 offset += SCTP_SIZE32(param_length);
1768         }                       /* while */
1769
1770         /*
1771          * if there are any "sent" params still on the queue, these are
1772          * implicitly "success", or "failed" (if we got an error back) ...
1773          * so process these appropriately
1774          *
1775          * we assume that the correlation_id's are monotonically increasing
1776          * beginning from 1 and that we don't have *that* many outstanding
1777          * at any given time
1778          */
1779         if (last_error_id == 0)
1780                 last_error_id--;/* set to "max" value */
1781         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1782                 if (aa->sent == 1) {
1783                         /*
1784                          * implicitly successful or failed if correlation_id
1785                          * < last_error_id, then success else, failure
1786                          */
1787                         if (aa->ap.aph.correlation_id < last_error_id)
1788                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1789                         else
1790                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1791                 } else {
1792                         /*
1793                          * since we always process in order (FIFO queue) if
1794                          * we reach one that hasn't been sent, the rest
1795                          * should not have been sent either. so, we're
1796                          * done...
1797                          */
1798                         break;
1799                 }
1800         }
1801
1802         /* update the next sequence number to use */
1803         asoc->asconf_seq_out_acked++;
1804         /* remove the old ASCONF on our outbound queue */
1805         sctp_toss_old_asconf(stcb);
1806         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1807 #ifdef SCTP_TIMER_BASED_ASCONF
1808                 /* we have more params, so restart our timer */
1809                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1810                     stcb, net);
1811 #else
1812                 /* we have more params, so send out more */
1813                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1814 #endif
1815         }
1816 }
1817
1818 #ifdef INET6
1819 static uint32_t
1820 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1821 {
1822         struct sockaddr_in6 *sin6, *net6;
1823         struct sctp_nets *net;
1824
1825         if (sa->sa_family != AF_INET6) {
1826                 /* wrong family */
1827                 return (0);
1828         }
1829         sin6 = (struct sockaddr_in6 *)sa;
1830         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1831                 /* not link local address */
1832                 return (0);
1833         }
1834         /* hunt through our destination nets list for this scope_id */
1835         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1836                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1837                     AF_INET6)
1838                         continue;
1839                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1840                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1841                         continue;
1842                 if (sctp_is_same_scope(sin6, net6)) {
1843                         /* found one */
1844                         return (1);
1845                 }
1846         }
1847         /* didn't find one */
1848         return (0);
1849 }
1850
1851 #endif
1852
1853 /*
1854  * address management functions
1855  */
1856 static void
1857 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1858     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1859 {
1860         int status;
1861
1862         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1863             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1864                 /* subset bound, no ASCONF allowed case, so ignore */
1865                 return;
1866         }
1867         /*
1868          * note: we know this is not the subset bound, no ASCONF case eg.
1869          * this is boundall or subset bound w/ASCONF allowed
1870          */
1871
1872         /* first, make sure it's a good address family */
1873         switch (ifa->address.sa.sa_family) {
1874 #ifdef INET6
1875         case AF_INET6:
1876                 break;
1877 #endif
1878 #ifdef INET
1879         case AF_INET:
1880                 break;
1881 #endif
1882         default:
1883                 return;
1884         }
1885 #ifdef INET6
1886         /* make sure we're "allowed" to add this type of addr */
1887         if (ifa->address.sa.sa_family == AF_INET6) {
1888                 /* invalid if we're not a v6 endpoint */
1889                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1890                         return;
1891                 /* is the v6 addr really valid ? */
1892                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1893                         return;
1894                 }
1895         }
1896 #endif
1897         /* put this address on the "pending/do not use yet" list */
1898         sctp_add_local_addr_restricted(stcb, ifa);
1899         /*
1900          * check address scope if address is out of scope, don't queue
1901          * anything... note: this would leave the address on both inp and
1902          * asoc lists
1903          */
1904         switch (ifa->address.sa.sa_family) {
1905 #ifdef INET6
1906         case AF_INET6:
1907                 {
1908                         struct sockaddr_in6 *sin6;
1909
1910                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1911                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1912                                 /* we skip unspecifed addresses */
1913                                 return;
1914                         }
1915                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1916                                 if (stcb->asoc.scope.local_scope == 0) {
1917                                         return;
1918                                 }
1919                                 /* is it the right link local scope? */
1920                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1921                                         return;
1922                                 }
1923                         }
1924                         if (stcb->asoc.scope.site_scope == 0 &&
1925                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1926                                 return;
1927                         }
1928                         break;
1929                 }
1930 #endif
1931 #ifdef INET
1932         case AF_INET:
1933                 {
1934                         struct sockaddr_in *sin;
1935                         struct in6pcb *inp6;
1936
1937                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1938                         /* invalid if we are a v6 only endpoint */
1939                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1940                             SCTP_IPV6_V6ONLY(inp6))
1941                                 return;
1942
1943                         sin = (struct sockaddr_in *)&ifa->address.sa;
1944                         if (sin->sin_addr.s_addr == 0) {
1945                                 /* we skip unspecifed addresses */
1946                                 return;
1947                         }
1948                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1949                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1950                                 return;
1951                         }
1952                         break;
1953                 }
1954 #endif
1955         default:
1956                 /* else, not AF_INET or AF_INET6, so skip */
1957                 return;
1958         }
1959
1960         /* queue an asconf for this address add/delete */
1961         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1962                 /* does the peer do asconf? */
1963                 if (stcb->asoc.peer_supports_asconf) {
1964                         /* queue an asconf for this addr */
1965                         status = sctp_asconf_queue_add(stcb, ifa, type);
1966
1967                         /*
1968                          * if queued ok, and in the open state, send out the
1969                          * ASCONF.  If in the non-open state, these will be
1970                          * sent when the state goes open.
