The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_asconf.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
    3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
    4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions are met:
    8  *
    9  * a) Redistributions of source code must retain the above copyright notice,
   10  *    this list of conditions and the following disclaimer.
   11  *
   12  * b) Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in
   14  *    the documentation and/or other materials provided with the distribution.
   15  *
   16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
   17  *    contributors may be used to endorse or promote products derived
   18  *    from this software without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
   24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   30  * THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __FBSDID("$FreeBSD: releng/10.2/sys/netinet/sctp_asconf.c 284633 2015-06-20 08:25:27Z tuexen $");
   35 
   36 #include <netinet/sctp_os.h>
   37 #include <netinet/sctp_var.h>
   38 #include <netinet/sctp_sysctl.h>
   39 #include <netinet/sctp_pcb.h>
   40 #include <netinet/sctp_header.h>
   41 #include <netinet/sctputil.h>
   42 #include <netinet/sctp_output.h>
   43 #include <netinet/sctp_asconf.h>
   44 #include <netinet/sctp_timer.h>
   45 
   46 /*
   47  * debug flags:
   48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
   49  * SCTP_DEBUG_ASCONF2: detailed info
   50  */
   51 
   52 
   53 /*
   54  * RFC 5061
   55  *
   56  * An ASCONF parameter queue exists per asoc which holds the pending address
   57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
   58  *
   59  * A restricted_addrs list exists per assoc to hold local addresses that are
   60  * not (yet) usable by the assoc as a source address.  These addresses are
   61  * either pending an ASCONF operation (and exist on the ASCONF parameter
   62  * queue), or they are permanently restricted (the peer has returned an
   63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
   64  *
   65  * Deleted addresses are always immediately removed from the lists as they will
   66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
   67  * only if allowed.
   68  */
   69 
   70 /*
   71  * ASCONF parameter processing.
   72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
   73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
   74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
   75  */
   76 static struct mbuf *
   77 sctp_asconf_success_response(uint32_t id)
   78 {
   79         struct mbuf *m_reply = NULL;
   80         struct sctp_asconf_paramhdr *aph;
   81 
   82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
   83             0, M_NOWAIT, 1, MT_DATA);
   84         if (m_reply == NULL) {
   85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
   86                     "asconf_success_response: couldn't get mbuf!\n");
   87                 return (NULL);
   88         }
   89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
   90         aph->correlation_id = id;
   91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
   92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
   93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
   94         aph->ph.param_length = htons(aph->ph.param_length);
   95 
   96         return (m_reply);
   97 }
   98 
   99 static struct mbuf *
  100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
  101     uint16_t tlv_length)
  102 {
  103         struct mbuf *m_reply = NULL;
  104         struct sctp_asconf_paramhdr *aph;
  105         struct sctp_error_cause *error;
  106         uint8_t *tlv;
  107 
  108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
  109             tlv_length +
  110             sizeof(struct sctp_error_cause)),
  111             0, M_NOWAIT, 1, MT_DATA);
  112         if (m_reply == NULL) {
  113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  114                     "asconf_error_response: couldn't get mbuf!\n");
  115                 return (NULL);
  116         }
  117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  118         error = (struct sctp_error_cause *)(aph + 1);
  119 
  120         aph->correlation_id = id;
  121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
  122         error->code = htons(cause);
  123         error->length = tlv_length + sizeof(struct sctp_error_cause);
  124         aph->ph.param_length = error->length +
  125             sizeof(struct sctp_asconf_paramhdr);
  126 
  127         if (aph->ph.param_length > MLEN) {
  128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  129                     "asconf_error_response: tlv_length (%xh) too big\n",
  130                     tlv_length);
  131                 sctp_m_freem(m_reply);  /* discard */
  132                 return (NULL);
  133         }
  134         if (error_tlv != NULL) {
  135                 tlv = (uint8_t *) (error + 1);
  136                 memcpy(tlv, error_tlv, tlv_length);
  137         }
  138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  139         error->length = htons(error->length);
  140         aph->ph.param_length = htons(aph->ph.param_length);
  141 
  142         return (m_reply);
  143 }
  144 
  145 static struct mbuf *
  146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
  147     struct sctp_tcb *stcb, int send_hb, int response_required)
  148 {
  149         struct sctp_nets *net;
  150         struct mbuf *m_reply = NULL;
  151         union sctp_sockstore store;
  152         struct sctp_paramhdr *ph;
  153         uint16_t param_type, aparam_length;
  154 
  155 #if defined(INET) || defined(INET6)
  156         uint16_t param_length;
  157 
  158 #endif
  159         struct sockaddr *sa;
  160         int zero_address = 0;
  161         int bad_address = 0;
  162 
  163 #ifdef INET
  164         struct sockaddr_in *sin;
  165         struct sctp_ipv4addr_param *v4addr;
  166 
  167 #endif
  168 #ifdef INET6
  169         struct sockaddr_in6 *sin6;
  170         struct sctp_ipv6addr_param *v6addr;
  171 
  172 #endif
  173 
  174         aparam_length = ntohs(aph->ph.param_length);
  175         ph = (struct sctp_paramhdr *)(aph + 1);
  176         param_type = ntohs(ph->param_type);
  177 #if defined(INET) || defined(INET6)
  178         param_length = ntohs(ph->param_length);
  179 #endif
  180         sa = &store.sa;
  181         switch (param_type) {
  182 #ifdef INET
  183         case SCTP_IPV4_ADDRESS:
  184                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  185                         /* invalid param size */
  186                         return (NULL);
  187                 }
  188                 v4addr = (struct sctp_ipv4addr_param *)ph;
  189                 sin = &store.sin;
  190                 bzero(sin, sizeof(*sin));
  191                 sin->sin_family = AF_INET;
  192                 sin->sin_len = sizeof(struct sockaddr_in);
  193                 sin->sin_port = stcb->rport;
  194                 sin->sin_addr.s_addr = v4addr->addr;
  195                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
  196                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
  197                         bad_address = 1;
  198                 }
  199                 if (sin->sin_addr.s_addr == INADDR_ANY)
  200                         zero_address = 1;
  201                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
  202                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  203                 break;
  204 #endif
  205 #ifdef INET6
  206         case SCTP_IPV6_ADDRESS:
  207                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  208                         /* invalid param size */
  209                         return (NULL);
  210                 }
  211                 v6addr = (struct sctp_ipv6addr_param *)ph;
  212                 sin6 = &store.sin6;
  213                 bzero(sin6, sizeof(*sin6));
  214                 sin6->sin6_family = AF_INET6;
  215                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  216                 sin6->sin6_port = stcb->rport;
  217                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
  218                     sizeof(struct in6_addr));
  219                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
  220                         bad_address = 1;
  221                 }
  222                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  223                         zero_address = 1;
