sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_DONTWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_DONTWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         struct sockaddr_storage sa_store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, param_length, aparam_length;
 154         struct sockaddr *sa;
 155         int zero_address = 0;
 156         int bad_address = 0;
 157
 158 #ifdef INET
 159         struct sockaddr_in *sin;
 160         struct sctp_ipv4addr_param *v4addr;
 161
 162 #endif
 163 #ifdef INET6
 164         struct sockaddr_in6 *sin6;
 165         struct sctp_ipv6addr_param *v6addr;
 166
 167 #endif
 168
 169         aparam_length = ntohs(aph->ph.param_length);
 170         ph = (struct sctp_paramhdr *)(aph + 1);
 171         param_type = ntohs(ph->param_type);
 172         param_length = ntohs(ph->param_length);
 173
 174         sa = (struct sockaddr *)&sa_store;
 175         switch (param_type) {
 176 #ifdef INET
 177         case SCTP_IPV4_ADDRESS:
 178                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 179                         /* invalid param size */
 180                         return (NULL);
 181                 }
 182                 v4addr = (struct sctp_ipv4addr_param *)ph;
 183                 sin = (struct sockaddr_in *)&sa_store;
 184                 bzero(sin, sizeof(*sin));
 185                 sin->sin_family = AF_INET;
 186                 sin->sin_len = sizeof(struct sockaddr_in);
 187                 sin->sin_port = stcb->rport;
 188                 sin->sin_addr.s_addr = v4addr->addr;
 189                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 190                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 191                         bad_address = 1;
 192                 }
 193                 if (sin->sin_addr.s_addr == INADDR_ANY)
 194                         zero_address = 1;
 195                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 196                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 197                 break;
 198 #endif
 199 #ifdef INET6
 200         case SCTP_IPV6_ADDRESS:
 201                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 202                         /* invalid param size */
 203                         return (NULL);
 204                 }
 205                 v6addr = (struct sctp_ipv6addr_param *)ph;
 206                 sin6 = (struct sockaddr_in6 *)&sa_store;
 207                 bzero(sin6, sizeof(*sin6));
 208                 sin6->sin6_family = AF_INET6;
 209                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 210                 sin6->sin6_port = stcb->rport;
 211                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 212                     sizeof(struct in6_addr));
 213                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 214                         bad_address = 1;
 215                 }
 216                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 217                         zero_address = 1;
 218                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 219                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 220                 break;
 221 #endif
 222         default:
 223                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 224                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 225                     aparam_length);
 226                 return (m_reply);
 227         }                       /* end switch */
 228
 229         /* if 0.0.0.0/::0, add the source address instead */
 230         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 231                 sa = src;
 232                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 233                     "process_asconf_add_ip: using source addr ");
 234                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 235         }
 236         /* add the address */
 237         if (bad_address) {
 238                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 239                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 240                     aparam_length);
 241         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 242             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 243                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 244                     "process_asconf_add_ip: error adding address\n");
 245                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 246                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 247                     aparam_length);
 248         } else {
 249                 /* notify upper layer */
 250                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 251                 if (response_required) {
 252                         m_reply =
 253                             sctp_asconf_success_response(aph->correlation_id);
 254                 }
 255                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 256                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 257                     stcb, net);
 258                 if (send_hb) {
 259                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 260                 }
 261         }
 262         return (m_reply);
 263 }
 264
 265 static int
 266 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 267 {
 268         struct sctp_nets *src_net, *net;
 269
 270         /* make sure the source address exists as a destination net */
 271         src_net = sctp_findnet(stcb, src);
 272         if (src_net == NULL) {
 273                 /* not found */
 274                 return (-1);
 275         }
 276         /* delete all destination addresses except the source */
 277         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 278                 if (net != src_net) {
 279                         /* delete this address */
 280                         sctp_remove_net(stcb, net);
 281                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 282                             "asconf_del_remote_addrs_except: deleting ");
 283                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 284                             (struct sockaddr *)&net->ro._l_addr);
 285                         /* notify upper layer */
 286                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 287                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 288                 }
 289         }
 290         return (0);
 291 }
 292
 293 static struct mbuf *
 294 sctp_process_asconf_delete_ip(struct sockaddr *src,
 295     struct sctp_asconf_paramhdr *aph,
 296     struct sctp_tcb *stcb, int response_required)
 297 {
 298         struct mbuf *m_reply = NULL;
 299         struct sockaddr_storage sa_store;
 300         struct sctp_paramhdr *ph;
 301         uint16_t param_type, param_length, aparam_length;
 302         struct sockaddr *sa;
 303         int zero_address = 0;
 304         int result;
 305
 306 #ifdef INET
 307         struct sockaddr_in *sin;
 308         struct sctp_ipv4addr_param *v4addr;
 309
 310 #endif
 311 #ifdef INET6
 312         struct sockaddr_in6 *sin6;
 313         struct sctp_ipv6addr_param *v6addr;
 314
 315 #endif
 316
 317         aparam_length = ntohs(aph->ph.param_length);
 318         ph = (struct sctp_paramhdr *)(aph + 1);
 319         param_type = ntohs(ph->param_type);
 320         param_length = ntohs(ph->param_length);
 321
 322         sa = (struct sockaddr *)&sa_store;
 323         switch (param_type) {
 324 #ifdef INET
 325         case SCTP_IPV4_ADDRESS:
 326                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 327                         /* invalid param size */
 328                         return (NULL);
 329                 }
 330                 v4addr = (struct sctp_ipv4addr_param *)ph;
 331                 sin = (struct sockaddr_in *)&sa_store;
 332                 bzero(sin, sizeof(*sin));
 333                 sin->sin_family = AF_INET;
 334                 sin->sin_len = sizeof(struct sockaddr_in);
 335                 sin->sin_port = stcb->rport;
 336                 sin->sin_addr.s_addr = v4addr->addr;
 337                 if (sin->sin_addr.s_addr == INADDR_ANY)
 338                         zero_address = 1;
 339                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 340                     "process_asconf_delete_ip: deleting ");
 341                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 342                 break;
 343 #endif
 344 #ifdef INET6
 345         case SCTP_IPV6_ADDRESS:
 346                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 347                         /* invalid param size */
 348                         return (NULL);
 349                 }
 350                 v6addr = (struct sctp_ipv6addr_param *)ph;
 351                 sin6 = (struct sockaddr_in6 *)&sa_store;
 352                 bzero(sin6, sizeof(*sin6));
 353                 sin6->sin6_family = AF_INET6;
 354                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 355                 sin6->sin6_port = stcb->rport;
 356                 memcpy(&sin6->sin6_addr, v6addr->addr,
 357                     sizeof(struct in6_addr));
 358                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 359                         zero_address = 1;
 360                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 361                     "process_asconf_delete_ip: deleting ");
 362                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 363                 break;
 364 #endif
 365         default:
 366                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 367                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 368                     aparam_length);
 369                 return (m_reply);
 370         }
 371
 372         /* make sure the source address is not being deleted */
 373         if (sctp_cmpaddr(sa, src)) {
 374                 /* trying to delete the source address! */
 375                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 376                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 377                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 378                     aparam_length);
 379                 return (m_reply);
 380         }
 381         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 382         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 383                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 384
 385                 if (result) {
 386                         /* src address did not exist? */
 387                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 388                         /* what error to reply with?? */
 389                         m_reply =
 390                             sctp_asconf_error_response(aph->correlation_id,
 391                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 392                             aparam_length);
 393                 } else if (response_required) {
 394                         m_reply =
 395                             sctp_asconf_success_response(aph->correlation_id);
 396                 }
 397                 return (m_reply);
 398         }
 399         /* delete the address */
 400         result = sctp_del_remote_addr(stcb, sa);
 401         /*
 402          * note if result == -2, the address doesn't exist in the asoc but
 403          * since it's being deleted anyways, we just ack the delete -- but
 404          * this probably means something has already gone awry
 405          */
 406         if (result == -1) {
 407                 /* only one address in the asoc */
 408                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 409                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 410                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 411                     aparam_length);
 412         } else {
 413                 if (response_required) {
 414                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 415                 }
 416                 /* notify upper layer */
 417                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 418         }
 419         return (m_reply);
 420 }
 421
 422 static struct mbuf *
 423 sctp_process_asconf_set_primary(struct sockaddr *src,
 424     struct sctp_asconf_paramhdr *aph,
 425     struct sctp_tcb *stcb, int response_required)
 426 {
 427         struct mbuf *m_reply = NULL;
 428         struct sockaddr_storage sa_store;
 429         struct sctp_paramhdr *ph;
 430         uint16_t param_type, param_length, aparam_length;
 431         struct sockaddr *sa;
 432         int zero_address = 0;
 433
 434 #ifdef INET
 435         struct sockaddr_in *sin;
 436         struct sctp_ipv4addr_param *v4addr;
 437
 438 #endif
 439 #ifdef INET6
 440         struct sockaddr_in6 *sin6;
 441         struct sctp_ipv6addr_param *v6addr;
 442
 443 #endif
 444
 445         aparam_length = ntohs(aph->ph.param_length);
 446         ph = (struct sctp_paramhdr *)(aph + 1);
 447         param_type = ntohs(ph->param_type);
 448         param_length = ntohs(ph->param_length);
 449
 450         sa = (struct sockaddr *)&sa_store;
 451         switch (param_type) {
 452 #ifdef INET
 453         case SCTP_IPV4_ADDRESS:
 454                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 455                         /* invalid param size */
 456                         return (NULL);
 457                 }
 458                 v4addr = (struct sctp_ipv4addr_param *)ph;
 459                 sin = (struct sockaddr_in *)&sa_store;
 460                 bzero(sin, sizeof(*sin));
 461                 sin->sin_family = AF_INET;
 462                 sin->sin_len = sizeof(struct sockaddr_in);
 463                 sin->sin_addr.s_addr = v4addr->addr;
 464                 if (sin->sin_addr.s_addr == INADDR_ANY)
 465                         zero_address = 1;
 466                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 467                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 468                 break;
 469 #endif
 470 #ifdef INET6
 471         case SCTP_IPV6_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v6addr = (struct sctp_ipv6addr_param *)ph;
 477                 sin6 = (struct sockaddr_in6 *)&sa_store;
 478                 bzero(sin6, sizeof(*sin6));
 479                 sin6->sin6_family = AF_INET6;
 480                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 481                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 482                     sizeof(struct in6_addr));
 483                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 484                         zero_address = 1;
 485                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 486                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 487                 break;
 488 #endif
 489         default:
 490                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 491                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 492                     aparam_length);
 493                 return (m_reply);
 494         }
 495
 496         /* if 0.0.0.0/::0, use the source address instead */
 497         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 498                 sa = src;
 499                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 500                     "process_asconf_set_primary: using source addr ");
 501                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 502         }
 503         /* set the primary address */
 504         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 505                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 506                     "process_asconf_set_primary: primary address set\n");
 507                 /* notify upper layer */
 508                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 509                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 510                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 511                     (stcb->asoc.alternate)) {
 512                         sctp_free_remote_addr(stcb->asoc.alternate);
 513                         stcb->asoc.alternate = NULL;
 514                 }
 515                 if (response_required) {
 516                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 517                 }
 518                 /*
 519                  * Mobility adaptation. Ideally, when the reception of SET
 520                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 521                  * destination, unacknowledged DATA are retransmitted
 522                  * immediately to the new primary destination for seamless
 523                  * handover. If the destination is UNCONFIRMED and marked to
 524                  * REQ_PRIM, The retransmission occur when reception of the
 525                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 526                  * sctp_input.c) Also, when change of the primary
 527                  * destination, it is better that all subsequent new DATA
 528                  * containing already queued DATA are transmitted to the new
 529                  * primary destination. (by micchie)
 530                  */
 531                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 532                     SCTP_MOBILITY_BASE) ||
 533                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 534                     SCTP_MOBILITY_FASTHANDOFF)) &&
 535                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 536                     SCTP_MOBILITY_PRIM_DELETED) &&
 537                     (stcb->asoc.primary_destination->dest_state &
 538                     SCTP_ADDR_UNCONFIRMED) == 0) {
 539
 540                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 541                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 542                             SCTP_MOBILITY_FASTHANDOFF)) {
 543                                 sctp_assoc_immediate_retrans(stcb,
 544                                     stcb->asoc.primary_destination);
 545                         }
 546                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 547                             SCTP_MOBILITY_BASE)) {
 548                                 sctp_move_chunks_from_net(stcb,
 549                                     stcb->asoc.deleted_primary);
 550                         }
 551                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 552                             stcb->asoc.deleted_primary);
 553                 }
 554         } else {
 555                 /* couldn't set the requested primary address! */
 556                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 557                     "process_asconf_set_primary: set primary failed!\n");
 558                 /* must have been an invalid address, so report */
 559                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 560                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 561                     aparam_length);
 562         }
 563
 564         return (m_reply);
 565 }
 566
 567 /*
 568  * handles an ASCONF chunk.