1971                          */
1972                         if (status == 0 &&
1973                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1974 #ifdef SCTP_TIMER_BASED_ASCONF
1975                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1976                                     stcb, stcb->asoc.primary_destination);
1977 #else
1978                                 sctp_send_asconf(stcb, NULL, addr_locked);
1979 #endif
1980                         }
1981                 }
1982         }
1983 }
1984
1985
1986 int
1987 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1988 {
1989         struct sctp_asconf_iterator *asc;
1990         struct sctp_ifa *ifa;
1991         struct sctp_laddr *l;
1992         int cnt_invalid = 0;
1993
1994         asc = (struct sctp_asconf_iterator *)ptr;
1995         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
1996                 ifa = l->ifa;
1997                 switch (ifa->address.sa.sa_family) {
1998 #ifdef INET6
1999                 case AF_INET6:
2000                         /* invalid if we're not a v6 endpoint */
2001                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2002                                 cnt_invalid++;
2003                                 if (asc->cnt == cnt_invalid)
2004                                         return (1);
2005                         }
2006                         break;
2007 #endif
2008 #ifdef INET
2009                 case AF_INET:
2010                         {
2011                                 /* invalid if we are a v6 only endpoint */
2012                                 struct in6pcb *inp6;
2013
2014                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2015                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2016                                     SCTP_IPV6_V6ONLY(inp6)) {
2017                                         cnt_invalid++;
2018                                         if (asc->cnt == cnt_invalid)
2019                                                 return (1);
2020                                 }
2021                                 break;
2022                         }
2023 #endif
2024                 default:
2025                         /* invalid address family */
2026                         cnt_invalid++;
2027                         if (asc->cnt == cnt_invalid)
2028                                 return (1);
2029                 }
2030         }
2031         return (0);
2032 }
2033
2034 static int
2035 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2036 {
2037         struct sctp_ifa *ifa;
2038         struct sctp_asconf_iterator *asc;
2039         struct sctp_laddr *laddr, *nladdr, *l;
2040
2041         /* Only for specific case not bound all */
2042         asc = (struct sctp_asconf_iterator *)ptr;
2043         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2044                 ifa = l->ifa;
2045                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2046                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2047                             sctp_nxt_addr) {
2048                                 if (laddr->ifa == ifa) {
2049                                         laddr->action = 0;
2050                                         break;
2051                                 }
2052                         }
2053                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2054                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2055                                 /* remove only after all guys are done */
2056                                 if (laddr->ifa == ifa) {
2057                                         sctp_del_local_addr_ep(inp, ifa);
2058                                 }
2059                         }
2060                 }
2061         }
2062         return (0);
2063 }
2064
2065 void
2066 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2067     void *ptr, uint32_t val SCTP_UNUSED)
2068 {
2069         struct sctp_asconf_iterator *asc;
2070         struct sctp_ifa *ifa;
2071         struct sctp_laddr *l;
2072         int cnt_invalid = 0;
2073         int type, status;
2074         int num_queued = 0;
2075
2076         asc = (struct sctp_asconf_iterator *)ptr;
2077         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2078                 ifa = l->ifa;
2079                 type = l->action;
2080
2081                 /* address's vrf_id must be the vrf_id of the assoc */
2082                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2083                         continue;
2084                 }
2085                 /* Same checks again for assoc */
2086                 switch (ifa->address.sa.sa_family) {
2087 #ifdef INET6
2088                 case AF_INET6:
2089                         {
2090                                 /* invalid if we're not a v6 endpoint */
2091                                 struct sockaddr_in6 *sin6;
2092
2093                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2094                                         cnt_invalid++;
2095                                         if (asc->cnt == cnt_invalid)
2096                                                 return;
2097                                         else
2098                                                 continue;
2099                                 }
2100                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2101                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2102                                         /* we skip unspecifed addresses */
2103                                         continue;
2104                                 }
2105                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2106                                         if (stcb->asoc.scope.local_scope == 0) {
2107                                                 continue;
2108                                         }
2109                                         /* is it the right link local scope? */
2110                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2111                                                 continue;
2112                                         }
2113                                 }
2114                                 break;
2115                         }
2116 #endif
2117 #ifdef INET
2118                 case AF_INET:
2119                         {
2120                                 /* invalid if we are a v6 only endpoint */
2121                                 struct in6pcb *inp6;
2122                                 struct sockaddr_in *sin;
2123
2124                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2125                                 /* invalid if we are a v6 only endpoint */
2126                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2127                                     SCTP_IPV6_V6ONLY(inp6))
2128                                         continue;
2129
2130                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2131                                 if (sin->sin_addr.s_addr == 0) {
2132                                         /* we skip unspecifed addresses */
2133                                         continue;
2134                                 }
2135                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2136                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2137                                         continue;
2138                                 }
2139                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2140                                     SCTP_IPV6_V6ONLY(inp6)) {
2141                                         cnt_invalid++;
2142                                         if (asc->cnt == cnt_invalid)
2143                                                 return;
2144                                         else
2145                                                 continue;
2146                                 }
2147                                 break;
2148                         }
2149 #endif
2150                 default:
2151                         /* invalid address family */
2152                         cnt_invalid++;
2153                         if (asc->cnt == cnt_invalid)
2154                                 return;
2155                         else
2156                                 continue;
2157                         break;
2158                 }
2159
2160                 if (type == SCTP_ADD_IP_ADDRESS) {
2161                         /* prevent this address from being used as a source */
2162                         sctp_add_local_addr_restricted(stcb, ifa);
2163                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2164                         struct sctp_nets *net;
2165
2166                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2167                                 sctp_rtentry_t *rt;
2168
2169                                 /* delete this address if cached */
2170                                 if (net->ro._s_addr == ifa) {
2171                                         sctp_free_ifa(net->ro._s_addr);
2172                                         net->ro._s_addr = NULL;
2173                                         net->src_addr_selected = 0;
2174                                         rt = net->ro.ro_rt;
2175                                         if (rt) {
2176                                                 RTFREE(rt);
2177                                                 net->ro.ro_rt = NULL;
2178                                         }
2179                                         /*
2180                                          * Now we deleted our src address,
2181                                          * should we not also now reset the
2182                                          * cwnd/rto to start as if its a new
2183                                          * address?
2184                                          */
2185                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2186                                         net->RTO = 0;
2187
2188                                 }
2189                         }
2190                 } else if (type == SCTP_SET_PRIM_ADDR) {
2191                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2192                                 /* must validate the ifa is in the ep */
2193                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2194                                         continue;
2195                                 }
2196                         } else {
2197                                 /* Need to check scopes for this guy */
2198                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2199                                         continue;
2200                                 }
2201                         }
2202                 }
2203                 /* queue an asconf for this address add/delete */
2204                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2205                     stcb->asoc.peer_supports_asconf) {
2206                         /* queue an asconf for this addr */
2207                         status = sctp_asconf_queue_add(stcb, ifa, type);
2208                         /*
2209                          * if queued ok, and in the open state, update the
2210                          * count of queued params.  If in the non-open
2211                          * state, these get sent when the assoc goes open.