  224                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
  225                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  226                 break;
  227 #endif
  228         default:
  229                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  230                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
  231                     aparam_length);
  232                 return (m_reply);
  233         }                       /* end switch */
  234 
  235         /* if 0.0.0.0/::0, add the source address instead */
  236         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  237                 sa = src;
  238                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  239                     "process_asconf_add_ip: using source addr ");
  240                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  241         }
  242         /* add the address */
  243         if (bad_address) {
  244                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  245                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
  246                     aparam_length);
  247         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
  248             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
  249                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  250                     "process_asconf_add_ip: error adding address\n");
  251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  252                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
  253                     aparam_length);
  254         } else {
  255                 /* notify upper layer */
  256                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  257                 if (response_required) {
  258                         m_reply =
  259                             sctp_asconf_success_response(aph->correlation_id);
  260                 }
  261                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
  262                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
  263                     stcb, net);
  264                 if (send_hb) {
  265                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
  266                 }
  267         }
  268         return (m_reply);
  269 }
  270 
  271 static int
  272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
  273 {
  274         struct sctp_nets *src_net, *net;
  275 
  276         /* make sure the source address exists as a destination net */
  277         src_net = sctp_findnet(stcb, src);
  278         if (src_net == NULL) {
  279                 /* not found */
  280                 return (-1);
  281         }
  282         /* delete all destination addresses except the source */
  283         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  284                 if (net != src_net) {
  285                         /* delete this address */
  286                         sctp_remove_net(stcb, net);
  287                         SCTPDBG(SCTP_DEBUG_ASCONF1,
  288                             "asconf_del_remote_addrs_except: deleting ");
  289                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
  290                             (struct sockaddr *)&net->ro._l_addr);
  291                         /* notify upper layer */
  292                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
  293                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
  294                 }
  295         }
  296         return (0);
  297 }
  298 
  299 static struct mbuf *
  300 sctp_process_asconf_delete_ip(struct sockaddr *src,
  301     struct sctp_asconf_paramhdr *aph,
  302     struct sctp_tcb *stcb, int response_required)
  303 {
  304         struct mbuf *m_reply = NULL;
  305         union sctp_sockstore store;
  306         struct sctp_paramhdr *ph;
  307         uint16_t param_type, aparam_length;
  308 
  309 #if defined(INET) || defined(INET6)
  310         uint16_t param_length;
  311 
  312 #endif
  313         struct sockaddr *sa;
  314         int zero_address = 0;
  315         int result;
  316 
  317 #ifdef INET
  318         struct sockaddr_in *sin;
  319         struct sctp_ipv4addr_param *v4addr;
  320 
  321 #endif
  322 #ifdef INET6
  323         struct sockaddr_in6 *sin6;
  324         struct sctp_ipv6addr_param *v6addr;
  325 
  326 #endif
  327 
  328         aparam_length = ntohs(aph->ph.param_length);
  329         ph = (struct sctp_paramhdr *)(aph + 1);
  330         param_type = ntohs(ph->param_type);
  331 #if defined(INET) || defined(INET6)
  332         param_length = ntohs(ph->param_length);
  333 #endif
  334         sa = &store.sa;
  335         switch (param_type) {
  336 #ifdef INET
  337         case SCTP_IPV4_ADDRESS:
  338                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  339                         /* invalid param size */
  340                         return (NULL);
  341                 }
  342                 v4addr = (struct sctp_ipv4addr_param *)ph;
  343                 sin = &store.sin;
  344                 bzero(sin, sizeof(*sin));
  345                 sin->sin_family = AF_INET;
  346                 sin->sin_len = sizeof(struct sockaddr_in);
  347                 sin->sin_port = stcb->rport;
  348                 sin->sin_addr.s_addr = v4addr->addr;
  349                 if (sin->sin_addr.s_addr == INADDR_ANY)
  350                         zero_address = 1;
  351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  352                     "process_asconf_delete_ip: deleting ");
  353                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  354                 break;
  355 #endif
  356 #ifdef INET6
  357         case SCTP_IPV6_ADDRESS:
  358                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  359                         /* invalid param size */
  360                         return (NULL);
  361                 }
  362                 v6addr = (struct sctp_ipv6addr_param *)ph;
  363                 sin6 = &store.sin6;
  364                 bzero(sin6, sizeof(*sin6));
  365                 sin6->sin6_family = AF_INET6;
  366                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  367                 sin6->sin6_port = stcb->rport;
  368                 memcpy(&sin6->sin6_addr, v6addr->addr,
  369                     sizeof(struct in6_addr));
  370                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  371                         zero_address = 1;
  372                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  373                     "process_asconf_delete_ip: deleting ");
  374                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  375                 break;
  376 #endif
  377         default:
  378                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  379                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  380                     aparam_length);
  381                 return (m_reply);
  382         }
  383 
  384         /* make sure the source address is not being deleted */
  385         if (sctp_cmpaddr(sa, src)) {
  386                 /* trying to delete the source address! */
  387                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
  388                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  389                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
  390                     aparam_length);
  391                 return (m_reply);
  392         }
  393         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
  394         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  395                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
  396 
  397                 if (result) {
  398                         /* src address did not exist? */
  399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
  400                         /* what error to reply with?? */
  401                         m_reply =
  402                             sctp_asconf_error_response(aph->correlation_id,
  403                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
  404                             aparam_length);
  405                 } else if (response_required) {
  406                         m_reply =
  407                             sctp_asconf_success_response(aph->correlation_id);
  408                 }
  409                 return (m_reply);
  410         }
  411         /* delete the address */