 569  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 570  */
 571 void
 572 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 573     struct sockaddr *src,
 574     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 575     int first)
 576 {
 577         struct sctp_association *asoc;
 578         uint32_t serial_num;
 579         struct mbuf *n, *m_ack, *m_result, *m_tail;
 580         struct sctp_asconf_ack_chunk *ack_cp;
 581         struct sctp_asconf_paramhdr *aph, *ack_aph;
 582         struct sctp_ipv6addr_param *p_addr;
 583         unsigned int asconf_limit, cnt;
 584         int error = 0;          /* did an error occur? */
 585
 586         /* asconf param buffer */
 587         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 588         struct sctp_asconf_ack *ack, *ack_next;
 589
 590         /* verify minimum length */
 591         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "handle_asconf: chunk too small = %xh\n",
 594                     ntohs(cp->ch.chunk_length));
 595                 return;
 596         }
 597         asoc = &stcb->asoc;
 598         serial_num = ntohl(cp->serial_number);
 599
 600         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 601                 /* got a duplicate ASCONF */
 602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 603                     "handle_asconf: got duplicate serial number = %xh\n",
 604                     serial_num);
 605                 return;
 606         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 607                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 608                     serial_num, asoc->asconf_seq_in + 1);
 609                 return;
 610         }
 611         /* it's the expected "next" sequence number, so process it */
 612         asoc->asconf_seq_in = serial_num;       /* update sequence */
 613         /* get length of all the param's in the ASCONF */
 614         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 615         SCTPDBG(SCTP_DEBUG_ASCONF1,
 616             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 617             asconf_limit, serial_num);
 618
 619         if (first) {
 620                 /* delete old cache */
 621                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 622
 623                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 624                         if (ack->serial_number == serial_num)
 625                                 break;
 626                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 627                             ack->serial_number, serial_num);
 628                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 629                         if (ack->data != NULL) {
 630                                 sctp_m_freem(ack->data);
 631                         }
 632                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 633                 }
 634         }
 635         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 636             M_DONTWAIT, 1, MT_DATA);
 637         if (m_ack == NULL) {
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: couldn't get mbuf!\n");
 640                 return;
 641         }
 642         m_tail = m_ack;         /* current reply chain's tail */
 643
 644         /* fill in ASCONF-ACK header */
 645         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 646         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 647         ack_cp->ch.chunk_flags = 0;
 648         ack_cp->serial_number = htonl(serial_num);
 649         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 650         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 651         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 652
 653         /* skip the lookup address parameter */
 654         offset += sizeof(struct sctp_asconf_chunk);
 655         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 656         if (p_addr == NULL) {
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 658                     "handle_asconf: couldn't get lookup addr!\n");
 659                 /* respond with a missing/invalid mandatory parameter error */
 660                 return;
 661         }
 662         /* param_length is already validated in process_control... */
 663         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 664
 665         /* get pointer to first asconf param in ASCONF-ACK */
 666         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 667         if (ack_aph == NULL) {
 668                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 669                 return;
 670         }
 671         /* get pointer to first asconf param in ASCONF */
 672         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 673         if (aph == NULL) {
 674                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 675                 goto send_reply;
 676         }
 677         /* process through all parameters */
 678         cnt = 0;
 679         while (aph != NULL) {
 680                 unsigned int param_length, param_type;
 681
 682                 param_type = ntohs(aph->ph.param_type);
 683                 param_length = ntohs(aph->ph.param_length);
 684                 if (offset + param_length > asconf_limit) {
 685                         /* parameter goes beyond end of chunk! */
 686                         sctp_m_freem(m_ack);
 687                         return;
 688                 }
 689                 m_result = NULL;
 690
 691                 if (param_length > sizeof(aparam_buf)) {
 692                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 693                         sctp_m_freem(m_ack);
 694                         return;
 695                 }
 696                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 697                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 698                         sctp_m_freem(m_ack);
 699                 }
 700                 /* get the entire parameter */
 701                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 702                 if (aph == NULL) {
 703                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 704                         sctp_m_freem(m_ack);
 705                         return;
 706                 }
 707                 switch (param_type) {
 708                 case SCTP_ADD_IP_ADDRESS:
 709                         asoc->peer_supports_asconf = 1;
 710                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 711                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 712                         cnt++;
 713                         break;
 714                 case SCTP_DEL_IP_ADDRESS:
 715                         asoc->peer_supports_asconf = 1;
 716                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 717                             error);
 718                         break;
 719                 case SCTP_ERROR_CAUSE_IND:
 720                         /* not valid in an ASCONF chunk */
 721                         break;
 722                 case SCTP_SET_PRIM_ADDR:
 723                         asoc->peer_supports_asconf = 1;
 724                         m_result = sctp_process_asconf_set_primary(src, aph,
 725                             stcb, error);
 726                         break;
 727                 case SCTP_NAT_VTAGS:
 728                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 729                         break;
 730                 case SCTP_SUCCESS_REPORT:
 731                         /* not valid in an ASCONF chunk */
 732                         break;
 733                 case SCTP_ULP_ADAPTATION:
 734                         /* FIX */
 735                         break;
 736                 default:
 737                         if ((param_type & 0x8000) == 0) {
 738                                 /* Been told to STOP at this param */
 739                                 asconf_limit = offset;
 740                                 /*
 741                                  * FIX FIX - We need to call
 742                                  * sctp_arethere_unrecognized_parameters()
 743                                  * to get a operr and send it for any
 744                                  * param's with the 0x4000 bit set OR do it
 745                                  * here ourselves... note we still must STOP
 746                                  * if the 0x8000 bit is clear.
 747                                  */
 748                         }
 749                         /* unknown/invalid param type */
 750                         break;
 751                 }               /* switch */
 752
 753                 /* add any (error) result to the reply mbuf chain */
 754                 if (m_result != NULL) {
 755                         SCTP_BUF_NEXT(m_tail) = m_result;
 756                         m_tail = m_result;
 757                         /* update lengths, make sure it's aligned too */
 758                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 759                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 760                         /* set flag to force success reports */
 761                         error = 1;
 762                 }
 763                 offset += SCTP_SIZE32(param_length);
 764                 /* update remaining ASCONF message length to process */
 765                 if (offset >= asconf_limit) {
 766                         /* no more data in the mbuf chain */
 767                         break;
 768                 }
 769                 /* get pointer to next asconf param */
 770                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 771                     sizeof(struct sctp_asconf_paramhdr),
 772                     (uint8_t *) & aparam_buf);
 773                 if (aph == NULL) {
 774                         /* can't get an asconf paramhdr */
 775                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 776                         /* FIX ME - add error here... */
 777                 }
 778         }
 779
 780 send_reply:
 781         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 782         /* save the ASCONF-ACK reply */
 783         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 784             struct sctp_asconf_ack);
 785         if (ack == NULL) {
 786                 sctp_m_freem(m_ack);
 787                 return;
 788         }
 789         ack->serial_number = serial_num;
 790         ack->last_sent_to = NULL;
 791         ack->data = m_ack;
 792         ack->len = 0;
 793         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 794                 ack->len += SCTP_BUF_LEN(n);
 795         }
 796         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 797
 798         /* see if last_control_chunk_from is set properly (use IP src addr) */
 799         if (stcb->asoc.last_control_chunk_from == NULL) {
 800                 /*
 801                  * this could happen if the source address was just newly
 802                  * added
 803                  */
 804                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 805                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 806                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 807                 /* look up the from address */
 808                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 809 #ifdef SCTP_DEBUG
 810                 if (stcb->asoc.last_control_chunk_from == NULL) {
 811                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 812                 }
 813 #endif
 814         }
 815 }
 816
 817 /*
 818  * does the address match? returns 0 if not, 1 if so
 819  */
 820 static uint32_t
 821 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 822 {
 823         switch (sa->sa_family) {
 824 #ifdef INET6
 825         case AF_INET6:
 826                 {
 827                         /* XXX scopeid */
 828                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 829
 830                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 831                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 832                             sizeof(struct in6_addr)) == 0)) {
 833                                 return (1);
 834                         }
 835                         break;
 836                 }
 837 #endif
 838 #ifdef INET
 839         case AF_INET:
 840                 {
 841                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 842
 843                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 844                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 845                             sizeof(struct in_addr)) == 0)) {
 846                                 return (1);
 847                         }
 848                         break;
 849                 }
 850 #endif
 851         default:
 852                 break;
 853         }
 854         return (0);
 855 }
 856
 857 /*
 858  * does the address match? returns 0 if not, 1 if so
 859  */
 860 static uint32_t
 861 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 862 {
 863         uint16_t param_type, param_length;
 864
 865         param_type = ntohs(ph->param_type);
 866         param_length = ntohs(ph->param_length);
 867         switch (sa->sa_family) {
 868 #ifdef INET6
 869         case AF_INET6:
 870                 {
 871                         /* XXX scopeid */
 872                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 873                         struct sctp_ipv6addr_param *v6addr;
 874
 875                         v6addr = (struct sctp_ipv6addr_param *)ph;
 876                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 877                             param_length == sizeof(struct sctp_ipv6addr_param) &&
 878                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 879                             sizeof(struct in6_addr)) == 0)) {
 880                                 return (1);
 881                         }
 882                         break;
 883                 }
 884 #endif
 885 #ifdef INET
 886         case AF_INET:
 887                 {
 888                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 889                         struct sctp_ipv4addr_param *v4addr;
 890
 891                         v4addr = (struct sctp_ipv4addr_param *)ph;
 892                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 893                             param_length == sizeof(struct sctp_ipv4addr_param) &&
 894                             (memcmp(&v4addr->addr, &sin->sin_addr,
 895                             sizeof(struct in_addr)) == 0)) {
 896                                 return (1);
 897                         }
 898                         break;
 899                 }
 900 #endif
 901         default:
 902                 break;
 903         }
 904         return (0);
 905 }
 906
 907 /*
 908  * Cleanup for non-responded/OP ERR'd ASCONF
 909  */
 910 void
 911 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 912 {
 913         /* mark peer as ASCONF incapable */
 914         stcb->asoc.peer_supports_asconf = 0;
 915         /*
 916          * clear out any existing asconfs going out
 917          */
 918         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 919             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 920         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 921         /* remove the old ASCONF on our outbound queue */
 922         sctp_toss_old_asconf(stcb);
 923 }
 924
 925 /*
 926  * cleanup any cached source addresses that may be topologically
 927  * incorrect after a new address has been added to this interface.
 928  */
 929 static void
 930 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 931 {
 932         struct sctp_nets *net;
 933
 934         /*
 935          * Ideally, we want to only clear cached routes and source addresses
 936          * that are topologically incorrect.  But since there is no easy way
 937          * to know whether the newly added address on the ifn would cause a
 938          * routing change (i.e. a new egress interface would be chosen)
 939          * without doing a new routing lookup and source address selection,
 940          * we will (for now) just flush any cached route using a different
 941          * ifn (and cached source addrs) and let output re-choose them
 942          * during the next send on that net.
 943          */
 944         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 945                 /*
 946                  * clear any cached route (and cached source address) if the
 947                  * route's interface is NOT the same as the address change.
 948                  * If it's the same interface, just clear the cached source
 949                  * address.