2212                          */
2213                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2214                                 if (status >= 0) {
2215                                         num_queued++;
2216                                 }
2217                         }
2218                 }
2219         }
2220         /*
2221          * If we have queued params in the open state, send out an ASCONF.
2222          */
2223         if (num_queued > 0) {
2224                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2225         }
2226 }
2227
2228 void
2229 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2230 {
2231         struct sctp_asconf_iterator *asc;
2232         struct sctp_ifa *ifa;
2233         struct sctp_laddr *l, *nl;
2234
2235         asc = (struct sctp_asconf_iterator *)ptr;
2236         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2237                 ifa = l->ifa;
2238                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2239                         /* Clear the defer use flag */
2240                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2241                 }
2242                 sctp_free_ifa(ifa);
2243                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2244                 SCTP_DECR_LADDR_COUNT();
2245         }
2246         SCTP_FREE(asc, SCTP_M_ASC_IT);
2247 }
2248
2249 /*
2250  * sa is the sockaddr to ask the peer to set primary to.
2251  * returns: 0 = completed, -1 = error
2252  */
2253 int32_t
2254 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2255 {
2256         uint32_t vrf_id;
2257         struct sctp_ifa *ifa;
2258
2259         /* find the ifa for the desired set primary */
2260         vrf_id = stcb->asoc.vrf_id;
2261         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2262         if (ifa == NULL) {
2263                 /* Invalid address */
2264                 return (-1);
2265         }
2266         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2267         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2268                 /* set primary queuing succeeded */
2269                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2270                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2271                     (void *)stcb);
2272                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2273                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2274 #ifdef SCTP_TIMER_BASED_ASCONF
2275                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2276                             stcb->sctp_ep, stcb,
2277                             stcb->asoc.primary_destination);
2278 #else
2279                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2280 #endif
2281                 }
2282         } else {
2283                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2284                     (void *)stcb);
2285                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2286                 return (-1);
2287         }
2288         return (0);
2289 }
2290
2291 void
2292 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2293 {
2294         struct sctp_inpcb *inp;
2295
2296         /* go through all our PCB's */
2297         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2298                 struct sctp_tcb *stcb;
2299
2300                 /* process for all associations for this endpoint */
2301                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2302                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2303                         if (!sctp_asconf_queue_add(stcb, ifa,
2304                             SCTP_SET_PRIM_ADDR)) {
2305                                 /* set primary queuing succeeded */
2306                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2307                                     (void *)stcb);
2308                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2309                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2310 #ifdef SCTP_TIMER_BASED_ASCONF
2311                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2312                                             stcb->sctp_ep, stcb,
2313                                             stcb->asoc.primary_destination);
2314 #else
2315                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2316 #endif
2317                                 }
2318                         }
2319                 }               /* for each stcb */
2320         }                       /* for each inp */
2321 }
2322
2323 int
2324 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2325 {
2326         struct sctp_tmit_chunk *chk, *nchk;
2327         unsigned int offset, asconf_limit;
2328         struct sctp_asconf_chunk *acp;
2329         struct sctp_asconf_paramhdr *aph;
2330         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2331         struct sctp_paramhdr *ph;
2332         int add_cnt, del_cnt;
2333         uint16_t last_param_type;
2334
2335         add_cnt = del_cnt = 0;
2336         last_param_type = 0;
2337         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2338                 if (chk->data == NULL) {
2339                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2340                         continue;
2341                 }
2342                 offset = 0;
2343                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2344                 offset += sizeof(struct sctp_asconf_chunk);
2345                 asconf_limit = ntohs(acp->ch.chunk_length);
2346                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2347                 if (ph == NULL) {
2348                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2349                         continue;
2350                 }
2351                 offset += ntohs(ph->param_length);
2352
2353                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2354                 if (aph == NULL) {
2355                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2356                         continue;
2357                 }
2358                 while (aph != NULL) {
2359                         unsigned int param_length, param_type;
2360
2361                         param_type = ntohs(aph->ph.param_type);
2362                         param_length = ntohs(aph->ph.param_length);
2363                         if (offset + param_length > asconf_limit) {
2364                                 /* parameter goes beyond end of chunk! */
2365                                 break;
2366                         }
2367                         if (param_length > sizeof(aparam_buf)) {
2368                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2369                                 break;
2370                         }
2371                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2372                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2373                                 break;
2374                         }
2375                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2376                         if (aph == NULL) {
2377                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2378                                 break;
2379                         }
2380                         ph = (struct sctp_paramhdr *)(aph + 1);
2381                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2382                                 switch (param_type) {
2383                                 case SCTP_ADD_IP_ADDRESS:
2384                                         add_cnt++;
2385                                         break;
2386                                 case SCTP_DEL_IP_ADDRESS:
2387                                         del_cnt++;
2388                                         break;
2389                                 default:
2390                                         break;
2391                                 }
2392                                 last_param_type = param_type;
2393                         }
2394                         offset += SCTP_SIZE32(param_length);
2395                         if (offset >= asconf_limit) {
2396                                 /* no more data in the mbuf chain */
2397                                 break;
2398                         }
2399                         /* get pointer to next asconf param */
2400                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2401                 }
2402         }
2403
2404         /*
2405          * we want to find the sequences which consist of ADD -> DEL -> ADD
2406          * or DEL -> ADD
2407          */
2408         if (add_cnt > del_cnt ||
2409             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2410                 return (1);
2411         }
2412         return (0);
2413 }
2414
2415 static struct sockaddr *
2416 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2417 {
2418         struct sctp_vrf *vrf = NULL;
2419         struct sctp_ifn *sctp_ifn;
2420         struct sctp_ifa *sctp_ifa;
2421
2422         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2423                 SCTP_IPI_ADDR_RLOCK();
2424         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2425         if (vrf == NULL) {
2426                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2427                         SCTP_IPI_ADDR_RUNLOCK();
2428                 return (NULL);
2429         }
2430         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2431                 if (stcb->asoc.scope.loopback_scope == 0 &&
2432                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2433                         /* Skip if loopback_scope not set */
2434                         continue;
2435                 }