  412         result = sctp_del_remote_addr(stcb, sa);
  413         /*
  414          * note if result == -2, the address doesn't exist in the asoc but
  415          * since it's being deleted anyways, we just ack the delete -- but
  416          * this probably means something has already gone awry
  417          */
  418         if (result == -1) {
  419                 /* only one address in the asoc */
  420                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
  421                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  422                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
  423                     aparam_length);
  424         } else {
  425                 if (response_required) {
  426                         m_reply = sctp_asconf_success_response(aph->correlation_id);
  427                 }
  428                 /* notify upper layer */
  429                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  430         }
  431         return (m_reply);
  432 }
  433 
  434 static struct mbuf *
  435 sctp_process_asconf_set_primary(struct sockaddr *src,
  436     struct sctp_asconf_paramhdr *aph,
  437     struct sctp_tcb *stcb, int response_required)
  438 {
  439         struct mbuf *m_reply = NULL;
  440         union sctp_sockstore store;
  441         struct sctp_paramhdr *ph;
  442         uint16_t param_type, aparam_length;
  443 
  444 #if defined(INET) || defined(INET6)
  445         uint16_t param_length;
  446 
  447 #endif
  448         struct sockaddr *sa;
  449         int zero_address = 0;
  450 
  451 #ifdef INET
  452         struct sockaddr_in *sin;
  453         struct sctp_ipv4addr_param *v4addr;
  454 
  455 #endif
  456 #ifdef INET6
  457         struct sockaddr_in6 *sin6;
  458         struct sctp_ipv6addr_param *v6addr;
  459 
  460 #endif
  461 
  462         aparam_length = ntohs(aph->ph.param_length);
  463         ph = (struct sctp_paramhdr *)(aph + 1);
  464         param_type = ntohs(ph->param_type);
  465 #if defined(INET) || defined(INET6)
  466         param_length = ntohs(ph->param_length);
  467 #endif
  468         sa = &store.sa;
  469         switch (param_type) {
  470 #ifdef INET
  471         case SCTP_IPV4_ADDRESS:
  472                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  473                         /* invalid param size */
  474                         return (NULL);
  475                 }
  476                 v4addr = (struct sctp_ipv4addr_param *)ph;
  477                 sin = &store.sin;
  478                 bzero(sin, sizeof(*sin));
  479                 sin->sin_family = AF_INET;
  480                 sin->sin_len = sizeof(struct sockaddr_in);
  481                 sin->sin_addr.s_addr = v4addr->addr;
  482                 if (sin->sin_addr.s_addr == INADDR_ANY)
  483                         zero_address = 1;
  484                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
  485                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  486                 break;
  487 #endif
  488 #ifdef INET6
  489         case SCTP_IPV6_ADDRESS:
  490                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  491                         /* invalid param size */
  492                         return (NULL);
  493                 }
  494                 v6addr = (struct sctp_ipv6addr_param *)ph;
  495                 sin6 = &store.sin6;
  496                 bzero(sin6, sizeof(*sin6));
  497                 sin6->sin6_family = AF_INET6;
  498                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  499                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
  500                     sizeof(struct in6_addr));
  501                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  502                         zero_address = 1;
  503                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
  504                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  505                 break;
  506 #endif
  507         default:
  508                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  509                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  510                     aparam_length);
  511                 return (m_reply);
  512         }
  513 
  514         /* if 0.0.0.0/::0, use the source address instead */
  515         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  516                 sa = src;
  517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  518                     "process_asconf_set_primary: using source addr ");
  519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  520         }
  521         /* set the primary address */
  522         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
  523                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  524                     "process_asconf_set_primary: primary address set\n");
  525                 /* notify upper layer */
  526                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  527                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
  528                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
  529                     (stcb->asoc.alternate)) {
  530                         sctp_free_remote_addr(stcb->asoc.alternate);
  531                         stcb->asoc.alternate = NULL;
  532                 }
  533                 if (response_required) {
  534                         m_reply = sctp_asconf_success_response(aph->correlation_id);
  535                 }
  536                 /*
  537                  * Mobility adaptation. Ideally, when the reception of SET
  538                  * PRIMARY with DELETE IP ADDRESS of the previous primary
  539                  * destination, unacknowledged DATA are retransmitted
  540                  * immediately to the new primary destination for seamless
  541                  * handover. If the destination is UNCONFIRMED and marked to
  542                  * REQ_PRIM, The retransmission occur when reception of the
  543                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
  544                  * sctp_input.c) Also, when change of the primary
  545                  * destination, it is better that all subsequent new DATA
  546                  * containing already queued DATA are transmitted to the new
  547                  * primary destination. (by micchie)
  548                  */
  549                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
  550                     SCTP_MOBILITY_BASE) ||
  551                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  552                     SCTP_MOBILITY_FASTHANDOFF)) &&
  553                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  554                     SCTP_MOBILITY_PRIM_DELETED) &&
  555                     (stcb->asoc.primary_destination->dest_state &
  556                     SCTP_ADDR_UNCONFIRMED) == 0) {
  557 
  558                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
  559                             stcb->sctp_ep, stcb, NULL,
  560                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
  561                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  562                             SCTP_MOBILITY_FASTHANDOFF)) {
  563                                 sctp_assoc_immediate_retrans(stcb,
  564                                     stcb->asoc.primary_destination);
  565                         }
  566                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  567                             SCTP_MOBILITY_BASE)) {
  568                                 sctp_move_chunks_from_net(stcb,
  569                                     stcb->asoc.deleted_primary);
  570                         }
  571                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
  572                             stcb->asoc.deleted_primary);
  573                 }
  574         } else {
  575                 /* couldn't set the requested primary address! */
  576                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  577                     "process_asconf_set_primary: set primary failed!\n");
  578                 /* must have been an invalid address, so report */
  579                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  580                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  581                     aparam_length);
  582         }
  583 
  584         return (m_reply);
  585 }
  586 
  587 /*
  588  * handles an ASCONF chunk.