 950                  */
 951                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 952                     ((ifn == NULL) ||
 953                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 954                         /* clear any cached route */
 955                         RTFREE(net->ro.ro_rt);
 956                         net->ro.ro_rt = NULL;
 957                 }
 958                 /* clear any cached source address */
 959                 if (net->src_addr_selected) {
 960                         sctp_free_ifa(net->ro._s_addr);
 961                         net->ro._s_addr = NULL;
 962                         net->src_addr_selected = 0;
 963                 }
 964         }
 965 }
 966
 967
 968 void
 969 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 970 {
 971         int error;
 972
 973         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 974                 return;
 975         }
 976         if (stcb->asoc.deleted_primary == NULL) {
 977                 return;
 978         }
 979         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 980                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 981                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 982                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 983                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 984                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 985                     stcb->asoc.deleted_primary,
 986                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
 987                 stcb->asoc.num_send_timers_up--;
 988                 if (stcb->asoc.num_send_timers_up < 0) {
 989                         stcb->asoc.num_send_timers_up = 0;
 990                 }
 991                 SCTP_TCB_LOCK_ASSERT(stcb);
 992                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 993                     stcb->asoc.deleted_primary);
 994                 if (error) {
 995                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 996                         return;
 997                 }
 998                 SCTP_TCB_LOCK_ASSERT(stcb);
 999 #ifdef SCTP_AUDITING_ENABLED
1000                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1001 #endif
1002                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1003                 if ((stcb->asoc.num_send_timers_up == 0) &&
1004                     (stcb->asoc.sent_queue_cnt > 0)) {
1005                         struct sctp_tmit_chunk *chk;
1006
1007                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1008                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1009                             stcb, chk->whoTo);
1010                 }
1011         }
1012         return;
1013 }
1014
1015 static int
1016     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1017
1018 void
1019 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1020 {
1021         struct sctp_tmit_chunk *chk;
1022
1023         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1024         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1025             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1026         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1027         net->error_count = 0;
1028         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1029                 if (chk->whoTo == net) {
1030                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1031                                 chk->sent = SCTP_DATAGRAM_RESEND;
1032                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1033                                 sctp_flight_size_decrease(chk);
1034                                 sctp_total_flight_decrease(stcb, chk);
1035                                 net->marked_retrans++;
1036                                 stcb->asoc.marked_retrans++;
1037                         }
1038                 }
1039         }
1040         if (net->marked_retrans) {
1041                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1042         }
1043 }
1044
1045 static void
1046 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1047 {
1048         struct sctp_nets *net;
1049         int addrnum, changed;
1050
1051         /*
1052          * If number of local valid addresses is 1, the valid address is
1053          * probably newly added address. Several valid addresses in this
1054          * association.  A source address may not be changed.  Additionally,
1055          * they can be configured on a same interface as "alias" addresses.
1056          * (by micchie)
1057          */
1058         addrnum = sctp_local_addr_count(stcb);
1059         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1060             addrnum);
1061         if (addrnum == 1) {
1062                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1063                         /* clear any cached route and source address */
1064                         if (net->ro.ro_rt) {
1065                                 RTFREE(net->ro.ro_rt);
1066                                 net->ro.ro_rt = NULL;
1067                         }
1068                         if (net->src_addr_selected) {
1069                                 sctp_free_ifa(net->ro._s_addr);
1070                                 net->ro._s_addr = NULL;
1071                                 net->src_addr_selected = 0;
1072                         }
1073                         /* Retransmit unacknowledged DATA chunks immediately */
1074                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1075                             SCTP_MOBILITY_FASTHANDOFF)) {
1076                                 sctp_net_immediate_retrans(stcb, net);
1077                         }
1078                         /* also, SET PRIMARY is maybe already sent */
1079                 }
1080                 return;
1081         }
1082         /* Multiple local addresses exsist in the association.  */
1083         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1084                 /* clear any cached route and source address */
1085                 if (net->ro.ro_rt) {
1086                         RTFREE(net->ro.ro_rt);
1087                         net->ro.ro_rt = NULL;
1088                 }
1089                 if (net->src_addr_selected) {
1090                         sctp_free_ifa(net->ro._s_addr);
1091                         net->ro._s_addr = NULL;
1092                         net->src_addr_selected = 0;
1093                 }
1094                 /*
1095                  * Check if the nexthop is corresponding to the new address.
1096                  * If the new address is corresponding to the current
1097                  * nexthop, the path will be changed. If the new address is
1098                  * NOT corresponding to the current nexthop, the path will
1099                  * not be changed.
1100                  */
1101                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1102                     stcb->sctp_ep->def_vrf_id);
1103                 if (net->ro.ro_rt == NULL)
1104                         continue;
1105
1106                 changed = 0;
1107                 switch (net->ro._l_addr.sa.sa_family) {
1108 #ifdef INET
1109                 case AF_INET:
1110                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1111                                 changed = 1;
1112                         }
1113                         break;
1114 #endif
1115 #ifdef INET6
1116                 case AF_INET6:
1117                         if (sctp_v6src_match_nexthop(
1118                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1119                                 changed = 1;
1120                         }
1121                         break;
1122 #endif
1123                 default:
1124                         break;
1125                 }
1126                 /*
1127                  * if the newly added address does not relate routing
1128                  * information, we skip.
1129                  */
1130                 if (changed == 0)
1131                         continue;
1132                 /* Retransmit unacknowledged DATA chunks immediately */
1133                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1134                     SCTP_MOBILITY_FASTHANDOFF)) {
1135                         sctp_net_immediate_retrans(stcb, net);
1136                 }
1137                 /* Send SET PRIMARY for this new address */
1138                 if (net == stcb->asoc.primary_destination) {
1139                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1140                             SCTP_SET_PRIM_ADDR);
1141                 }
1142         }
1143 }
1144
1145 /*
1146  * process an ADD/DELETE IP ack from peer.
1147  * addr: corresponding sctp_ifa to the address being added/deleted.
1148  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1149  * flag: 1=success, 0=failure.
1150  */
1151 static void
1152 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1153 {
1154         /*
1155          * do the necessary asoc list work- if we get a failure indication,
1156          * leave the address on the assoc's restricted list.  If we get a
1157          * success indication, remove the address from the restricted list.
1158          */
1159         /*
1160          * Note: this will only occur for ADD_IP_ADDRESS, since
1161          * DEL_IP_ADDRESS is never actually added to the list...
1162          */
1163         if (flag) {
1164                 /* success case, so remove from the restricted list */
1165                 sctp_del_local_addr_restricted(stcb, addr);
1166
1167                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1168                     SCTP_MOBILITY_BASE) ||
1169                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1170                     SCTP_MOBILITY_FASTHANDOFF)) {
1171                         sctp_path_check_and_react(stcb, addr);
1172                         return;
1173                 }
1174                 /* clear any cached/topologically incorrect source addresses */
1175                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1176         }
1177         /* else, leave it on the list */
1178 }
1179
1180 /*
1181  * add an asconf add/delete/set primary IP address parameter to the queue.
1182  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1183  * returns 0 if queued, -1 if not queued/removed.
1184  * NOTE: if adding, but a delete for the same address is already scheduled
1185  * (and not yet sent out), simply remove it from queue.  Same for deleting
1186  * an address already scheduled for add.  If a duplicate operation is found,
1187  * ignore the new one.
1188  */
1189 static int
1190 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1191     uint16_t type)
1192 {
1193         struct sctp_asconf_addr *aa, *aa_next;
1194         struct sockaddr *sa;
1195
1196         /* make sure the request isn't already in the queue */
1197         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1198                 /* address match? */
1199                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1200                         continue;
1201                 /*
1202                  * is the request already in queue but not sent? pass the
1203                  * request already sent in order to resolve the following
1204                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1205                  * can't remove the ADD request already sent 3. arrival of
1206                  * ADD
1207                  */
1208                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1209                         return (-1);
1210                 }
1211                 /* is the negative request already in queue, and not sent */
1212                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1213                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1214                         /* add requested, delete already queued */
1215                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1216                         /* remove the ifa from the restricted list */
1217                         sctp_del_local_addr_restricted(stcb, ifa);
1218                         /* free the asconf param */
1219                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1220                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1221                         return (-1);
1222                 }
1223                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1224                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1225                         /* delete requested, add already queued */
1226                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1227                         /* remove the aa->ifa from the restricted list */
1228                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1229                         /* free the asconf param */
1230                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1231                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1232                         return (-1);
1233                 }
1234         }                       /* for each aa */
1235
1236         /* adding new request to the queue */
1237         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1238             SCTP_M_ASC_ADDR);
1239         if (aa == NULL) {
1240                 /* didn't get memory */
1241                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1242                 return (-1);
1243         }
1244         aa->special_del = 0;
1245         /* fill in asconf address parameter fields */
1246         /* top level elements are "networked" during send */
1247         aa->ap.aph.ph.param_type = type;
1248         aa->ifa = ifa;
1249         atomic_add_int(&ifa->refcount, 1);
1250         /* correlation_id filled in during send routine later... */
1251         switch (ifa->address.sa.sa_family) {
1252 #ifdef INET6
1253         case AF_INET6:
1254                 {
1255                         struct sockaddr_in6 *sin6;
1256
1257                         sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1258                         sa = (struct sockaddr *)sin6;
1259                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1260                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1261                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1262                             sizeof(struct sctp_ipv6addr_param);
1263                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1264                             sizeof(struct in6_addr));
1265                         break;
1266                 }
1267 #endif
1268 #ifdef INET
1269         case AF_INET:
1270                 {
1271                         struct sockaddr_in *sin;
1272
1273                         sin = (struct sockaddr_in *)&ifa->address.sa;
1274                         sa = (struct sockaddr *)sin;
1275                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1276                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1277                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1278                             sizeof(struct sctp_ipv4addr_param);
1279                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1280                             sizeof(struct in_addr));
1281                         break;
1282                 }
1283 #endif
1284         default:
1285                 /* invalid family! */
1286                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1287                 sctp_free_ifa(ifa);
1288                 return (-1);
1289         }
1290         aa->sent = 0;           /* clear sent flag */
1291
1292         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1293 #ifdef SCTP_DEBUG
1294         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1295                 if (type == SCTP_ADD_IP_ADDRESS) {
1296                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1297                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1298                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1299                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1300                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1301                 } else {
1302                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1303                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1304                 }
1305         }
1306 #endif
1307
1308         return (0);
1309 }
1310
1311
1312 /*
1313  * add an asconf operation for the given ifa and type.
1314  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1315  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1316  * advisable.
1317  */
1318 static int
1319 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1320     uint16_t type)
1321 {
1322         uint32_t status;
1323         int pending_delete_queued = 0;
1324
1325         /* see if peer supports ASCONF */
1326         if (stcb->asoc.peer_supports_asconf == 0) {
1327                 return (-1);
1328         }
1329         /*
1330          * if this is deleting the last address from the assoc, mark it as
1331          * pending.
1332          */
1333         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1334             (sctp_local_addr_count(stcb) < 2)) {
1335                 /* set the pending delete info only */
1336                 stcb->asoc.asconf_del_pending = 1;
1337                 stcb->asoc.asconf_addr_del_pending = ifa;
1338                 atomic_add_int(&ifa->refcount, 1);
1339                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1340                     "asconf_queue_add: mark delete last address pending\n");
1341                 return (-1);
1342         }
1343         /* queue an asconf parameter */
1344         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1345
1346         /*
1347          * if this is an add, and there is a delete also pending (i.e. the
1348          * last local address is being changed), queue the pending delete
1349          * too.
1350          */
1351         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1352                 /* queue in the pending delete */
1353                 if (sctp_asconf_queue_mgmt(stcb,
1354                     stcb->asoc.asconf_addr_del_pending,
1355                     SCTP_DEL_IP_ADDRESS) == 0) {
1356                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1357                         pending_delete_queued = 1;
1358                         /* clear out the pending delete info */
1359                         stcb->asoc.asconf_del_pending = 0;
1360                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1361                         stcb->asoc.asconf_addr_del_pending = NULL;
1362                 }
1363         }
1364         if (pending_delete_queued) {
1365                 struct sctp_nets *net;
1366
1367                 /*
1368                  * since we know that the only/last address is now being
1369                  * changed in this case, reset the cwnd/rto on all nets to
1370                  * start as a new address and path.  Also clear the error
1371                  * counts to give the assoc the best chance to complete the
1372                  * address change.