2436                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2437                         switch (sctp_ifa->address.sa.sa_family) {
2438 #ifdef INET
2439                         case AF_INET:
2440                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2441                                         struct sockaddr_in *sin;
2442
2443                                         sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2444                                         if (sin->sin_addr.s_addr == 0) {
2445                                                 /* skip unspecifed addresses */
2446                                                 continue;
2447                                         }
2448                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2449                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2450                                                 continue;
2451
2452                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2453                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2454                                                 continue;
2455                                         /*
2456                                          * found a valid local v4 address to
2457                                          * use
2458                                          */
2459                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2460                                                 SCTP_IPI_ADDR_RUNLOCK();
2461                                         return (&sctp_ifa->address.sa);
2462                                 }
2463                                 break;
2464 #endif
2465 #ifdef INET6
2466                         case AF_INET6:
2467                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2468                                         struct sockaddr_in6 *sin6;
2469
2470                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2471                                                 continue;
2472                                         }
2473                                         sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2474                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2475                                                 /*
2476                                                  * we skip unspecifed
2477                                                  * addresses
2478                                                  */
2479                                                 continue;
2480                                         }
2481                                         if (stcb->asoc.scope.local_scope == 0 &&
2482                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2483                                                 continue;
2484                                         if (stcb->asoc.scope.site_scope == 0 &&
2485                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2486                                                 continue;
2487
2488                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2489                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2490                                                 continue;
2491                                         /*
2492                                          * found a valid local v6 address to
2493                                          * use
2494                                          */
2495                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2496                                                 SCTP_IPI_ADDR_RUNLOCK();
2497                                         return (&sctp_ifa->address.sa);
2498                                 }
2499                                 break;
2500 #endif
2501                         default:
2502                                 break;
2503                         }
2504                 }
2505         }
2506         /* no valid addresses found */
2507         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2508                 SCTP_IPI_ADDR_RUNLOCK();
2509         return (NULL);
2510 }
2511
2512 static struct sockaddr *
2513 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2514 {
2515         struct sctp_laddr *laddr;
2516
2517         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2518                 if (laddr->ifa == NULL) {
2519                         continue;
2520                 }
2521                 /* is the address restricted ? */
2522                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2523                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2524                         continue;
2525
2526                 /* found a valid local address to use */
2527                 return (&laddr->ifa->address.sa);
2528         }
2529         /* no valid addresses found */
2530         return (NULL);
2531 }
2532
2533 /*
2534  * builds an ASCONF chunk from queued ASCONF params.
2535  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2536  */
2537 struct mbuf *
2538 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2539 {
2540         struct mbuf *m_asconf, *m_asconf_chk;
2541         struct sctp_asconf_addr *aa;
2542         struct sctp_asconf_chunk *acp;
2543         struct sctp_asconf_paramhdr *aph;
2544         struct sctp_asconf_addr_param *aap;
2545         uint32_t p_length;
2546         uint32_t correlation_id = 1;    /* 0 is reserved... */
2547         caddr_t ptr, lookup_ptr;
2548         uint8_t lookup_used = 0;
2549
2550         /* are there any asconf params to send? */
2551         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2552                 if (aa->sent == 0)
2553                         break;
2554         }
2555         if (aa == NULL)
2556                 return (NULL);
2557
2558         /*
2559          * get a chunk header mbuf and a cluster for the asconf params since
2560          * it's simpler to fill in the asconf chunk header lookup address on
2561          * the fly
2562          */
2563         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2564         if (m_asconf_chk == NULL) {
2565                 /* no mbuf's */
2566                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2567                     "compose_asconf: couldn't get chunk mbuf!\n");
2568                 return (NULL);
2569         }
2570         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2571         if (m_asconf == NULL) {
2572                 /* no mbuf's */
2573                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2574                     "compose_asconf: couldn't get mbuf!\n");
2575                 sctp_m_freem(m_asconf_chk);
2576                 return (NULL);
2577         }
2578         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2579         SCTP_BUF_LEN(m_asconf) = 0;
2580         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2581         bzero(acp, sizeof(struct sctp_asconf_chunk));
2582         /* save pointers to lookup address and asconf params */
2583         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2584         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2585
2586         /* fill in chunk header info */
2587         acp->ch.chunk_type = SCTP_ASCONF;
2588         acp->ch.chunk_flags = 0;
2589         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2590         stcb->asoc.asconf_seq_out++;
2591
2592         /* add parameters... up to smallest MTU allowed */
2593         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2594                 if (aa->sent)
2595                         continue;
2596                 /* get the parameter length */
2597                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2598                 /* will it fit in current chunk? */
2599                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2600                         /* won't fit, so we're done with this chunk */
2601                         break;
2602                 }
2603                 /* assign (and store) a correlation id */
2604                 aa->ap.aph.correlation_id = correlation_id++;
2605
2606                 /*
2607                  * fill in address if we're doing a delete this is a simple
2608                  * way for us to fill in the correlation address, which
2609                  * should only be used by the peer if we're deleting our
2610                  * source address and adding a new address (e.g. renumbering
2611                  * case)
2612                  */
2613                 if (lookup_used == 0 &&
2614                     (aa->special_del == 0) &&
2615                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2616                         struct sctp_ipv6addr_param *lookup;
2617                         uint16_t p_size, addr_size;
2618
2619                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2620                         lookup->ph.param_type =
2621                             htons(aa->ap.addrp.ph.param_type);
2622                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2623                                 /* copy IPv6 address */
2624                                 p_size = sizeof(struct sctp_ipv6addr_param);
2625                                 addr_size = sizeof(struct in6_addr);
2626                         } else {
2627                                 /* copy IPv4 address */
2628                                 p_size = sizeof(struct sctp_ipv4addr_param);
2629                                 addr_size = sizeof(struct in_addr);
2630                         }
2631                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2632                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2633                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2634                         lookup_used = 1;