  589  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
  590  */
  591 void
  592 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
  593     struct sockaddr *src,
  594     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
  595     int first)
  596 {
  597         struct sctp_association *asoc;
  598         uint32_t serial_num;
  599         struct mbuf *n, *m_ack, *m_result, *m_tail;
  600         struct sctp_asconf_ack_chunk *ack_cp;
  601         struct sctp_asconf_paramhdr *aph;
  602         struct sctp_ipv6addr_param *p_addr;
  603         unsigned int asconf_limit, cnt;
  604         int error = 0;          /* did an error occur? */
  605 
  606         /* asconf param buffer */
  607         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
  608         struct sctp_asconf_ack *ack, *ack_next;
  609 
  610         /* verify minimum length */
  611         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
  612                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  613                     "handle_asconf: chunk too small = %xh\n",
  614                     ntohs(cp->ch.chunk_length));
  615                 return;
  616         }
  617         asoc = &stcb->asoc;
  618         serial_num = ntohl(cp->serial_number);
  619 
  620         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
  621                 /* got a duplicate ASCONF */
  622                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  623                     "handle_asconf: got duplicate serial number = %xh\n",
  624                     serial_num);
  625                 return;
  626         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
  627                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
  628                     serial_num, asoc->asconf_seq_in + 1);
  629                 return;
  630         }
  631         /* it's the expected "next" sequence number, so process it */
  632         asoc->asconf_seq_in = serial_num;       /* update sequence */
  633         /* get length of all the param's in the ASCONF */
  634         asconf_limit = offset + ntohs(cp->ch.chunk_length);
  635         SCTPDBG(SCTP_DEBUG_ASCONF1,
  636             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
  637             asconf_limit, serial_num);
  638 
  639         if (first) {
  640                 /* delete old cache */
  641                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
  642 
  643                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
  644                         if (ack->serial_number == serial_num)
  645                                 break;
  646                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
  647                             ack->serial_number, serial_num);
  648                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
  649                         if (ack->data != NULL) {
  650                                 sctp_m_freem(ack->data);
  651                         }
  652                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
  653                 }
  654         }
  655         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
  656             M_NOWAIT, 1, MT_DATA);
  657         if (m_ack == NULL) {
  658                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  659                     "handle_asconf: couldn't get mbuf!\n");
  660                 return;
  661         }
  662         m_tail = m_ack;         /* current reply chain's tail */
  663 
  664         /* fill in ASCONF-ACK header */
  665         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
  666         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
  667         ack_cp->ch.chunk_flags = 0;
  668         ack_cp->serial_number = htonl(serial_num);
  669         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
  670         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
  671         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
  672 
  673         /* skip the lookup address parameter */
  674         offset += sizeof(struct sctp_asconf_chunk);
  675         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
  676         if (p_addr == NULL) {
  677                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  678                     "handle_asconf: couldn't get lookup addr!\n");
  679                 /* respond with a missing/invalid mandatory parameter error */
  680                 return;
  681         }
  682         /* param_length is already validated in process_control... */
  683         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
  684         /* get pointer to first asconf param in ASCONF */
  685         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
  686         if (aph == NULL) {
  687                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
  688                 goto send_reply;
  689         }
  690         /* process through all parameters */
  691         cnt = 0;
  692         while (aph != NULL) {
  693                 unsigned int param_length, param_type;
  694 
  695                 param_type = ntohs(aph->ph.param_type);
  696                 param_length = ntohs(aph->ph.param_length);
  697                 if (offset + param_length > asconf_limit) {
  698                         /* parameter goes beyond end of chunk! */
  699                         sctp_m_freem(m_ack);
  700                         return;
  701                 }
  702                 m_result = NULL;
  703 
  704                 if (param_length > sizeof(aparam_buf)) {
  705                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
  706                         sctp_m_freem(m_ack);
  707                         return;
  708                 }
  709                 if (param_length <= sizeof(struct sctp_paramhdr)) {
  710                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
  711                         sctp_m_freem(m_ack);
  712                 }
  713                 /* get the entire parameter */
  714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
  715                 if (aph == NULL) {
  716                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
  717                         sctp_m_freem(m_ack);
  718                         return;
  719                 }
  720                 switch (param_type) {
  721                 case SCTP_ADD_IP_ADDRESS:
  722                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
  723                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
  724                         cnt++;
  725                         break;
  726                 case SCTP_DEL_IP_ADDRESS:
  727                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
  728                             error);
  729                         break;
  730                 case SCTP_ERROR_CAUSE_IND:
  731                         /* not valid in an ASCONF chunk */
  732                         break;
  733                 case SCTP_SET_PRIM_ADDR:
  734                         m_result = sctp_process_asconf_set_primary(src, aph,
  735                             stcb, error);
  736                         break;
  737                 case SCTP_NAT_VTAGS:
  738                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
  739                         break;
  740                 case SCTP_SUCCESS_REPORT:
  741                         /* not valid in an ASCONF chunk */
  742                         break;
  743                 case SCTP_ULP_ADAPTATION:
  744                         /* FIX */
  745                         break;
  746                 default:
  747                         if ((param_type & 0x8000) == 0) {
  748                                 /* Been told to STOP at this param */
  749                                 asconf_limit = offset;
  750                                 /*
  751                                  * FIX FIX - We need to call
  752                                  * sctp_arethere_unrecognized_parameters()
  753                                  * to get a operr and send it for any
  754                                  * param's with the 0x4000 bit set OR do it
  755                                  * here ourselves... note we still must STOP
  756                                  * if the 0x8000 bit is clear.