1373                  */
1374                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1375                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1376                             net);
1377                         net->RTO = 0;
1378                         net->error_count = 0;
1379                 }
1380                 stcb->asoc.overall_error_count = 0;
1381                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1382                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1383                             stcb->asoc.overall_error_count,
1384                             0,
1385                             SCTP_FROM_SCTP_ASCONF,
1386                             __LINE__);
1387                 }
1388                 /* queue in an advisory set primary too */
1389                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1390                 /* let caller know we should send this out immediately */
1391                 status = 1;
1392         }
1393         return (status);
1394 }
1395
1396 /*-
1397  * add an asconf delete IP address parameter to the queue by sockaddr and
1398  * possibly with no sctp_ifa available.  This is only called by the routine
1399  * that checks the addresses in an INIT-ACK against the current address list.
1400  * returns 0 if completed, non-zero if not completed.
1401  * NOTE: if an add is already scheduled (and not yet sent out), simply
1402  * remove it from queue.  If a duplicate operation is found, ignore the
1403  * new one.
1404  */
1405 static int
1406 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1407 {
1408         struct sctp_ifa *ifa;
1409         struct sctp_asconf_addr *aa, *aa_next;
1410         uint32_t vrf_id;
1411
1412         if (stcb == NULL) {
1413                 return (-1);
1414         }
1415         /* see if peer supports ASCONF */
1416         if (stcb->asoc.peer_supports_asconf == 0) {
1417                 return (-1);
1418         }
1419         /* make sure the request isn't already in the queue */
1420         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1421                 /* address match? */
1422                 if (sctp_asconf_addr_match(aa, sa) == 0)
1423                         continue;
1424                 /* is the request already in queue (sent or not) */
1425                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1426                         return (-1);
1427                 }
1428                 /* is the negative request already in queue, and not sent */
1429                 if (aa->sent == 1)
1430                         continue;
1431                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1432                         /* add already queued, so remove existing entry */
1433                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1434                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1435                         /* free the entry */
1436                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1437                         return (-1);
1438                 }
1439         }                       /* for each aa */
1440
1441         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1442         if (stcb) {
1443                 vrf_id = stcb->asoc.vrf_id;
1444         } else {
1445                 vrf_id = SCTP_DEFAULT_VRFID;
1446         }
1447         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1448
1449         /* adding new request to the queue */
1450         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1451             SCTP_M_ASC_ADDR);
1452         if (aa == NULL) {
1453                 /* didn't get memory */
1454                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1455                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1456                 return (-1);
1457         }
1458         aa->special_del = 0;
1459         /* fill in asconf address parameter fields */
1460         /* top level elements are "networked" during send */
1461         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1462         aa->ifa = ifa;
1463         if (ifa)
1464                 atomic_add_int(&ifa->refcount, 1);
1465         /* correlation_id filled in during send routine later... */
1466         switch (sa->sa_family) {
1467 #ifdef INET6
1468         case AF_INET6:
1469                 {
1470                         /* IPv6 address */
1471                         struct sockaddr_in6 *sin6;
1472
1473                         sin6 = (struct sockaddr_in6 *)sa;
1474                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1475                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1476                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1477                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1478                             sizeof(struct in6_addr));
1479                         break;
1480                 }
1481 #endif
1482 #ifdef INET
1483         case AF_INET:
1484                 {
1485                         /* IPv4 address */
1486                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1487
1488                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1489                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1490                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1491                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1492                             sizeof(struct in_addr));
1493                         break;
1494                 }
1495 #endif
1496         default:
1497                 /* invalid family! */
1498                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1499                 if (ifa)
1500                         sctp_free_ifa(ifa);
1501                 return (-1);
1502         }
1503         aa->sent = 0;           /* clear sent flag */
1504
1505         /* delete goes to the back of the queue */
1506         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1507
1508         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1509         return (0);
1510 }
1511
1512 /*
1513  * find a specific asconf param on our "sent" queue
1514  */
1515 static struct sctp_asconf_addr *
1516 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1517 {
1518         struct sctp_asconf_addr *aa;
1519
1520         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1521                 if (aa->ap.aph.correlation_id == correlation_id &&
1522                     aa->sent == 1) {
1523                         /* found it */
1524                         return (aa);
1525                 }
1526         }
1527         /* didn't find it */
1528         return (NULL);
1529 }
1530
1531 /*
1532  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1533  * notifications based on the error response
1534  */
1535 static void
1536 sctp_asconf_process_error(struct sctp_tcb *stcb,
1537     struct sctp_asconf_paramhdr *aph)
1538 {
1539         struct sctp_error_cause *eh;
1540         struct sctp_paramhdr *ph;
1541         uint16_t param_type;
1542         uint16_t error_code;
1543
1544         eh = (struct sctp_error_cause *)(aph + 1);
1545         ph = (struct sctp_paramhdr *)(eh + 1);
1546         /* validate lengths */
1547         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1548             htons(aph->ph.param_length)) {
1549                 /* invalid error cause length */
1550                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1551                     "asconf_process_error: cause element too long\n");
1552                 return;
1553         }
1554         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1555             htons(eh->length)) {
1556                 /* invalid included TLV length */
1557                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1558                     "asconf_process_error: included TLV too long\n");
1559                 return;
1560         }
1561         /* which error code ? */
1562         error_code = ntohs(eh->code);
1563         param_type = ntohs(aph->ph.param_type);
1564         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1565         switch (error_code) {
1566         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1567                 /* we allow ourselves to "try again" for this error */
1568                 break;
1569         default:
1570                 /* peer can't handle it... */
1571                 switch (param_type) {
1572                 case SCTP_ADD_IP_ADDRESS:
1573                 case SCTP_DEL_IP_ADDRESS:
1574                         stcb->asoc.peer_supports_asconf = 0;
1575                         break;
1576                 case SCTP_SET_PRIM_ADDR:
1577                         stcb->asoc.peer_supports_asconf = 0;
1578                         break;
1579                 default:
1580                         break;
1581                 }
1582         }
1583 }
1584
1585 /*
1586  * process an asconf queue param.
1587  * aparam: parameter to process, will be removed from the queue.
1588  * flag: 1=success case, 0=failure case
1589  */
1590 static void
1591 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1592     struct sctp_asconf_addr *aparam, uint32_t flag)
1593 {
1594         uint16_t param_type;
1595
1596         /* process this param */
1597         param_type = aparam->ap.aph.ph.param_type;
1598         switch (param_type) {
1599         case SCTP_ADD_IP_ADDRESS:
1600                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1601                     "process_param_ack: added IP address\n");
1602                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1603                 break;
1604         case SCTP_DEL_IP_ADDRESS:
1605                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1606                     "process_param_ack: deleted IP address\n");
1607                 /* nothing really to do... lists already updated */
1608                 break;
1609         case SCTP_SET_PRIM_ADDR:
1610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1611                     "process_param_ack: set primary IP address\n");
1612                 /* nothing to do... peer may start using this addr */
1613                 if (flag == 0)
1614                         stcb->asoc.peer_supports_asconf = 0;
1615                 break;
1616         default:
1617                 /* should NEVER happen */
1618                 break;
1619         }
1620
1621         /* remove the param and free it */
1622         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1623         if (aparam->ifa)
1624                 sctp_free_ifa(aparam->ifa);
1625         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1626 }
1627
1628 /*
1629  * cleanup from a bad asconf ack parameter
1630  */
1631 static void
1632 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1633 {
1634         /* assume peer doesn't really know how to do asconfs */
1635         stcb->asoc.peer_supports_asconf = 0;
1636         /* XXX we could free the pending queue here */
1637 }
1638
1639 void
1640 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1641     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1642     struct sctp_nets *net, int *abort_no_unlock)
1643 {
1644         struct sctp_association *asoc;
1645         uint32_t serial_num;
1646         uint16_t ack_length;
1647         struct sctp_asconf_paramhdr *aph;
1648         struct sctp_asconf_addr *aa, *aa_next;
1649         uint32_t last_error_id = 0;     /* last error correlation id */
1650         uint32_t id;
1651         struct sctp_asconf_addr *ap;
1652
1653         /* asconf param buffer */
1654         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1655
1656         /* verify minimum length */
1657         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1658                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1659                     "handle_asconf_ack: chunk too small = %xh\n",
1660                     ntohs(cp->ch.chunk_length));
1661                 return;
1662         }
1663         asoc = &stcb->asoc;
1664         serial_num = ntohl(cp->serial_number);
1665
1666         /*
1667          * NOTE: we may want to handle this differently- currently, we will
1668          * abort when we get an ack for the expected serial number + 1 (eg.
1669          * we didn't send it), process an ack normally if it is the expected
1670          * serial number, and re-send the previous ack for *ALL* other
1671          * serial numbers
1672          */
1673
1674         /*
1675          * if the serial number is the next expected, but I didn't send it,
1676          * abort the asoc, since someone probably just hijacked us...
1677          */
1678         if (serial_num == (asoc->asconf_seq_out + 1)) {
1679                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1680                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1681                 *abort_no_unlock = 1;
1682                 return;
1683         }
1684         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1685                 /* got a duplicate/unexpected ASCONF-ACK */
1686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1687                     serial_num, asoc->asconf_seq_out_acked + 1);
1688                 return;
1689         }
1690         if (serial_num == asoc->asconf_seq_out - 1) {
1691                 /* stop our timer */
1692                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1693                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1694         }
1695         /* process the ASCONF-ACK contents */
1696         ack_length = ntohs(cp->ch.chunk_length) -
1697             sizeof(struct sctp_asconf_ack_chunk);
1698         offset += sizeof(struct sctp_asconf_ack_chunk);
1699         /* process through all parameters */
1700         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1701                 unsigned int param_length, param_type;
1702
1703                 /* get pointer to next asconf parameter */
1704                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1705                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1706                 if (aph == NULL) {
1707                         /* can't get an asconf paramhdr */
1708                         sctp_asconf_ack_clear(stcb);
1709                         return;
1710                 }
1711                 param_type = ntohs(aph->ph.param_type);
1712                 param_length = ntohs(aph->ph.param_length);
1713                 if (param_length > ack_length) {
1714                         sctp_asconf_ack_clear(stcb);
1715                         return;
1716                 }
1717                 if (param_length < sizeof(struct sctp_paramhdr)) {
1718                         sctp_asconf_ack_clear(stcb);
1719                         return;
1720                 }
1721                 /* get the complete parameter... */
1722                 if (param_length > sizeof(aparam_buf)) {
1723                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1724                             "param length (%u) larger than buffer size!\n", param_length);
1725                         sctp_asconf_ack_clear(stcb);
1726                         return;
1727                 }
1728                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1729                 if (aph == NULL) {
1730                         sctp_asconf_ack_clear(stcb);
1731                         return;
1732                 }
1733                 /* correlation_id is transparent to peer, no ntohl needed */
1734                 id = aph->correlation_id;
1735
1736                 switch (param_type) {
1737                 case SCTP_ERROR_CAUSE_IND:
1738                         last_error_id = id;
1739                         /* find the corresponding asconf param in our queue */
1740                         ap = sctp_asconf_find_param(stcb, id);
1741                         if (ap == NULL) {
1742                                 /* hmm... can't find this in our queue! */
1743                                 break;
1744                         }
1745                         /* process the parameter, failed flag */
1746                         sctp_asconf_process_param_ack(stcb, ap, 0);
1747                         /* process the error response */
1748                         sctp_asconf_process_error(stcb, aph);
1749                         break;
1750                 case SCTP_SUCCESS_REPORT:
1751                         /* find the corresponding asconf param in our queue */
1752                         ap = sctp_asconf_find_param(stcb, id);
1753                         if (ap == NULL) {
1754                                 /* hmm... can't find this in our queue! */
1755                                 break;
1756                         }
1757                         /* process the parameter, success flag */
1758                         sctp_asconf_process_param_ack(stcb, ap, 1);
1759                         break;
1760                 default:
1761                         break;
1762                 }               /* switch */
1763
1764                 /* update remaining ASCONF-ACK message length to process */
1765                 ack_length -= SCTP_SIZE32(param_length);
1766                 if (ack_length <= 0) {
1767                         /* no more data in the mbuf chain */
1768                         break;
1769                 }
1770                 offset += SCTP_SIZE32(param_length);
1771         }                       /* while */
1772
1773         /*
1774          * if there are any "sent" params still on the queue, these are
1775          * implicitly "success", or "failed" (if we got an error back) ...