2635                 }
2636                 /* copy into current space */
2637                 memcpy(ptr, &aa->ap, p_length);
2638
2639                 /* network elements and update lengths */
2640                 aph = (struct sctp_asconf_paramhdr *)ptr;
2641                 aap = (struct sctp_asconf_addr_param *)ptr;
2642                 /* correlation_id is transparent to peer, no htonl needed */
2643                 aph->ph.param_type = htons(aph->ph.param_type);
2644                 aph->ph.param_length = htons(aph->ph.param_length);
2645                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2646                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2647
2648                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2649                 ptr += SCTP_SIZE32(p_length);
2650
2651                 /*
2652                  * these params are removed off the pending list upon
2653                  * getting an ASCONF-ACK back from the peer, just set flag
2654                  */
2655                 aa->sent = 1;
2656         }
2657         /* check to see if the lookup addr has been populated yet */
2658         if (lookup_used == 0) {
2659                 /* NOTE: if the address param is optional, can skip this... */
2660                 /* add any valid (existing) address... */
2661                 struct sctp_ipv6addr_param *lookup;
2662                 uint16_t p_size, addr_size;
2663                 struct sockaddr *found_addr;
2664                 caddr_t addr_ptr;
2665
2666                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2667                         found_addr = sctp_find_valid_localaddr(stcb,
2668                             addr_locked);
2669                 else
2670                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2671
2672                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2673                 if (found_addr != NULL) {
2674                         switch (found_addr->sa_family) {
2675 #ifdef INET6
2676                         case AF_INET6:
2677                                 /* copy IPv6 address */
2678                                 lookup->ph.param_type =
2679                                     htons(SCTP_IPV6_ADDRESS);
2680                                 p_size = sizeof(struct sctp_ipv6addr_param);
2681                                 addr_size = sizeof(struct in6_addr);
2682                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2683                                     found_addr)->sin6_addr;
2684                                 break;
2685 #endif
2686 #ifdef INET
2687                         case AF_INET:
2688                                 /* copy IPv4 address */
2689                                 lookup->ph.param_type =
2690                                     htons(SCTP_IPV4_ADDRESS);
2691                                 p_size = sizeof(struct sctp_ipv4addr_param);
2692                                 addr_size = sizeof(struct in_addr);
2693                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2694                                     found_addr)->sin_addr;
2695                                 break;
2696 #endif
2697                         default:
2698                                 p_size = 0;
2699                                 addr_size = 0;
2700                                 addr_ptr = NULL;
2701                                 break;
2702                         }
2703                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2704                         memcpy(lookup->addr, addr_ptr, addr_size);
2705                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2706                 } else {
2707                         /* uh oh... don't have any address?? */
2708                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2709                             "compose_asconf: no lookup addr!\n");
2710                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2711                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2712                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2713                         bzero(lookup->addr, sizeof(struct in_addr));
2714                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2715                 }
2716         }
2717         /* chain it all together */
2718         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2719         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2720         acp->ch.chunk_length = ntohs(*retlen);
2721
2722         return (m_asconf_chk);
2723 }
2724
2725 /*
2726  * section to handle address changes before an association is up eg. changes
2727  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2728  */
2729
2730 /*
2731  * processes the (local) addresses in the INIT-ACK chunk
2732  */
2733 static void
2734 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2735     unsigned int offset, unsigned int length)
2736 {
2737         struct sctp_paramhdr tmp_param, *ph;
2738         uint16_t plen, ptype;
2739         struct sctp_ifa *sctp_ifa;
2740
2741 #ifdef INET6
2742         struct sctp_ipv6addr_param addr6_store;
2743         struct sockaddr_in6 sin6;
2744
2745 #endif
2746 #ifdef INET
2747         struct sctp_ipv4addr_param addr4_store;
2748         struct sockaddr_in sin;
2749
2750 #endif
2751         struct sockaddr *sa;
2752         uint32_t vrf_id;
2753
2754         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2755         if (stcb == NULL)       /* Un-needed check for SA */
2756                 return;
2757
2758         /* convert to upper bound */
2759         length += offset;
2760
2761         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2762                 return;
2763         }
2764         /* init the addresses */
2765 #ifdef INET6
2766         bzero(&sin6, sizeof(sin6));
2767         sin6.sin6_family = AF_INET6;
2768         sin6.sin6_len = sizeof(sin6);
2769         sin6.sin6_port = stcb->rport;
2770 #endif
2771
2772 #ifdef INET
2773         bzero(&sin, sizeof(sin));
2774         sin.sin_family = AF_INET;
2775         sin.sin_len = sizeof(sin);
2776         sin.sin_port = stcb->rport;
2777 #endif
2778
2779         /* go through the addresses in the init-ack */
2780         ph = (struct sctp_paramhdr *)
2781             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2782             (uint8_t *) & tmp_param);
2783         while (ph != NULL) {
2784                 ptype = ntohs(ph->param_type);
2785                 plen = ntohs(ph->param_length);
2786                 switch (ptype) {
2787 #ifdef INET6
2788                 case SCTP_IPV6_ADDRESS:
2789                         {
2790                                 struct sctp_ipv6addr_param *a6p;
2791
2792                                 /* get the entire IPv6 address param */
2793                                 a6p = (struct sctp_ipv6addr_param *)
2794                                     sctp_m_getptr(m, offset,
2795                                     sizeof(struct sctp_ipv6addr_param),
2796                                     (uint8_t *) & addr6_store);
2797                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2798                                     a6p == NULL) {
2799                                         return;
2800                                 }
2801                                 memcpy(&sin6.sin6_addr, a6p->addr,
2802                                     sizeof(struct in6_addr));
2803                                 sa = (struct sockaddr *)&sin6;
2804                                 break;
2805                         }
2806 #endif
2807 #ifdef INET
2808                 case SCTP_IPV4_ADDRESS:
2809                         {
2810                                 struct sctp_ipv4addr_param *a4p;
2811
2812                                 /* get the entire IPv4 address param */
2813                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2814                                     sizeof(struct sctp_ipv4addr_param),
2815                                     (uint8_t *) & addr4_store);
2816                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2817                                     a4p == NULL) {
2818                                         return;
2819                                 }
2820                                 sin.sin_addr.s_addr = a4p->addr;
2821                                 sa = (struct sockaddr *)&sin;
2822                                 break;
2823                         }
2824 #endif
2825                 default:
2826                         goto next_addr;
2827                 }
2828
2829                 /* see if this address really (still) exists */
2830                 if (stcb) {
2831                         vrf_id = stcb->asoc.vrf_id;
2832                 } else {
2833                         vrf_id = SCTP_DEFAULT_VRFID;
2834                 }
2835                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2836                     SCTP_ADDR_NOT_LOCKED);
2837                 if (sctp_ifa == NULL) {
2838                         /* address doesn't exist anymore */
2839                         int status;
2840
2841                         /* are ASCONFs allowed ? */
2842                         if ((sctp_is_feature_on(stcb->sctp_ep,
2843                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2844                             stcb->asoc.peer_supports_asconf) {
2845                                 /* queue an ASCONF DEL_IP_ADDRESS */
2846                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2847                                 /*
2848                                  * if queued ok, and in correct state, send
2849                                  * out the ASCONF.