  757                                  */
  758                         }
  759                         /* unknown/invalid param type */
  760                         break;
  761                 }               /* switch */
  762 
  763                 /* add any (error) result to the reply mbuf chain */
  764                 if (m_result != NULL) {
  765                         SCTP_BUF_NEXT(m_tail) = m_result;
  766                         m_tail = m_result;
  767                         /* update lengths, make sure it's aligned too */
  768                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
  769                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
  770                         /* set flag to force success reports */
  771                         error = 1;
  772                 }
  773                 offset += SCTP_SIZE32(param_length);
  774                 /* update remaining ASCONF message length to process */
  775                 if (offset >= asconf_limit) {
  776                         /* no more data in the mbuf chain */
  777                         break;
  778                 }
  779                 /* get pointer to next asconf param */
  780                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
  781                     sizeof(struct sctp_asconf_paramhdr),
  782                     (uint8_t *) & aparam_buf);
  783                 if (aph == NULL) {
  784                         /* can't get an asconf paramhdr */
  785                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
  786                         /* FIX ME - add error here... */
  787                 }
  788         }
  789 
  790 send_reply:
  791         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
  792         /* save the ASCONF-ACK reply */
  793         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
  794             struct sctp_asconf_ack);
  795         if (ack == NULL) {
  796                 sctp_m_freem(m_ack);
  797                 return;
  798         }
  799         ack->serial_number = serial_num;
  800         ack->last_sent_to = NULL;
  801         ack->data = m_ack;
  802         ack->len = 0;
  803         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
  804                 ack->len += SCTP_BUF_LEN(n);
  805         }
  806         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
  807 
  808         /* see if last_control_chunk_from is set properly (use IP src addr) */
  809         if (stcb->asoc.last_control_chunk_from == NULL) {
  810                 /*
  811                  * this could happen if the source address was just newly
  812                  * added
  813                  */
  814                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
  815                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
  816                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  817                 /* look up the from address */
  818                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
  819 #ifdef SCTP_DEBUG
  820                 if (stcb->asoc.last_control_chunk_from == NULL) {
  821                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
  822                 }
  823 #endif
  824         }
  825 }
  826 
  827 /*
  828  * does the address match? returns 0 if not, 1 if so
  829  */
  830 static uint32_t
  831 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
  832 {
  833         switch (sa->sa_family) {
  834 #ifdef INET6
  835         case AF_INET6:
  836                 {
  837                         /* XXX scopeid */
  838                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
  839 
  840                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
  841                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
  842                             sizeof(struct in6_addr)) == 0)) {
  843                                 return (1);
  844                         }
  845                         break;
  846                 }
  847 #endif
  848 #ifdef INET
  849         case AF_INET:
  850                 {
  851                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
  852 
  853                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
  854                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
  855                             sizeof(struct in_addr)) == 0)) {
  856                                 return (1);
  857                         }
  858                         break;
  859                 }
  860 #endif
  861         default:
  862                 break;
  863         }
  864         return (0);
  865 }
  866 
  867 /*
  868  * does the address match? returns 0 if not, 1 if so
  869  */
  870 static uint32_t
  871 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
  872 {
  873 #if defined(INET) || defined(INET6)
  874         uint16_t param_type, param_length;
  875 
  876         param_type = ntohs(ph->param_type);
  877         param_length = ntohs(ph->param_length);
  878 #endif
  879         switch (sa->sa_family) {
  880 #ifdef INET6
  881         case AF_INET6:
  882                 {
  883                         /* XXX scopeid */
  884                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
  885                         struct sctp_ipv6addr_param *v6addr;
  886 
  887                         v6addr = (struct sctp_ipv6addr_param *)ph;
  888                         if ((param_type == SCTP_IPV6_ADDRESS) &&
  889                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
  890                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
  891                             sizeof(struct in6_addr)) == 0)) {
  892                                 return (1);
  893                         }
  894                         break;
  895                 }
  896 #endif
  897 #ifdef INET
  898         case AF_INET:
  899                 {
  900                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
  901                         struct sctp_ipv4addr_param *v4addr;
  902 
  903                         v4addr = (struct sctp_ipv4addr_param *)ph;
  904                         if ((param_type == SCTP_IPV4_ADDRESS) &&
  905                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
  906                             (memcmp(&v4addr->addr, &sin->sin_addr,
  907                             sizeof(struct in_addr)) == 0)) {
  908                                 return (1);
  909                         }
  910                         break;
  911                 }
  912 #endif
  913         default:
  914                 break;
  915         }
  916         return (0);
  917 }
  918 
  919 /*
  920  * Cleanup for non-responded/OP ERR'd ASCONF
  921  */
  922 void
  923 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
  924 {
  925         /*
  926          * clear out any existing asconfs going out
  927          */
  928         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
  929             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
  930         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
  931         /* remove the old ASCONF on our outbound queue */
  932         sctp_toss_old_asconf(stcb);
  933 }
  934 
  935 /*
  936  * cleanup any cached source addresses that may be topologically
  937  * incorrect after a new address has been added to this interface.
  938  */
  939 static void
  940 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
  941 {
  942         struct sctp_nets *net;
  943 
  944         /*
  945          * Ideally, we want to only clear cached routes and source addresses
  946          * that are topologically incorrect.  But since there is no easy way
  947          * to know whether the newly added address on the ifn would cause a
  948          * routing change (i.e. a new egress interface would be chosen)
  949          * without doing a new routing lookup and source address selection,
  950          * we will (for now) just flush any cached route using a different
  951          * ifn (and cached source addrs) and let output re-choose them
  952          * during the next send on that net.
  953          */
  954         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  955                 /*
  956                  * clear any cached route (and cached source address) if the
  957                  * route's interface is NOT the same as the address change.
  958                  * If it's the same interface, just clear the cached source
  959                  * address.