1776          * so process these appropriately
1777          *
1778          * we assume that the correlation_id's are monotonically increasing
1779          * beginning from 1 and that we don't have *that* many outstanding
1780          * at any given time
1781          */
1782         if (last_error_id == 0)
1783                 last_error_id--;/* set to "max" value */
1784         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1785                 if (aa->sent == 1) {
1786                         /*
1787                          * implicitly successful or failed if correlation_id
1788                          * < last_error_id, then success else, failure
1789                          */
1790                         if (aa->ap.aph.correlation_id < last_error_id)
1791                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1792                         else
1793                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1794                 } else {
1795                         /*
1796                          * since we always process in order (FIFO queue) if
1797                          * we reach one that hasn't been sent, the rest
1798                          * should not have been sent either. so, we're
1799                          * done...
1800                          */
1801                         break;
1802                 }
1803         }
1804
1805         /* update the next sequence number to use */
1806         asoc->asconf_seq_out_acked++;
1807         /* remove the old ASCONF on our outbound queue */
1808         sctp_toss_old_asconf(stcb);
1809         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1810 #ifdef SCTP_TIMER_BASED_ASCONF
1811                 /* we have more params, so restart our timer */
1812                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1813                     stcb, net);
1814 #else
1815                 /* we have more params, so send out more */
1816                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1817 #endif
1818         }
1819 }
1820
1821 #ifdef INET6
1822 static uint32_t
1823 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1824 {
1825         struct sockaddr_in6 *sin6, *net6;
1826         struct sctp_nets *net;
1827
1828         if (sa->sa_family != AF_INET6) {
1829                 /* wrong family */
1830                 return (0);
1831         }
1832         sin6 = (struct sockaddr_in6 *)sa;
1833         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1834                 /* not link local address */
1835                 return (0);
1836         }
1837         /* hunt through our destination nets list for this scope_id */
1838         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1839                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1840                     AF_INET6)
1841                         continue;
1842                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1843                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1844                         continue;
1845                 if (sctp_is_same_scope(sin6, net6)) {
1846                         /* found one */
1847                         return (1);
1848                 }
1849         }
1850         /* didn't find one */
1851         return (0);
1852 }
1853
1854 #endif
1855
1856 /*
1857  * address management functions
1858  */
1859 static void
1860 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1861     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1862 {
1863         int status;
1864
1865
1866         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1867             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1868                 /* subset bound, no ASCONF allowed case, so ignore */
1869                 return;
1870         }
1871         /*
1872          * note: we know this is not the subset bound, no ASCONF case eg.
1873          * this is boundall or subset bound w/ASCONF allowed
1874          */
1875
1876         /* first, make sure it's a good address family */
1877         switch (ifa->address.sa.sa_family) {
1878 #ifdef INET6
1879         case AF_INET6:
1880                 break;
1881 #endif
1882 #ifdef INET
1883         case AF_INET:
1884                 break;
1885 #endif
1886         default:
1887                 return;
1888         }
1889 #ifdef INET6
1890         /* make sure we're "allowed" to add this type of addr */
1891         if (ifa->address.sa.sa_family == AF_INET6) {
1892                 /* invalid if we're not a v6 endpoint */
1893                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1894                         return;
1895                 /* is the v6 addr really valid ? */
1896                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1897                         return;
1898                 }
1899         }
1900 #endif
1901         /* put this address on the "pending/do not use yet" list */
1902         sctp_add_local_addr_restricted(stcb, ifa);
1903         /*
1904          * check address scope if address is out of scope, don't queue
1905          * anything... note: this would leave the address on both inp and
1906          * asoc lists
1907          */
1908         switch (ifa->address.sa.sa_family) {
1909 #ifdef INET6
1910         case AF_INET6:
1911                 {
1912                         struct sockaddr_in6 *sin6;
1913
1914                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1915                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1916                                 /* we skip unspecifed addresses */
1917                                 return;
1918                         }
1919                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1920                                 if (stcb->asoc.local_scope == 0) {
1921                                         return;
1922                                 }
1923                                 /* is it the right link local scope? */
1924                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1925                                         return;
1926                                 }
1927                         }
1928                         if (stcb->asoc.site_scope == 0 &&
1929                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1930                                 return;
1931                         }
1932                         break;
1933                 }
1934 #endif
1935 #ifdef INET
1936         case AF_INET:
1937                 {
1938                         struct sockaddr_in *sin;
1939                         struct in6pcb *inp6;
1940
1941                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1942                         /* invalid if we are a v6 only endpoint */
1943                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1944                             SCTP_IPV6_V6ONLY(inp6))
1945                                 return;
1946
1947                         sin = (struct sockaddr_in *)&ifa->address.sa;
1948                         if (sin->sin_addr.s_addr == 0) {
1949                                 /* we skip unspecifed addresses */
1950                                 return;
1951                         }
1952                         if (stcb->asoc.ipv4_local_scope == 0 &&
1953                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1954                                 return;
1955                         }
1956                         break;
1957                 }
1958 #endif
1959         default:
1960                 /* else, not AF_INET or AF_INET6, so skip */
1961                 return;
1962         }
1963
1964         /* queue an asconf for this address add/delete */
1965         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1966                 /* does the peer do asconf? */
1967                 if (stcb->asoc.peer_supports_asconf) {
1968                         /* queue an asconf for this addr */
1969                         status = sctp_asconf_queue_add(stcb, ifa, type);
1970
1971                         /*
1972                          * if queued ok, and in the open state, send out the
1973                          * ASCONF.  If in the non-open state, these will be
1974                          * sent when the state goes open.
1975                          */
1976                         if (status == 0 &&
1977                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1978 #ifdef SCTP_TIMER_BASED_ASCONF
1979                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1980                                     stcb, stcb->asoc.primary_destination);
1981 #else
1982                                 sctp_send_asconf(stcb, NULL, addr_locked);
1983 #endif
1984                         }
1985                 }
1986         }
1987 }
1988
1989
1990 int
1991 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1992 {
1993         struct sctp_asconf_iterator *asc;
1994         struct sctp_ifa *ifa;
1995         struct sctp_laddr *l;
1996         int cnt_invalid = 0;
1997
1998         asc = (struct sctp_asconf_iterator *)ptr;
1999         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2000                 ifa = l->ifa;
2001                 switch (ifa->address.sa.sa_family) {
2002 #ifdef INET6
2003                 case AF_INET6:
2004                         /* invalid if we're not a v6 endpoint */
2005                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2006                                 cnt_invalid++;
2007                                 if (asc->cnt == cnt_invalid)
2008                                         return (1);
2009                         }
2010                         break;
2011 #endif
2012 #ifdef INET
2013                 case AF_INET:
2014                         {
2015                                 /* invalid if we are a v6 only endpoint */
2016                                 struct in6pcb *inp6;
2017
2018                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2019                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2020                                     SCTP_IPV6_V6ONLY(inp6)) {
2021                                         cnt_invalid++;
2022                                         if (asc->cnt == cnt_invalid)
2023                                                 return (1);
2024                                 }
2025                                 break;
2026                         }
2027 #endif
2028                 default:
2029                         /* invalid address family */
2030                         cnt_invalid++;
2031                         if (asc->cnt == cnt_invalid)
2032                                 return (1);
2033                 }
2034         }
2035         return (0);
2036 }
2037
2038 static int
2039 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2040 {
2041         struct sctp_ifa *ifa;
2042         struct sctp_asconf_iterator *asc;
2043         struct sctp_laddr *laddr, *nladdr, *l;
2044
2045         /* Only for specific case not bound all */
2046         asc = (struct sctp_asconf_iterator *)ptr;
2047         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2048                 ifa = l->ifa;
2049                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2050                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2051                             sctp_nxt_addr) {
2052                                 if (laddr->ifa == ifa) {
2053                                         laddr->action = 0;
2054                                         break;
2055                                 }
2056                         }
2057                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2058                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2059                                 /* remove only after all guys are done */
2060                                 if (laddr->ifa == ifa) {
2061                                         sctp_del_local_addr_ep(inp, ifa);
2062                                 }
2063                         }
2064                 }
2065         }
2066         return (0);
2067 }
2068
2069 void
2070 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2071     void *ptr, uint32_t val SCTP_UNUSED)
2072 {
2073         struct sctp_asconf_iterator *asc;
2074         struct sctp_ifa *ifa;
2075         struct sctp_laddr *l;
2076         int cnt_invalid = 0;
2077         int type, status;
2078         int num_queued = 0;
2079
2080         asc = (struct sctp_asconf_iterator *)ptr;
2081         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2082                 ifa = l->ifa;
2083                 type = l->action;
2084
2085                 /* address's vrf_id must be the vrf_id of the assoc */
2086                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2087                         continue;
2088                 }
2089                 /* Same checks again for assoc */
2090                 switch (ifa->address.sa.sa_family) {
2091 #ifdef INET6
2092                 case AF_INET6:
2093                         {
2094                                 /* invalid if we're not a v6 endpoint */
2095                                 struct sockaddr_in6 *sin6;
2096
2097                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2098                                         cnt_invalid++;
2099                                         if (asc->cnt == cnt_invalid)
2100                                                 return;
2101                                         else
2102                                                 continue;
2103                                 }
2104                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2105                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2106                                         /* we skip unspecifed addresses */
2107                                         continue;
2108                                 }
2109                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2110                                         if (stcb->asoc.local_scope == 0) {
2111                                                 continue;
2112                                         }
2113                                         /* is it the right link local scope? */
2114                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2115                                                 continue;
2116                                         }
2117                                 }
2118                                 break;
2119                         }
2120 #endif
2121 #ifdef INET
2122                 case AF_INET:
2123                         {
2124                                 /* invalid if we are a v6 only endpoint */
2125                                 struct in6pcb *inp6;
2126                                 struct sockaddr_in *sin;
2127
2128                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2129                                 /* invalid if we are a v6 only endpoint */
2130                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2131                                     SCTP_IPV6_V6ONLY(inp6))
2132                                         continue;
2133
2134                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2135                                 if (sin->sin_addr.s_addr == 0) {
2136                                         /* we skip unspecifed addresses */
2137                                         continue;
2138                                 }
2139                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2140                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2141                                         continue;
2142                                 }
2143                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2144                                     SCTP_IPV6_V6ONLY(inp6)) {
2145                                         cnt_invalid++;
2146                                         if (asc->cnt == cnt_invalid)
2147                                                 return;
2148                                         else
2149                                                 continue;
2150                                 }
2151                                 break;
2152                         }
2153 #endif
2154                 default:
2155                         /* invalid address family */
2156                         cnt_invalid++;
2157                         if (asc->cnt == cnt_invalid)
2158                                 return;
2159                         else
2160                                 continue;
2161                         break;
2162                 }
2163
2164                 if (type == SCTP_ADD_IP_ADDRESS) {
2165                         /* prevent this address from being used as a source */
2166                         sctp_add_local_addr_restricted(stcb, ifa);
2167                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2168                         struct sctp_nets *net;
2169
2170                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2171                                 sctp_rtentry_t *rt;
2172
2173                                 /* delete this address if cached */
2174                                 if (net->ro._s_addr == ifa) {
2175                                         sctp_free_ifa(net->ro._s_addr);
2176                                         net->ro._s_addr = NULL;
2177                                         net->src_addr_selected = 0;
2178                                         rt = net->ro.ro_rt;
2179                                         if (rt) {
2180                                                 RTFREE(rt);
2181                                                 net->ro.ro_rt = NULL;
2182                                         }
2183                                         /*
2184                                          * Now we deleted our src address,
2185                                          * should we not also now reset the
2186                                          * cwnd/rto to start as if its a new
2187                                          * address?
2188                                          */
2189                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2190                                         net->RTO = 0;
2191
2192                                 }
2193                         }
2194                 } else if (type == SCTP_SET_PRIM_ADDR) {
2195                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2196                                 /* must validate the ifa is in the ep */
2197                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2198                                         continue;
2199                                 }
2200                         } else {
2201                                 /* Need to check scopes for this guy */
2202                                 if (sctp_is_address_in_scope(ifa,
2203                                     stcb->asoc.ipv4_addr_legal,
2204                                     stcb->asoc.ipv6_addr_legal,
2205                                     stcb->asoc.loopback_scope,
2206                                     stcb->asoc.ipv4_local_scope,
2207                                     stcb->asoc.local_scope,
2208                                     stcb->asoc.site_scope, 0) == 0) {
2209                                         continue;
2210                                 }
2211                         }
2212                 }
2213                 /* queue an asconf for this address add/delete */
2214                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2215                     stcb->asoc.peer_supports_asconf) {
2216                         /* queue an asconf for this addr */
2217                         status = sctp_asconf_queue_add(stcb, ifa, type);
2218                         /*
2219                          * if queued ok, and in the open state, update the
2220                          * count of queued params.  If in the non-open
2221                          * state, these get sent when the assoc goes open.