2850                                  */
2851                                 if (status == 0 &&
2852                                     SCTP_GET_STATE(&stcb->asoc) ==
2853                                     SCTP_STATE_OPEN) {
2854 #ifdef SCTP_TIMER_BASED_ASCONF
2855                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2856                                             stcb->sctp_ep, stcb,
2857                                             stcb->asoc.primary_destination);
2858 #else
2859                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2860 #endif
2861                                 }
2862                         }
2863                 }
2864 next_addr:
2865                 /*
2866                  * Sanity check:  Make sure the length isn't 0, otherwise
2867                  * we'll be stuck in this loop for a long time...
2868                  */
2869                 if (SCTP_SIZE32(plen) == 0) {
2870                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2871                             plen, ptype);
2872                         return;
2873                 }
2874                 /* get next parameter */
2875                 offset += SCTP_SIZE32(plen);
2876                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2877                         return;
2878                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2879                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2880         }                       /* while */
2881 }
2882
2883 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2884 /*
2885  * checks to see if a specific address is in the initack address list returns
2886  * 1 if found, 0 if not
2887  */
2888 static uint32_t
2889 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2890 {
2891         struct sctp_paramhdr tmp_param, *ph;
2892         uint16_t plen, ptype;
2893
2894 #ifdef INET
2895         struct sockaddr_in *sin;
2896         struct sctp_ipv4addr_param *a4p;
2897         struct sctp_ipv6addr_param addr4_store;
2898
2899 #endif
2900 #ifdef INET6
2901         struct sockaddr_in6 *sin6;
2902         struct sctp_ipv6addr_param *a6p;
2903         struct sctp_ipv6addr_param addr6_store;
2904         struct sockaddr_in6 sin6_tmp;
2905
2906 #endif
2907
2908         switch (sa->sa_family) {
2909 #ifdef INET
2910         case AF_INET:
2911                 break;
2912 #endif
2913 #ifdef INET6
2914         case AF_INET6:
2915                 break;
2916 #endif
2917         default:
2918                 return (0);
2919         }
2920
2921         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2922         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2923         /* convert to upper bound */
2924         length += offset;
2925
2926         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2927                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2928                     "find_initack_addr: invalid offset?\n");
2929                 return (0);
2930         }
2931         /* go through the addresses in the init-ack */
2932         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2933             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2934         while (ph != NULL) {
2935                 ptype = ntohs(ph->param_type);
2936                 plen = ntohs(ph->param_length);
2937                 switch (ptype) {
2938 #ifdef INET6
2939                 case SCTP_IPV6_ADDRESS:
2940                         if (sa->sa_family == AF_INET6) {
2941                                 /* get the entire IPv6 address param */
2942                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2943                                         break;
2944                                 }
2945                                 /* get the entire IPv6 address param */
2946                                 a6p = (struct sctp_ipv6addr_param *)
2947                                     sctp_m_getptr(m, offset,
2948                                     sizeof(struct sctp_ipv6addr_param),
2949                                     (uint8_t *) & addr6_store);
2950                                 if (a6p == NULL) {
2951                                         return (0);
2952                                 }
2953                                 sin6 = (struct sockaddr_in6 *)sa;
2954                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2955                                         /* create a copy and clear scope */
2956                                         memcpy(&sin6_tmp, sin6,
2957                                             sizeof(struct sockaddr_in6));
2958                                         sin6 = &sin6_tmp;
2959                                         in6_clearscope(&sin6->sin6_addr);
2960                                 }
2961                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2962                                     sizeof(struct in6_addr)) == 0) {
2963                                         /* found it */
2964                                         return (1);
2965                                 }
2966                         }
2967                         break;
2968 #endif                          /* INET6 */
2969 #ifdef INET
2970                 case SCTP_IPV4_ADDRESS:
2971                         if (sa->sa_family == AF_INET) {
2972                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2973                                         break;
2974                                 }
2975                                 /* get the entire IPv4 address param */
2976                                 a4p = (struct sctp_ipv4addr_param *)
2977                                     sctp_m_getptr(m, offset,
2978                                     sizeof(struct sctp_ipv4addr_param),
2979                                     (uint8_t *) & addr4_store);
2980                                 if (a4p == NULL) {
2981                                         return (0);
2982                                 }
2983                                 sin = (struct sockaddr_in *)sa;
2984                                 if (sin->sin_addr.s_addr == a4p->addr) {
2985                                         /* found it */
2986                                         return (1);
2987                                 }
2988                         }
2989                         break;
2990 #endif
2991                 default:
2992                         break;
2993                 }
2994                 /* get next parameter */
2995                 offset += SCTP_SIZE32(plen);
2996                 if (offset + sizeof(struct sctp_paramhdr) > length) {
2997                         return (0);
2998                 }
2999                 ph = (struct sctp_paramhdr *)
3000                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3001                     (uint8_t *) & tmp_param);
3002         }                       /* while */
3003         /* not found! */
3004         return (0);
3005 }
3006
3007 /*
3008  * makes sure that the current endpoint local addr list is consistent with
3009  * the new association (eg. subset bound, asconf allowed) adds addresses as
3010  * necessary
3011  */
3012 static void
3013 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3014     int length, struct sockaddr *init_addr)
3015 {
3016         struct sctp_laddr *laddr;
3017
3018         /* go through the endpoint list */
3019         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3020                 /* be paranoid and validate the laddr */
3021                 if (laddr->ifa == NULL) {
3022                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3023                             "check_addr_list_ep: laddr->ifa is NULL");
3024                         continue;
3025                 }
3026                 if (laddr->ifa == NULL) {
3027                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3028                         continue;