  960                  */
  961                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
  962                     ((ifn == NULL) ||
  963                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
  964                         /* clear any cached route */
  965                         RTFREE(net->ro.ro_rt);
  966                         net->ro.ro_rt = NULL;
  967                 }
  968                 /* clear any cached source address */
  969                 if (net->src_addr_selected) {
  970                         sctp_free_ifa(net->ro._s_addr);
  971                         net->ro._s_addr = NULL;
  972                         net->src_addr_selected = 0;
  973                 }
  974         }
  975 }
  976 
  977 
  978 void
  979 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
  980 {
  981         int error;
  982 
  983         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
  984                 return;
  985         }
  986         if (stcb->asoc.deleted_primary == NULL) {
  987                 return;
  988         }
  989         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
  990                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
  991                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
  992                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
  993                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
  994                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
  995                     stcb->asoc.deleted_primary,
  996                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
  997                 stcb->asoc.num_send_timers_up--;
  998                 if (stcb->asoc.num_send_timers_up < 0) {
  999                         stcb->asoc.num_send_timers_up = 0;
 1000                 }
 1001                 SCTP_TCB_LOCK_ASSERT(stcb);
 1002                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 1003                     stcb->asoc.deleted_primary);
 1004                 if (error) {
 1005                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 1006                         return;
 1007                 }
 1008                 SCTP_TCB_LOCK_ASSERT(stcb);
 1009 #ifdef SCTP_AUDITING_ENABLED
 1010                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
 1011 #endif
 1012                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
 1013                 if ((stcb->asoc.num_send_timers_up == 0) &&
 1014                     (stcb->asoc.sent_queue_cnt > 0)) {
 1015                         struct sctp_tmit_chunk *chk;
 1016 
 1017                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 1018                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 1019                             stcb, chk->whoTo);
 1020                 }
 1021         }
 1022         return;
 1023 }
 1024 
 1025 static int
 1026     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
 1027 
 1028 void
 1029 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
 1030 {
 1031         struct sctp_tmit_chunk *chk;
 1032 
 1033         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
 1034         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
 1035             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
 1036         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
 1037         net->error_count = 0;
 1038         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 1039                 if (chk->whoTo == net) {
 1040                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
 1041                                 chk->sent = SCTP_DATAGRAM_RESEND;
 1042                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 1043                                 sctp_flight_size_decrease(chk);
 1044                                 sctp_total_flight_decrease(stcb, chk);
 1045                                 net->marked_retrans++;
 1046                                 stcb->asoc.marked_retrans++;
 1047                         }
 1048                 }
 1049         }
 1050         if (net->marked_retrans) {
 1051                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
 1052         }
 1053 }
 1054 
 1055 static void
 1056 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
 1057 {
 1058         struct sctp_nets *net;
 1059         int addrnum, changed;
 1060 
 1061         /*
 1062          * If number of local valid addresses is 1, the valid address is
 1063          * probably newly added address. Several valid addresses in this
 1064          * association.  A source address may not be changed.  Additionally,
 1065          * they can be configured on a same interface as "alias" addresses.
 1066          * (by micchie)
 1067          */
 1068         addrnum = sctp_local_addr_count(stcb);
 1069         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
 1070             addrnum);
 1071         if (addrnum == 1) {
 1072                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1073                         /* clear any cached route and source address */
 1074                         if (net->ro.ro_rt) {
 1075                                 RTFREE(net->ro.ro_rt);
 1076                                 net->ro.ro_rt = NULL;
 1077                         }
 1078                         if (net->src_addr_selected) {
 1079                                 sctp_free_ifa(net->ro._s_addr);
 1080                                 net->ro._s_addr = NULL;
 1081                                 net->src_addr_selected = 0;
 1082                         }
 1083                         /* Retransmit unacknowledged DATA chunks immediately */
 1084                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1085                             SCTP_MOBILITY_FASTHANDOFF)) {
 1086                                 sctp_net_immediate_retrans(stcb, net);
 1087                         }
 1088                         /* also, SET PRIMARY is maybe already sent */
 1089                 }
 1090                 return;
 1091         }
 1092         /* Multiple local addresses exsist in the association.  */
 1093         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1094                 /* clear any cached route and source address */
 1095                 if (net->ro.ro_rt) {
 1096                         RTFREE(net->ro.ro_rt);
 1097                         net->ro.ro_rt = NULL;
 1098                 }
 1099                 if (net->src_addr_selected) {
 1100                         sctp_free_ifa(net->ro._s_addr);
 1101                         net->ro._s_addr = NULL;
 1102                         net->src_addr_selected = 0;
 1103                 }
 1104                 /*
 1105                  * Check if the nexthop is corresponding to the new address.
 1106                  * If the new address is corresponding to the current
 1107                  * nexthop, the path will be changed. If the new address is
 1108                  * NOT corresponding to the current nexthop, the path will
 1109                  * not be changed.
 1110                  */
 1111                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
 1112                     stcb->sctp_ep->def_vrf_id,
 1113                     stcb->sctp_ep->fibnum);
 1114                 if (net->ro.ro_rt == NULL)
 1115                         continue;
 1116 
 1117                 changed = 0;
 1118                 switch (net->ro._l_addr.sa.sa_family) {
 1119 #ifdef INET
 1120                 case AF_INET:
 1121                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
 1122                                 changed = 1;
 1123                         }
 1124                         break;
 1125 #endif
 1126 #ifdef INET6
 1127                 case AF_INET6:
 1128                         if (sctp_v6src_match_nexthop(
 1129                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
 1130                                 changed = 1;
 1131                         }
 1132                         break;
 1133 #endif
 1134                 default:
 1135                         break;
 1136                 }
 1137                 /*
 1138                  * if the newly added address does not relate routing
 1139                  * information, we skip.
 1140                  */
 1141                 if (changed == 0)
 1142                         continue;
 1143                 /* Retransmit unacknowledged DATA chunks immediately */
 1144                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1145                     SCTP_MOBILITY_FASTHANDOFF)) {
 1146                         sctp_net_immediate_retrans(stcb, net);
 1147                 }
 1148                 /* Send SET PRIMARY for this new address */
 1149                 if (net == stcb->asoc.primary_destination) {
 1150                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
 1151                             SCTP_SET_PRIM_ADDR);
 1152                 }
 1153         }
 1154 }
 1155 
 1156 /*
 1157  * process an ADD/DELETE IP ack from peer.