2222                          */
2223                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2224                                 if (status >= 0) {
2225                                         num_queued++;
2226                                 }
2227                         }
2228                 }
2229         }
2230         /*
2231          * If we have queued params in the open state, send out an ASCONF.
2232          */
2233         if (num_queued > 0) {
2234                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2235         }
2236 }
2237
2238 void
2239 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2240 {
2241         struct sctp_asconf_iterator *asc;
2242         struct sctp_ifa *ifa;
2243         struct sctp_laddr *l, *nl;
2244
2245         asc = (struct sctp_asconf_iterator *)ptr;
2246         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2247                 ifa = l->ifa;
2248                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2249                         /* Clear the defer use flag */
2250                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2251                 }
2252                 sctp_free_ifa(ifa);
2253                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2254                 SCTP_DECR_LADDR_COUNT();
2255         }
2256         SCTP_FREE(asc, SCTP_M_ASC_IT);
2257 }
2258
2259 /*
2260  * sa is the sockaddr to ask the peer to set primary to.
2261  * returns: 0 = completed, -1 = error
2262  */
2263 int32_t
2264 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2265 {
2266         uint32_t vrf_id;
2267         struct sctp_ifa *ifa;
2268
2269         /* find the ifa for the desired set primary */
2270         vrf_id = stcb->asoc.vrf_id;
2271         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2272         if (ifa == NULL) {
2273                 /* Invalid address */
2274                 return (-1);
2275         }
2276         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2277         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2278                 /* set primary queuing succeeded */
2279                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2280                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2281                     stcb);
2282                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2283                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2284 #ifdef SCTP_TIMER_BASED_ASCONF
2285                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2286                             stcb->sctp_ep, stcb,
2287                             stcb->asoc.primary_destination);
2288 #else
2289                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2290 #endif
2291                 }
2292         } else {
2293                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2294                     stcb);
2295                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2296                 return (-1);
2297         }
2298         return (0);
2299 }
2300
2301 void
2302 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2303 {
2304         struct sctp_inpcb *inp;
2305
2306         /* go through all our PCB's */
2307         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2308                 struct sctp_tcb *stcb;
2309
2310                 /* process for all associations for this endpoint */
2311                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2312                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2313                         if (!sctp_asconf_queue_add(stcb, ifa,
2314                             SCTP_SET_PRIM_ADDR)) {
2315                                 /* set primary queuing succeeded */
2316                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2317                                     stcb);
2318                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2319                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2320 #ifdef SCTP_TIMER_BASED_ASCONF
2321                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2322                                             stcb->sctp_ep, stcb,
2323                                             stcb->asoc.primary_destination);
2324 #else
2325                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2326 #endif
2327                                 }
2328                         }
2329                 }               /* for each stcb */
2330         }                       /* for each inp */
2331 }
2332
2333 int
2334 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2335 {
2336         struct sctp_tmit_chunk *chk, *nchk;
2337         unsigned int offset, asconf_limit;
2338         struct sctp_asconf_chunk *acp;
2339         struct sctp_asconf_paramhdr *aph;
2340         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2341         struct sctp_paramhdr *ph;
2342         int add_cnt, del_cnt;
2343         uint16_t last_param_type;
2344
2345         add_cnt = del_cnt = 0;
2346         last_param_type = 0;
2347         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2348                 if (chk->data == NULL) {
2349                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2350                         continue;
2351                 }
2352                 offset = 0;
2353                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2354                 offset += sizeof(struct sctp_asconf_chunk);
2355                 asconf_limit = ntohs(acp->ch.chunk_length);
2356                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2357                 if (ph == NULL) {
2358                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2359                         continue;
2360                 }
2361                 offset += ntohs(ph->param_length);
2362
2363                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2364                 if (aph == NULL) {
2365                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2366                         continue;
2367                 }
2368                 while (aph != NULL) {
2369                         unsigned int param_length, param_type;
2370
2371                         param_type = ntohs(aph->ph.param_type);
2372                         param_length = ntohs(aph->ph.param_length);
2373                         if (offset + param_length > asconf_limit) {
2374                                 /* parameter goes beyond end of chunk! */
2375                                 break;
2376                         }
2377                         if (param_length > sizeof(aparam_buf)) {
2378                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2379                                 break;
2380                         }
2381                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2382                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2383                                 break;
2384                         }
2385                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2386                         if (aph == NULL) {
2387                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2388                                 break;
2389                         }
2390                         ph = (struct sctp_paramhdr *)(aph + 1);
2391                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2392                                 switch (param_type) {
2393                                 case SCTP_ADD_IP_ADDRESS:
2394                                         add_cnt++;
2395                                         break;
2396                                 case SCTP_DEL_IP_ADDRESS:
2397                                         del_cnt++;
2398                                         break;
2399                                 default:
2400                                         break;
2401                                 }
2402                                 last_param_type = param_type;
2403                         }
2404                         offset += SCTP_SIZE32(param_length);
2405                         if (offset >= asconf_limit) {
2406                                 /* no more data in the mbuf chain */
2407                                 break;
2408                         }
2409                         /* get pointer to next asconf param */
2410                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2411                 }
2412         }
2413
2414         /*
2415          * we want to find the sequences which consist of ADD -> DEL -> ADD
2416          * or DEL -> ADD
2417          */
2418         if (add_cnt > del_cnt ||
2419             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2420                 return (1);
2421         }
2422         return (0);
2423 }
2424
2425 static struct sockaddr *
2426 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2427 {
2428         struct sctp_vrf *vrf = NULL;
2429         struct sctp_ifn *sctp_ifn;
2430         struct sctp_ifa *sctp_ifa;
2431
2432         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2433                 SCTP_IPI_ADDR_RLOCK();
2434         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2435         if (vrf == NULL) {
2436                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2437                         SCTP_IPI_ADDR_RUNLOCK();
2438                 return (NULL);
2439         }
2440         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2441                 if (stcb->asoc.loopback_scope == 0 &&
2442                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2443                         /* Skip if loopback_scope not set */
2444                         continue;
2445                 }
2446                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2447                         switch (sctp_ifa->address.sa.sa_family) {
2448 #ifdef INET
2449                         case AF_INET:
2450                                 if (stcb->asoc.ipv4_addr_legal) {
2451                                         struct sockaddr_in *sin;
2452
2453                                         sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2454                                         if (sin->sin_addr.s_addr == 0) {
2455                                                 /* skip unspecifed addresses */
2456                                                 continue;
2457                                         }
2458                                         if (stcb->asoc.ipv4_local_scope == 0 &&
2459                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2460                                                 continue;
2461
2462                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2463                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2464                                                 continue;
2465                                         /*
2466                                          * found a valid local v4 address to
2467                                          * use
2468                                          */
2469                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2470                                                 SCTP_IPI_ADDR_RUNLOCK();
2471                                         return (&sctp_ifa->address.sa);
2472                                 }
2473                                 break;
2474 #endif
2475 #ifdef INET6
2476                         case AF_INET6:
2477                                 if (stcb->asoc.ipv6_addr_legal) {
2478                                         struct sockaddr_in6 *sin6;
2479
2480                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2481                                                 continue;
2482                                         }
2483                                         sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2484                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2485                                                 /*
2486                                                  * we skip unspecifed
2487                                                  * addresses
2488                                                  */
2489                                                 continue;
2490                                         }
2491                                         if (stcb->asoc.local_scope == 0 &&
2492                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2493                                                 continue;
2494                                         if (stcb->asoc.site_scope == 0 &&
2495                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2496                                                 continue;
2497
2498                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2499                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2500                                                 continue;
2501                                         /*
2502                                          * found a valid local v6 address to
2503                                          * use
2504                                          */
2505                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2506                                                 SCTP_IPI_ADDR_RUNLOCK();
2507                                         return (&sctp_ifa->address.sa);
2508                                 }
2509                                 break;
2510 #endif
2511                         default:
2512                                 break;
2513                         }
2514                 }
2515         }
2516         /* no valid addresses found */
2517         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2518                 SCTP_IPI_ADDR_RUNLOCK();
2519         return (NULL);
2520 }
2521
2522 static struct sockaddr *
2523 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2524 {
2525         struct sctp_laddr *laddr;
2526
2527         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2528                 if (laddr->ifa == NULL) {
2529                         continue;
2530                 }
2531                 /* is the address restricted ? */
2532                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2533                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2534                         continue;
2535
2536                 /* found a valid local address to use */
2537                 return (&laddr->ifa->address.sa);
2538         }
2539         /* no valid addresses found */
2540         return (NULL);
2541 }
2542
2543 /*
2544  * builds an ASCONF chunk from queued ASCONF params.