3029                 }
3030                 /* do i have it implicitly? */
3031                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3032                         continue;
3033                 }
3034                 /* check to see if in the init-ack */
3035                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3036                         /* try to add it */
3037                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3038                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3039                 }
3040         }
3041 }
3042
3043 /*
3044  * makes sure that the current kernel address list is consistent with the new
3045  * association (with all addrs bound) adds addresses as necessary
3046  */
3047 static void
3048 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3049     int length, struct sockaddr *init_addr,
3050     uint16_t local_scope, uint16_t site_scope,
3051     uint16_t ipv4_scope, uint16_t loopback_scope)
3052 {
3053         struct sctp_vrf *vrf = NULL;
3054         struct sctp_ifn *sctp_ifn;
3055         struct sctp_ifa *sctp_ifa;
3056         uint32_t vrf_id;
3057
3058 #ifdef INET
3059         struct sockaddr_in *sin;
3060
3061 #endif
3062 #ifdef INET6
3063         struct sockaddr_in6 *sin6;
3064
3065 #endif
3066
3067         if (stcb) {
3068                 vrf_id = stcb->asoc.vrf_id;
3069         } else {
3070                 return;
3071         }
3072         SCTP_IPI_ADDR_RLOCK();
3073         vrf = sctp_find_vrf(vrf_id);
3074         if (vrf == NULL) {
3075                 SCTP_IPI_ADDR_RUNLOCK();
3076                 return;
3077         }
3078         /* go through all our known interfaces */
3079         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3080                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3081                         /* skip loopback interface */
3082                         continue;
3083                 }
3084                 /* go through each interface address */
3085                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3086                         /* do i have it implicitly? */
3087                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3088                                 continue;
3089                         }
3090                         switch (sctp_ifa->address.sa.sa_family) {
3091 #ifdef INET
3092                         case AF_INET:
3093                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sin;
3094                                 if ((ipv4_scope == 0) &&
3095                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3096                                         /* private address not in scope */
3097                                         continue;
3098                                 }
3099                                 break;
3100 #endif
3101 #ifdef INET6
3102                         case AF_INET6:
3103                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sin6;
3104                                 if ((local_scope == 0) &&
3105                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3106                                         continue;
3107                                 }
3108                                 if ((site_scope == 0) &&
3109                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3110                                         continue;
3111                                 }
3112                                 break;
3113 #endif
3114                         default:
3115                                 break;
3116                         }
3117                         /* check to see if in the init-ack */
3118                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3119                                 /* try to add it */
3120                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3121                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3122                                     SCTP_ADDR_LOCKED);
3123                         }
3124                 }               /* end foreach ifa */
3125         }                       /* end foreach ifn */
3126         SCTP_IPI_ADDR_RUNLOCK();
3127 }
3128
3129 /*
3130  * validates an init-ack chunk (from a cookie-echo) with current addresses
3131  * adds addresses from the init-ack into our local address list, if needed
3132  * queues asconf adds/deletes addresses as needed and makes appropriate list
3133  * changes for source address selection m, offset: points to the start of the
3134  * address list in an init-ack chunk length: total length of the address
3135  * params only init_addr: address where my INIT-ACK was sent from
3136  */
3137 void
3138 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3139     int length, struct sockaddr *init_addr,
3140     uint16_t local_scope, uint16_t site_scope,
3141     uint16_t ipv4_scope, uint16_t loopback_scope)
3142 {
3143         /* process the local addresses in the initack */
3144         sctp_process_initack_addresses(stcb, m, offset, length);
3145
3146         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3147                 /* bound all case */
3148                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3149                     local_scope, site_scope, ipv4_scope, loopback_scope);
3150         } else {
3151                 /* subset bound case */
3152                 if (sctp_is_feature_on(stcb->sctp_ep,
3153                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3154                         /* asconf's allowed */
3155                         sctp_check_address_list_ep(stcb, m, offset, length,
3156                             init_addr);
3157                 }
3158                 /* else, no asconfs allowed, so what we sent is what we get */
3159         }
3160 }
3161
3162 /*
3163  * sctp_bindx() support
3164  */
3165 uint32_t
3166 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3167     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3168 {
3169         struct sctp_ifa *ifa;
3170         struct sctp_laddr *laddr, *nladdr;
3171
3172         if (sa->sa_len == 0) {
3173                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3174                 return (EINVAL);
3175         }
3176         if (sctp_ifap) {
3177                 ifa = sctp_ifap;
3178         } else if (type == SCTP_ADD_IP_ADDRESS) {
3179                 /* For an add the address MUST be on the system */
3180                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3181         } else if (type == SCTP_DEL_IP_ADDRESS) {
3182                 /* For a delete we need to find it in the inp */
3183                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3184         } else {
3185                 ifa = NULL;
3186         }
3187         if (ifa != NULL) {
3188                 if (type == SCTP_ADD_IP_ADDRESS) {
3189                         sctp_add_local_addr_ep(inp, ifa, type);
3190                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3191                         if (inp->laddr_count < 2) {
3192                                 /* can't delete the last local address */
3193                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3194                                 return (EINVAL);
3195                         }
3196                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3197                             sctp_nxt_addr) {
3198                                 if (ifa == laddr->ifa) {
3199                                         /* Mark in the delete */
3200                                         laddr->action = type;
3201                                 }
3202                         }
3203                 }
3204                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3205                         /*
3206                          * There is no need to start the iterator if the inp
3207                          * has no associations.