 1158  * addr: corresponding sctp_ifa to the address being added/deleted.
 1159  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
 1160  * flag: 1=success, 0=failure.
 1161  */
 1162 static void
 1163 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
 1164 {
 1165         /*
 1166          * do the necessary asoc list work- if we get a failure indication,
 1167          * leave the address on the assoc's restricted list.  If we get a
 1168          * success indication, remove the address from the restricted list.
 1169          */
 1170         /*
 1171          * Note: this will only occur for ADD_IP_ADDRESS, since
 1172          * DEL_IP_ADDRESS is never actually added to the list...
 1173          */
 1174         if (flag) {
 1175                 /* success case, so remove from the restricted list */
 1176                 sctp_del_local_addr_restricted(stcb, addr);
 1177 
 1178                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1179                     SCTP_MOBILITY_BASE) ||
 1180                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 1181                     SCTP_MOBILITY_FASTHANDOFF)) {
 1182                         sctp_path_check_and_react(stcb, addr);
 1183                         return;
 1184                 }
 1185                 /* clear any cached/topologically incorrect source addresses */
 1186                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
 1187         }
 1188         /* else, leave it on the list */
 1189 }
 1190 
 1191 /*
 1192  * add an asconf add/delete/set primary IP address parameter to the queue.
 1193  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
 1194  * returns 0 if queued, -1 if not queued/removed.
 1195  * NOTE: if adding, but a delete for the same address is already scheduled
 1196  * (and not yet sent out), simply remove it from queue.  Same for deleting
 1197  * an address already scheduled for add.  If a duplicate operation is found,
 1198  * ignore the new one.
 1199  */
 1200 static int
 1201 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
 1202     uint16_t type)
 1203 {
 1204         struct sctp_asconf_addr *aa, *aa_next;
 1205 
 1206         /* make sure the request isn't already in the queue */
 1207         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1208                 /* address match? */
 1209                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
 1210                         continue;
 1211                 /*
 1212                  * is the request already in queue but not sent? pass the
 1213                  * request already sent in order to resolve the following
 1214                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
 1215                  * can't remove the ADD request already sent 3. arrival of
 1216                  * ADD
 1217                  */
 1218                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
 1219                         return (-1);
 1220                 }
 1221                 /* is the negative request already in queue, and not sent */
 1222                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
 1223                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
 1224                         /* add requested, delete already queued */
 1225                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1226                         /* remove the ifa from the restricted list */
 1227                         sctp_del_local_addr_restricted(stcb, ifa);
 1228                         /* free the asconf param */
 1229                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1230                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
 1231                         return (-1);
 1232                 }
 1233                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
 1234                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
 1235                         /* delete requested, add already queued */
 1236                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1237                         /* remove the aa->ifa from the restricted list */
 1238                         sctp_del_local_addr_restricted(stcb, aa->ifa);
 1239                         /* free the asconf param */
 1240                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1241                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
 1242                         return (-1);
 1243                 }
 1244         }                       /* for each aa */
 1245 
 1246         /* adding new request to the queue */
 1247         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 1248             SCTP_M_ASC_ADDR);
 1249         if (aa == NULL) {
 1250                 /* didn't get memory */
 1251                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
 1252                 return (-1);
 1253         }
 1254         aa->special_del = 0;
 1255         /* fill in asconf address parameter fields */
 1256         /* top level elements are "networked" during send */
 1257         aa->ap.aph.ph.param_type = type;
 1258         aa->ifa = ifa;
 1259         atomic_add_int(&ifa->refcount, 1);
 1260         /* correlation_id filled in during send routine later... */
 1261         switch (ifa->address.sa.sa_family) {
 1262 #ifdef INET6
 1263         case AF_INET6:
 1264                 {
 1265                         struct sockaddr_in6 *sin6;
 1266 
 1267                         sin6 = &ifa->address.sin6;
 1268                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 1269                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
 1270                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
 1271                             sizeof(struct sctp_ipv6addr_param);
 1272                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
 1273                             sizeof(struct in6_addr));
 1274                         break;
 1275                 }
 1276 #endif
 1277 #ifdef INET
 1278         case AF_INET:
 1279                 {
 1280                         struct sockaddr_in *sin;
 1281 
 1282                         sin = &ifa->address.sin;
 1283                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 1284                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
 1285                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
 1286                             sizeof(struct sctp_ipv4addr_param);
 1287                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
 1288                             sizeof(struct in_addr));
 1289                         break;
 1290                 }
 1291 #endif
 1292         default:
 1293                 /* invalid family! */
 1294                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1295                 sctp_free_ifa(ifa);
 1296                 return (-1);
 1297         }
 1298         aa->sent = 0;           /* clear sent flag */
 1299 
 1300         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 1301 #ifdef SCTP_DEBUG
 1302         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
 1303                 if (type == SCTP_ADD_IP_ADDRESS) {
 1304                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
 1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1306                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 1307                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
 1308                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1309                 } else {
 1310                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
 1311                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1312                 }
 1313         }
 1314 #endif
 1315 
 1316         return (0);
 1317 }
 1318 
 1319 
 1320 /*
 1321  * add an asconf operation for the given ifa and type.
 1322  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
 1323  * returns 0 if completed, -1 if not completed, 1 if immediate send is
 1324  * advisable.
 1325  */
 1326 static int
 1327 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
 1328     uint16_t type)
 1329 {
 1330         uint32_t status;
 1331         int pending_delete_queued = 0;
 1332         int last;
 1333 
 1334         /* see if peer supports ASCONF */
 1335         if (stcb->asoc.asconf_supported == 0) {
 1336                 return (-1);
 1337         }
 1338         /*
 1339          * if this is deleting the last address from the assoc, mark it as
 1340          * pending.