2545  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2546  */
2547 struct mbuf *
2548 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2549 {
2550         struct mbuf *m_asconf, *m_asconf_chk;
2551         struct sctp_asconf_addr *aa;
2552         struct sctp_asconf_chunk *acp;
2553         struct sctp_asconf_paramhdr *aph;
2554         struct sctp_asconf_addr_param *aap;
2555         uint32_t p_length;
2556         uint32_t correlation_id = 1;    /* 0 is reserved... */
2557         caddr_t ptr, lookup_ptr;
2558         uint8_t lookup_used = 0;
2559
2560         /* are there any asconf params to send? */
2561         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2562                 if (aa->sent == 0)
2563                         break;
2564         }
2565         if (aa == NULL)
2566                 return (NULL);
2567
2568         /*
2569          * get a chunk header mbuf and a cluster for the asconf params since
2570          * it's simpler to fill in the asconf chunk header lookup address on
2571          * the fly
2572          */
2573         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2574         if (m_asconf_chk == NULL) {
2575                 /* no mbuf's */
2576                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2577                     "compose_asconf: couldn't get chunk mbuf!\n");
2578                 return (NULL);
2579         }
2580         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2581         if (m_asconf == NULL) {
2582                 /* no mbuf's */
2583                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2584                     "compose_asconf: couldn't get mbuf!\n");
2585                 sctp_m_freem(m_asconf_chk);
2586                 return (NULL);
2587         }
2588         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2589         SCTP_BUF_LEN(m_asconf) = 0;
2590         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2591         bzero(acp, sizeof(struct sctp_asconf_chunk));
2592         /* save pointers to lookup address and asconf params */
2593         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2594         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2595
2596         /* fill in chunk header info */
2597         acp->ch.chunk_type = SCTP_ASCONF;
2598         acp->ch.chunk_flags = 0;
2599         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2600         stcb->asoc.asconf_seq_out++;
2601
2602         /* add parameters... up to smallest MTU allowed */
2603         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2604                 if (aa->sent)
2605                         continue;
2606                 /* get the parameter length */
2607                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2608                 /* will it fit in current chunk? */
2609                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2610                         /* won't fit, so we're done with this chunk */
2611                         break;
2612                 }
2613                 /* assign (and store) a correlation id */
2614                 aa->ap.aph.correlation_id = correlation_id++;
2615
2616                 /*
2617                  * fill in address if we're doing a delete this is a simple
2618                  * way for us to fill in the correlation address, which
2619                  * should only be used by the peer if we're deleting our
2620                  * source address and adding a new address (e.g. renumbering
2621                  * case)
2622                  */
2623                 if (lookup_used == 0 &&
2624                     (aa->special_del == 0) &&
2625                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2626                         struct sctp_ipv6addr_param *lookup;
2627                         uint16_t p_size, addr_size;
2628
2629                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2630                         lookup->ph.param_type =
2631                             htons(aa->ap.addrp.ph.param_type);
2632                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2633                                 /* copy IPv6 address */
2634                                 p_size = sizeof(struct sctp_ipv6addr_param);
2635                                 addr_size = sizeof(struct in6_addr);
2636                         } else {
2637                                 /* copy IPv4 address */
2638                                 p_size = sizeof(struct sctp_ipv4addr_param);
2639                                 addr_size = sizeof(struct in_addr);
2640                         }
2641                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2642                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2643                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2644                         lookup_used = 1;
2645                 }
2646                 /* copy into current space */
2647                 memcpy(ptr, &aa->ap, p_length);
2648
2649                 /* network elements and update lengths */
2650                 aph = (struct sctp_asconf_paramhdr *)ptr;
2651                 aap = (struct sctp_asconf_addr_param *)ptr;
2652                 /* correlation_id is transparent to peer, no htonl needed */
2653                 aph->ph.param_type = htons(aph->ph.param_type);
2654                 aph->ph.param_length = htons(aph->ph.param_length);
2655                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2656                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2657
2658                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2659                 ptr += SCTP_SIZE32(p_length);
2660
2661                 /*
2662                  * these params are removed off the pending list upon
2663                  * getting an ASCONF-ACK back from the peer, just set flag
2664                  */
2665                 aa->sent = 1;
2666         }
2667         /* check to see if the lookup addr has been populated yet */
2668         if (lookup_used == 0) {
2669                 /* NOTE: if the address param is optional, can skip this... */
2670                 /* add any valid (existing) address... */
2671                 struct sctp_ipv6addr_param *lookup;
2672                 uint16_t p_size, addr_size;
2673                 struct sockaddr *found_addr;
2674                 caddr_t addr_ptr;
2675
2676                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2677                         found_addr = sctp_find_valid_localaddr(stcb,
2678                             addr_locked);
2679                 else
2680                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2681
2682                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2683                 if (found_addr != NULL) {
2684                         switch (found_addr->sa_family) {
2685 #ifdef INET6
2686                         case AF_INET6:
2687                                 /* copy IPv6 address */
2688                                 lookup->ph.param_type =
2689                                     htons(SCTP_IPV6_ADDRESS);
2690                                 p_size = sizeof(struct sctp_ipv6addr_param);
2691                                 addr_size = sizeof(struct in6_addr);
2692                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2693                                     found_addr)->sin6_addr;
2694                                 break;
2695 #endif
2696 #ifdef INET
2697                         case AF_INET:
2698                                 /* copy IPv4 address */
2699                                 lookup->ph.param_type =
2700                                     htons(SCTP_IPV4_ADDRESS);
2701                                 p_size = sizeof(struct sctp_ipv4addr_param);
2702                                 addr_size = sizeof(struct in_addr);
2703                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2704                                     found_addr)->sin_addr;
2705                                 break;
2706 #endif
2707                         default:
2708                                 p_size = 0;
2709                                 addr_size = 0;
2710                                 addr_ptr = NULL;
2711                                 break;
2712                         }
2713                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2714                         memcpy(lookup->addr, addr_ptr, addr_size);
2715                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2716                 } else {
2717                         /* uh oh... don't have any address?? */
2718                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2719                             "compose_asconf: no lookup addr!\n");
2720                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2721                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2722                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2723                         bzero(lookup->addr, sizeof(struct in_addr));
2724                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2725                 }
2726         }
2727         /* chain it all together */
2728         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2729         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2730         acp->ch.chunk_length = ntohs(*retlen);
2731
2732         return (m_asconf_chk);
2733 }
2734
2735 /*
2736  * section to handle address changes before an association is up eg. changes
2737  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2738  */
2739
2740 /*
2741  * processes the (local) addresses in the INIT-ACK chunk
2742  */
2743 static void
2744 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2745     unsigned int offset, unsigned int length)
2746 {
2747         struct sctp_paramhdr tmp_param, *ph;
2748         uint16_t plen, ptype;
2749         struct sctp_ifa *sctp_ifa;
2750
2751 #ifdef INET6
2752         struct sctp_ipv6addr_param addr6_store;
2753         struct sockaddr_in6 sin6;
2754
2755 #endif
2756 #ifdef INET
2757         struct sctp_ipv4addr_param addr4_store;
2758         struct sockaddr_in sin;
2759
2760 #endif
2761         struct sockaddr *sa;
2762         uint32_t vrf_id;
2763
2764         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2765         if (stcb == NULL)       /* Un-needed check for SA */
2766                 return;
2767
2768         /* convert to upper bound */
2769         length += offset;
2770
2771         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2772                 return;
2773         }
2774         /* init the addresses */
2775 #ifdef INET6
2776         bzero(&sin6, sizeof(sin6));
2777         sin6.sin6_family = AF_INET6;
2778         sin6.sin6_len = sizeof(sin6);
2779         sin6.sin6_port = stcb->rport;
2780 #endif
2781
2782 #ifdef INET
2783         bzero(&sin, sizeof(sin));
2784         sin.sin_family = AF_INET;
2785         sin.sin_len = sizeof(sin);
2786         sin.sin_port = stcb->rport;
2787 #endif
2788
2789         /* go through the addresses in the init-ack */
2790         ph = (struct sctp_paramhdr *)
2791             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2792             (uint8_t *) & tmp_param);
2793         while (ph != NULL) {
2794                 ptype = ntohs(ph->param_type);
2795                 plen = ntohs(ph->param_length);
2796                 switch (ptype) {
2797 #ifdef INET6
2798                 case SCTP_IPV6_ADDRESS:
2799                         {
2800                                 struct sctp_ipv6addr_param *a6p;
2801
2802                                 /* get the entire IPv6 address param */
2803                                 a6p = (struct sctp_ipv6addr_param *)
2804                                     sctp_m_getptr(m, offset,
2805                                     sizeof(struct sctp_ipv6addr_param),
2806                                     (uint8_t *) & addr6_store);
2807                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2808                                     a6p == NULL) {
2809                                         return;
2810                                 }
2811                                 memcpy(&sin6.sin6_addr, a6p->addr,
2812                                     sizeof(struct in6_addr));
2813                                 sa = (struct sockaddr *)&sin6;
2814                                 break;
2815                         }
2816 #endif
2817 #ifdef INET
2818                 case SCTP_IPV4_ADDRESS:
2819                         {
2820                                 struct sctp_ipv4addr_param *a4p;
2821
2822                                 /* get the entire IPv4 address param */
2823                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2824                                     sizeof(struct sctp_ipv4addr_param),
2825                                     (uint8_t *) & addr4_store);
2826                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2827                                     a4p == NULL) {
2828                                         return;
2829                                 }
2830                                 sin.sin_addr.s_addr = a4p->addr;
2831                                 sa = (struct sockaddr *)&sin;
2832                                 break;
2833                         }
2834 #endif
2835                 default:
2836                         goto next_addr;
2837                 }
2838
2839                 /* see if this address really (still) exists */
2840                 if (stcb) {
2841                         vrf_id = stcb->asoc.vrf_id;
2842                 } else {
2843                         vrf_id = SCTP_DEFAULT_VRFID;
2844                 }
2845                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2846                     SCTP_ADDR_NOT_LOCKED);
2847                 if (sctp_ifa == NULL) {
2848                         /* address doesn't exist anymore */
2849                         int status;
2850
2851                         /* are ASCONFs allowed ? */
2852                         if ((sctp_is_feature_on(stcb->sctp_ep,
2853                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2854                             stcb->asoc.peer_supports_asconf) {
2855                                 /* queue an ASCONF DEL_IP_ADDRESS */
2856                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2857                                 /*
2858                                  * if queued ok, and in correct state, send
2859                                  * out the ASCONF.
2860                                  */
2861                                 if (status == 0 &&
2862                                     SCTP_GET_STATE(&stcb->asoc) ==
2863                                     SCTP_STATE_OPEN) {
2864 #ifdef SCTP_TIMER_BASED_ASCONF
2865                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2866                                             stcb->sctp_ep, stcb,
2867                                             stcb->asoc.primary_destination);
2868 #else
2869                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2870 #endif
2871                                 }
2872                         }
2873                 }
2874 next_addr:
2875                 /*
2876                  * Sanity check:  Make sure the length isn't 0, otherwise
2877                  * we'll be stuck in this loop for a long time...
2878                  */
2879                 if (SCTP_SIZE32(plen) == 0) {
2880                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2881                             plen, ptype);
2882                         return;
2883                 }
2884                 /* get next parameter */
2885                 offset += SCTP_SIZE32(plen);
2886                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2887                         return;
2888                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2889                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2890         }                       /* while */
2891 }
2892
2893 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2894 /*
2895  * checks to see if a specific address is in the initack address list returns
2896  * 1 if found, 0 if not
2897  */
2898 static uint32_t
2899 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2900 {
2901         struct sctp_paramhdr tmp_param, *ph;
2902         uint16_t plen, ptype;
2903
2904 #ifdef INET
2905         struct sockaddr_in *sin;
2906         struct sctp_ipv4addr_param *a4p;
2907         struct sctp_ipv6addr_param addr4_store;
2908
2909 #endif
2910 #ifdef INET6
2911         struct sockaddr_in6 *sin6;
2912         struct sctp_ipv6addr_param *a6p;
2913         struct sctp_ipv6addr_param addr6_store;
2914         struct sockaddr_in6 sin6_tmp;
2915
2916 #endif
2917
2918         switch (sa->sa_family) {
2919 #ifdef INET
2920         case AF_INET:
2921                 break;
2922 #endif
2923 #ifdef INET6
2924         case AF_INET6:
2925                 break;
2926 #endif
2927         default:
2928                 return (0);
2929         }
2930
2931         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2932         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2933         /* convert to upper bound */
2934         length += offset;
2935
2936         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2937                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2938                     "find_initack_addr: invalid offset?\n");
2939                 return (0);
2940         }
2941         /* go through the addresses in the init-ack */
2942         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2943             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2944         while (ph != NULL) {
2945                 ptype = ntohs(ph->param_type);
2946                 plen = ntohs(ph->param_length);
2947                 switch (ptype) {
2948 #ifdef INET6
2949                 case SCTP_IPV6_ADDRESS:
2950                         if (sa->sa_family == AF_INET6) {
2951                                 /* get the entire IPv6 address param */
2952                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2953                                         break;
2954                                 }
2955                                 /* get the entire IPv6 address param */
2956                                 a6p = (struct sctp_ipv6addr_param *)
2957                                     sctp_m_getptr(m, offset,
2958                                     sizeof(struct sctp_ipv6addr_param),
2959                                     (uint8_t *) & addr6_store);
2960                                 if (a6p == NULL) {
2961                                         return (0);
2962                                 }
2963                                 sin6 = (struct sockaddr_in6 *)sa;
2964                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2965                                         /* create a copy and clear scope */
2966                                         memcpy(&sin6_tmp, sin6,
2967                                             sizeof(struct sockaddr_in6));
2968                                         sin6 = &sin6_tmp;
2969                                         in6_clearscope(&sin6->sin6_addr);
2970                                 }
2971                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2972                                     sizeof(struct in6_addr)) == 0) {
2973                                         /* found it */
2974                                         return (1);
2975                                 }
2976                         }
2977                         break;
2978 #endif                          /* INET6 */
2979 #ifdef INET
2980                 case SCTP_IPV4_ADDRESS:
2981                         if (sa->sa_family == AF_INET) {
2982                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2983                                         break;
2984                                 }
2985                                 /* get the entire IPv4 address param */
2986                                 a4p = (struct sctp_ipv4addr_param *)
2987                                     sctp_m_getptr(m, offset,
2988                                     sizeof(struct sctp_ipv4addr_param),
2989                                     (uint8_t *) & addr4_store);
2990                                 if (a4p == NULL) {
2991                                         return (0);
2992                                 }
2993                                 sin = (struct sockaddr_in *)sa;
2994                                 if (sin->sin_addr.s_addr == a4p->addr) {
2995                                         /* found it */
2996                                         return (1);
2997                                 }
2998                         }
2999                         break;
3000 #endif
3001                 default:
3002                         break;
3003                 }
3004                 /* get next parameter */
3005                 offset += SCTP_SIZE32(plen);
3006                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3007                         return (0);
3008                 }
3009                 ph = (struct sctp_paramhdr *)