3208                          */
3209                         if (type == SCTP_DEL_IP_ADDRESS) {
3210                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3211                                         if (laddr->ifa == ifa) {
3212                                                 sctp_del_local_addr_ep(inp, ifa);
3213                                         }
3214                                 }
3215                         }
3216                 } else {
3217                         struct sctp_asconf_iterator *asc;
3218                         struct sctp_laddr *wi;
3219
3220                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3221                             sizeof(struct sctp_asconf_iterator),
3222                             SCTP_M_ASC_IT);
3223                         if (asc == NULL) {
3224                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3225                                 return (ENOMEM);
3226                         }
3227                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3228                         if (wi == NULL) {
3229                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3230                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3231                                 return (ENOMEM);
3232                         }
3233                         LIST_INIT(&asc->list_of_work);
3234                         asc->cnt = 1;
3235                         SCTP_INCR_LADDR_COUNT();
3236                         wi->ifa = ifa;
3237                         wi->action = type;
3238                         atomic_add_int(&ifa->refcount, 1);
3239                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3240                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3241                             sctp_asconf_iterator_stcb,
3242                             sctp_asconf_iterator_ep_end,
3243                             SCTP_PCB_ANY_FLAGS,
3244                             SCTP_PCB_ANY_FEATURES,
3245                             SCTP_ASOC_ANY_STATE,
3246                             (void *)asc, 0,
3247                             sctp_asconf_iterator_end, inp, 0);
3248                 }
3249                 return (0);
3250         } else {
3251                 /* invalid address! */
3252                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3253                 return (EADDRNOTAVAIL);
3254         }
3255 }
3256
3257 void
3258 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3259     struct sctp_nets *net)
3260 {
3261         struct sctp_asconf_addr *aa;
3262         struct sctp_ifa *sctp_ifap;
3263         struct sctp_asconf_tag_param *vtag;
3264
3265 #ifdef INET
3266         struct sockaddr_in *to;
3267
3268 #endif
3269 #ifdef INET6
3270         struct sockaddr_in6 *to6;
3271
3272 #endif
3273         if (net == NULL) {
3274                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3275                 return;
3276         }
3277         if (stcb == NULL) {
3278                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3279                 return;
3280         }
3281         /*
3282          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3283          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3284          */
3285         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3286             SCTP_M_ASC_ADDR);
3287         if (aa == NULL) {
3288                 /* didn't get memory */
3289                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3290                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3291                 return;
3292         }
3293         aa->special_del = 0;
3294         /* fill in asconf address parameter fields */
3295         /* top level elements are "networked" during send */
3296         aa->ifa = NULL;
3297         aa->sent = 0;           /* clear sent flag */
3298         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3299         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3300         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3301         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3302         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3303         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3304
3305         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3306             SCTP_M_ASC_ADDR);
3307         if (aa == NULL) {
3308                 /* didn't get memory */
3309                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3310                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3311                 return;
3312         }
3313         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3314         /* fill in asconf address parameter fields */
3315         /* ADD(0.0.0.0) */
3316         switch (net->ro._l_addr.sa.sa_family) {
3317 #ifdef INET
3318         case AF_INET:
3319                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3320                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3321                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3322                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3323                 /* No need to add an address, we are using 0.0.0.0 */
3324                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3325                 break;
3326 #endif
3327 #ifdef INET6
3328         case AF_INET6:
3329                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3330                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3331                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3332                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3333                 /* No need to add an address, we are using 0.0.0.0 */
3334                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3335                 break;
3336 #endif
3337         }
3338         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3339             SCTP_M_ASC_ADDR);
3340         if (aa == NULL) {
3341                 /* didn't get memory */
3342                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3343                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3344                 return;
3345         }
3346         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3347         /* fill in asconf address parameter fields */
3348         /* ADD(0.0.0.0) */
3349         switch (net->ro._l_addr.sa.sa_family) {
3350 #ifdef INET
3351         case AF_INET:
3352                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3353                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3354                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3355                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3356                 /* No need to add an address, we are using 0.0.0.0 */
3357                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3358                 break;
3359 #endif
3360 #ifdef INET6
3361         case AF_INET6:
3362                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3363                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3364                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3365                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3366                 /* No need to add an address, we are using 0.0.0.0 */
3367                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3368                 break;
3369 #endif
3370         }
3371         /* Now we must hunt the addresses and add all global addresses */
3372         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3373                 struct sctp_vrf *vrf = NULL;
3374                 struct sctp_ifn *sctp_ifnp;
3375                 uint32_t vrf_id;
3376
3377                 vrf_id = stcb->sctp_ep->def_vrf_id;
3378                 vrf = sctp_find_vrf(vrf_id);
3379                 if (vrf == NULL) {
3380                         goto skip_rest;
3381                 }
3382                 SCTP_IPI_ADDR_RLOCK();
3383                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3384                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3385                                 switch (sctp_ifap->address.sa.sa_family) {
3386 #ifdef INET
3387                                 case AF_INET:
3388                                         to = &sctp_ifap->address.sin;
3389                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3390                                                 continue;
3391                                         }
3392                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3393                                                 continue;
3394                                         }
3395                                         break;
3396 #endif
3397 #ifdef INET6
3398                                 case AF_INET6:
3399                                         to6 = &sctp_ifap->address.sin6;
3400                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3401                                                 continue;
3402                                         }
3403                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3404                                                 continue;
3405                                         }
3406                                         break;
3407 #endif
3408                                 default:
3409                                         continue;
3410                                 }
3411                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3412                         }
3413                 }
3414                 SCTP_IPI_ADDR_RUNLOCK();
3415         } else {
3416                 struct sctp_laddr *laddr;
3417
3418                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3419                         if (laddr->ifa == NULL) {
3420                                 continue;
3421                         }
3422                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3423                                 /*
3424                                  * Address being deleted by the system, dont
3425                                  * list.
3426                                  */
3427                                 continue;
3428                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3429                                 /*
3430                                  * Address being deleted on this ep don't
3431                                  * list.
3432                                  */
3433                                 continue;
3434                         }
3435                         sctp_ifap = laddr->ifa;
3436                         switch (sctp_ifap->address.sa.sa_family) {
3437 #ifdef INET
3438                         case AF_INET:
3439                                 to = &sctp_ifap->address.sin;
3440                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3441                                         continue;
3442                                 }
3443                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3444                                         continue;
3445                                 }
3446                                 break;
3447 #endif
3448 #ifdef INET6
3449                         case AF_INET6:
3450                                 to6 = &sctp_ifap->address.sin6;
3451                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3452                                         continue;
3453                                 }
3454                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3455                                         continue;
3456                                 }
3457                                 break;
3458 #endif
3459                         default:
3460                                 continue;
3461                         }
3462                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3463                 }
3464         }
3465 skip_rest:
3466         /* Now we must send the asconf into the queue */
3467         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3468 }