3010                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3011                     (uint8_t *) & tmp_param);
3012         }                       /* while */
3013         /* not found! */
3014         return (0);
3015 }
3016
3017 /*
3018  * makes sure that the current endpoint local addr list is consistent with
3019  * the new association (eg. subset bound, asconf allowed) adds addresses as
3020  * necessary
3021  */
3022 static void
3023 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3024     int length, struct sockaddr *init_addr)
3025 {
3026         struct sctp_laddr *laddr;
3027
3028         /* go through the endpoint list */
3029         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3030                 /* be paranoid and validate the laddr */
3031                 if (laddr->ifa == NULL) {
3032                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3033                             "check_addr_list_ep: laddr->ifa is NULL");
3034                         continue;
3035                 }
3036                 if (laddr->ifa == NULL) {
3037                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3038                         continue;
3039                 }
3040                 /* do i have it implicitly? */
3041                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3042                         continue;
3043                 }
3044                 /* check to see if in the init-ack */
3045                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3046                         /* try to add it */
3047                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3048                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3049                 }
3050         }
3051 }
3052
3053 /*
3054  * makes sure that the current kernel address list is consistent with the new
3055  * association (with all addrs bound) adds addresses as necessary
3056  */
3057 static void
3058 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3059     int length, struct sockaddr *init_addr,
3060     uint16_t local_scope, uint16_t site_scope,
3061     uint16_t ipv4_scope, uint16_t loopback_scope)
3062 {
3063         struct sctp_vrf *vrf = NULL;
3064         struct sctp_ifn *sctp_ifn;
3065         struct sctp_ifa *sctp_ifa;
3066         uint32_t vrf_id;
3067
3068 #ifdef INET
3069         struct sockaddr_in *sin;
3070
3071 #endif
3072 #ifdef INET6
3073         struct sockaddr_in6 *sin6;
3074
3075 #endif
3076
3077         if (stcb) {
3078                 vrf_id = stcb->asoc.vrf_id;
3079         } else {
3080                 return;
3081         }
3082         SCTP_IPI_ADDR_RLOCK();
3083         vrf = sctp_find_vrf(vrf_id);
3084         if (vrf == NULL) {
3085                 SCTP_IPI_ADDR_RUNLOCK();
3086                 return;
3087         }
3088         /* go through all our known interfaces */
3089         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3090                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3091                         /* skip loopback interface */
3092                         continue;
3093                 }
3094                 /* go through each interface address */
3095                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3096                         /* do i have it implicitly? */
3097                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3098                                 continue;
3099                         }
3100                         switch (sctp_ifa->address.sa.sa_family) {
3101 #ifdef INET
3102                         case AF_INET:
3103                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sin;
3104                                 if ((ipv4_scope == 0) &&
3105                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3106                                         /* private address not in scope */
3107                                         continue;
3108                                 }
3109                                 break;
3110 #endif
3111 #ifdef INET6
3112                         case AF_INET6:
3113                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sin6;
3114                                 if ((local_scope == 0) &&
3115                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3116                                         continue;
3117                                 }
3118                                 if ((site_scope == 0) &&
3119                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3120                                         continue;
3121                                 }
3122                                 break;
3123 #endif
3124                         default:
3125                                 break;
3126                         }
3127                         /* check to see if in the init-ack */
3128                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3129                                 /* try to add it */
3130                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3131                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3132                                     SCTP_ADDR_LOCKED);
3133                         }
3134                 }               /* end foreach ifa */
3135         }                       /* end foreach ifn */
3136         SCTP_IPI_ADDR_RUNLOCK();
3137 }
3138
3139 /*
3140  * validates an init-ack chunk (from a cookie-echo) with current addresses
3141  * adds addresses from the init-ack into our local address list, if needed
3142  * queues asconf adds/deletes addresses as needed and makes appropriate list
3143  * changes for source address selection m, offset: points to the start of the
3144  * address list in an init-ack chunk length: total length of the address
3145  * params only init_addr: address where my INIT-ACK was sent from
3146  */
3147 void
3148 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3149     int length, struct sockaddr *init_addr,
3150     uint16_t local_scope, uint16_t site_scope,
3151     uint16_t ipv4_scope, uint16_t loopback_scope)
3152 {
3153         /* process the local addresses in the initack */
3154         sctp_process_initack_addresses(stcb, m, offset, length);
3155
3156         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3157                 /* bound all case */
3158                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3159                     local_scope, site_scope, ipv4_scope, loopback_scope);
3160         } else {
3161                 /* subset bound case */
3162                 if (sctp_is_feature_on(stcb->sctp_ep,
3163                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3164                         /* asconf's allowed */
3165                         sctp_check_address_list_ep(stcb, m, offset, length,
3166                             init_addr);
3167                 }
3168                 /* else, no asconfs allowed, so what we sent is what we get */
3169         }
3170 }
3171
3172 /*
3173  * sctp_bindx() support
3174  */
3175 uint32_t
3176 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3177     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3178 {
3179         struct sctp_ifa *ifa;
3180         struct sctp_laddr *laddr, *nladdr;
3181
3182         if (sa->sa_len == 0) {
3183                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3184                 return (EINVAL);
3185         }
3186         if (sctp_ifap) {
3187                 ifa = sctp_ifap;
3188         } else if (type == SCTP_ADD_IP_ADDRESS) {
3189                 /* For an add the address MUST be on the system */
3190                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3191         } else if (type == SCTP_DEL_IP_ADDRESS) {
3192                 /* For a delete we need to find it in the inp */
3193                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3194         } else {
3195                 ifa = NULL;
3196         }
3197         if (ifa != NULL) {
3198                 if (type == SCTP_ADD_IP_ADDRESS) {
3199                         sctp_add_local_addr_ep(inp, ifa, type);
3200                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3201                         if (inp->laddr_count < 2) {
3202                                 /* can't delete the last local address */
3203                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3204                                 return (EINVAL);
3205                         }
3206                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3207                             sctp_nxt_addr) {
3208                                 if (ifa == laddr->ifa) {
3209                                         /* Mark in the delete */
3210                                         laddr->action = type;
3211                                 }
3212                         }
3213                 }
3214                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3215                         /*
3216                          * There is no need to start the iterator if the inp
3217                          * has no associations.
3218                          */
3219                         if (type == SCTP_DEL_IP_ADDRESS) {
3220                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3221                                         if (laddr->ifa == ifa) {
3222                                                 sctp_del_local_addr_ep(inp, ifa);
3223                                         }
3224                                 }
3225                         }
3226                 } else {
3227                         struct sctp_asconf_iterator *asc;
3228                         struct sctp_laddr *wi;
3229
3230                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3231                             sizeof(struct sctp_asconf_iterator),
3232                             SCTP_M_ASC_IT);
3233                         if (asc == NULL) {
3234                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3235                                 return (ENOMEM);
3236                         }
3237                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3238                         if (wi == NULL) {
3239                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3240                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3241                                 return (ENOMEM);
3242                         }
3243                         LIST_INIT(&asc->list_of_work);
3244                         asc->cnt = 1;
3245                         SCTP_INCR_LADDR_COUNT();
3246                         wi->ifa = ifa;
3247                         wi->action = type;
3248                         atomic_add_int(&ifa->refcount, 1);
3249                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3250                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3251                             sctp_asconf_iterator_stcb,
3252                             sctp_asconf_iterator_ep_end,
3253                             SCTP_PCB_ANY_FLAGS,
3254                             SCTP_PCB_ANY_FEATURES,
3255                             SCTP_ASOC_ANY_STATE,
3256                             (void *)asc, 0,
3257                             sctp_asconf_iterator_end, inp, 0);
3258                 }
3259                 return (0);
3260         } else {
3261                 /* invalid address! */
3262                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3263                 return (EADDRNOTAVAIL);
3264         }
3265 }
3266
3267 void
3268 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3269     struct sctp_nets *net)
3270 {
3271         struct sctp_asconf_addr *aa;
3272         struct sctp_ifa *sctp_ifap;
3273         struct sctp_asconf_tag_param *vtag;
3274
3275 #ifdef INET
3276         struct sockaddr_in *to;
3277
3278 #endif
3279 #ifdef INET6
3280         struct sockaddr_in6 *to6;
3281
3282 #endif
3283         if (net == NULL) {
3284                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3285                 return;
3286         }
3287         if (stcb == NULL) {
3288                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3289                 return;
3290         }
3291         /*
3292          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3293          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3294          */
3295         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3296             SCTP_M_ASC_ADDR);
3297         if (aa == NULL) {
3298                 /* didn't get memory */
3299                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3300                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3301                 return;
3302         }
3303         aa->special_del = 0;
3304         /* fill in asconf address parameter fields */
3305         /* top level elements are "networked" during send */
3306         aa->ifa = NULL;
3307         aa->sent = 0;           /* clear sent flag */
3308         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3309         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3310         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3311         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3312         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3313         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3314
3315         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3316             SCTP_M_ASC_ADDR);
3317         if (aa == NULL) {
3318                 /* didn't get memory */
3319                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3320                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3321                 return;
3322         }
3323         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3324         /* fill in asconf address parameter fields */
3325         /* ADD(0.0.0.0) */
3326         switch (net->ro._l_addr.sa.sa_family) {
3327 #ifdef INET
3328         case AF_INET:
3329                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3330                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3331                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3332                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3333                 /* No need to add an address, we are using 0.0.0.0 */
3334                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3335                 break;
3336 #endif
3337 #ifdef INET6
3338         case AF_INET6:
3339                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3340                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3341                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3342                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3343                 /* No need to add an address, we are using 0.0.0.0 */
3344                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3345                 break;
3346 #endif
3347         }
3348         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3349             SCTP_M_ASC_ADDR);
3350         if (aa == NULL) {
3351                 /* didn't get memory */
3352                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3353                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3354                 return;
3355         }
3356         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3357         /* fill in asconf address parameter fields */
3358         /* ADD(0.0.0.0) */
3359         switch (net->ro._l_addr.sa.sa_family) {
3360 #ifdef INET
3361         case AF_INET:
3362                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3363                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3364                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3365                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3366                 /* No need to add an address, we are using 0.0.0.0 */
3367                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3368                 break;
3369 #endif
3370 #ifdef INET6
3371         case AF_INET6:
3372                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3373                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3374                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3375                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3376                 /* No need to add an address, we are using 0.0.0.0 */
3377                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3378                 break;
3379 #endif
3380         }
3381         /* Now we must hunt the addresses and add all global addresses */
3382         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3383                 struct sctp_vrf *vrf = NULL;
3384                 struct sctp_ifn *sctp_ifnp;
3385                 uint32_t vrf_id;
3386
3387                 vrf_id = stcb->sctp_ep->def_vrf_id;
3388                 vrf = sctp_find_vrf(vrf_id);
3389                 if (vrf == NULL) {
3390                         goto skip_rest;
3391                 }
3392                 SCTP_IPI_ADDR_RLOCK();
3393                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3394                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3395                                 switch (sctp_ifap->address.sa.sa_family) {
3396 #ifdef INET
3397                                 case AF_INET:
3398                                         to = &sctp_ifap->address.sin;
3399                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3400                                                 continue;
3401                                         }
3402                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3403                                                 continue;
3404                                         }
3405                                         break;
3406 #endif
3407 #ifdef INET6
3408                                 case AF_INET6:
3409                                         to6 = &sctp_ifap->address.sin6;
3410                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3411                                                 continue;
3412                                         }
3413                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3414                                                 continue;
3415                                         }
3416                                         break;
3417 #endif
3418                                 default:
3419                                         continue;
3420                                 }
3421                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3422                         }
3423                 }
3424                 SCTP_IPI_ADDR_RUNLOCK();
3425         } else {
3426                 struct sctp_laddr *laddr;
3427
3428                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3429                         if (laddr->ifa == NULL) {
3430                                 continue;
3431                         }
3432                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3433                                 /*
3434                                  * Address being deleted by the system, dont
3435                                  * list.
3436                                  */
3437                                 continue;
3438                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3439                                 /*
3440                                  * Address being deleted on this ep don't
3441                                  * list.
3442                                  */
3443                                 continue;
3444                         }
3445                         sctp_ifap = laddr->ifa;
3446                         switch (sctp_ifap->address.sa.sa_family) {
3447 #ifdef INET
3448                         case AF_INET:
3449                                 to = &sctp_ifap->address.sin;
3450                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3451                                         continue;
3452                                 }
3453                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3454                                         continue;
3455                                 }
3456                                 break;
3457 #endif
3458 #ifdef INET6
3459                         case AF_INET6:
3460                                 to6 = &sctp_ifap->address.sin6;
3461                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3462                                         continue;
3463                                 }
3464                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3465                                         continue;
3466                                 }
3467                                 break;
3468 #endif
3469                         default:
3470                                 continue;
3471                         }
3472                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3473                 }
3474         }
3475 skip_rest:
3476         /* Now we must send the asconf into the queue */
3477         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3478 }