 1341          */
 1342         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
 1343                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 1344                         last = (sctp_local_addr_count(stcb) == 0);
 1345                 } else {
 1346                         last = (sctp_local_addr_count(stcb) == 1);
 1347                 }
 1348                 if (last) {
 1349                         /* set the pending delete info only */
 1350                         stcb->asoc.asconf_del_pending = 1;
 1351                         stcb->asoc.asconf_addr_del_pending = ifa;
 1352                         atomic_add_int(&ifa->refcount, 1);
 1353                         SCTPDBG(SCTP_DEBUG_ASCONF2,
 1354                             "asconf_queue_add: mark delete last address pending\n");
 1355                         return (-1);
 1356                 }
 1357         }
 1358         /* queue an asconf parameter */
 1359         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
 1360 
 1361         /*
 1362          * if this is an add, and there is a delete also pending (i.e. the
 1363          * last local address is being changed), queue the pending delete
 1364          * too.
 1365          */
 1366         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
 1367                 /* queue in the pending delete */
 1368                 if (sctp_asconf_queue_mgmt(stcb,
 1369                     stcb->asoc.asconf_addr_del_pending,
 1370                     SCTP_DEL_IP_ADDRESS) == 0) {
 1371                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
 1372                         pending_delete_queued = 1;
 1373                         /* clear out the pending delete info */
 1374                         stcb->asoc.asconf_del_pending = 0;
 1375                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
 1376                         stcb->asoc.asconf_addr_del_pending = NULL;
 1377                 }
 1378         }
 1379         if (pending_delete_queued) {
 1380                 struct sctp_nets *net;
 1381 
 1382                 /*
 1383                  * since we know that the only/last address is now being
 1384                  * changed in this case, reset the cwnd/rto on all nets to
 1385                  * start as a new address and path.  Also clear the error
 1386                  * counts to give the assoc the best chance to complete the
 1387                  * address change.
 1388                  */
 1389                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1390                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
 1391                             net);
 1392                         net->RTO = 0;
 1393                         net->error_count = 0;
 1394                 }
 1395                 stcb->asoc.overall_error_count = 0;
 1396                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 1397                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 1398                             stcb->asoc.overall_error_count,
 1399                             0,
 1400                             SCTP_FROM_SCTP_ASCONF,
 1401                             __LINE__);
 1402                 }
 1403                 /* queue in an advisory set primary too */
 1404                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
 1405                 /* let caller know we should send this out immediately */
 1406                 status = 1;
 1407         }
 1408         return (status);
 1409 }
 1410 
 1411 /*-
 1412  * add an asconf delete IP address parameter to the queue by sockaddr and
 1413  * possibly with no sctp_ifa available.  This is only called by the routine
 1414  * that checks the addresses in an INIT-ACK against the current address list.
 1415  * returns 0 if completed, non-zero if not completed.
 1416  * NOTE: if an add is already scheduled (and not yet sent out), simply
 1417  * remove it from queue.  If a duplicate operation is found, ignore the
 1418  * new one.
 1419  */
 1420 static int
 1421 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
 1422 {
 1423         struct sctp_ifa *ifa;
 1424         struct sctp_asconf_addr *aa, *aa_next;
 1425 
 1426         if (stcb == NULL) {
 1427                 return (-1);
 1428         }
 1429         /* see if peer supports ASCONF */
 1430         if (stcb->asoc.asconf_supported == 0) {
 1431                 return (-1);
 1432         }
 1433         /* make sure the request isn't already in the queue */
 1434         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1435                 /* address match? */
 1436                 if (sctp_asconf_addr_match(aa, sa) == 0)
 1437                         continue;
 1438                 /* is the request already in queue (sent or not) */
 1439                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
 1440                         return (-1);
 1441                 }
 1442                 /* is the negative request already in queue, and not sent */
 1443                 if (aa->sent == 1)
 1444                         continue;
 1445                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
 1446                         /* add already queued, so remove existing entry */
 1447                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1448                         sctp_del_local_addr_restricted(stcb, aa->ifa);
 1449                         /* free the entry */
 1450                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1451                         return (-1);
 1452                 }
 1453         }                       /* for each aa */
 1454 
 1455         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
 1456         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
 1457 
 1458         /* adding new request to the queue */
 1459         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 1460             SCTP_M_ASC_ADDR);
 1461         if (aa == NULL) {
 1462                 /* didn't get memory */
 1463                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1464                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
 1465                 return (-1);
 1466         }
 1467         aa->special_del = 0;
 1468         /* fill in asconf address parameter fields */
 1469         /* top level elements are "networked" during send */
 1470         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
 1471         aa->ifa = ifa;
 1472         if (ifa)
 1473                 atomic_add_int(&ifa->refcount, 1);
 1474         /* correlation_id filled in during send routine later... */
 1475         switch (sa->sa_family) {
 1476 #ifdef INET6
 1477         case AF_INET6:
 1478                 {
 1479                         /* IPv6 address */
 1480                         struct sockaddr_in6 *sin6;
 1481 
 1482                         sin6 = (struct sockaddr_in6 *)sa;
 1483                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 1484                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
 1485                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
 1486                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
 1487                             sizeof(struct in6_addr));
 1488                         break;
 1489                 }
 1490 #endif
 1491 #ifdef INET
 1492         case AF_INET:
 1493                 {
 1494                         /* IPv4 address */
 1495                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 1496 
 1497                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 1498                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
 1499                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
 1500                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
 1501                             sizeof(struct in_addr));
 1502                         break;
 1503                 }
 1504 #endif
 1505         default:
 1506                 /* invalid family! */
 1507                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1508                 if (ifa)
 1509                         sctp_free_ifa(ifa);
 1510                 return (-1);
 1511         }
 1512         aa->sent = 0;           /* clear sent flag */
 1513 
 1514         /* delete goes to the back of the queue */
 1515         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 1516 
 1517         /* sa_ignore MEMLEAK {memory is put on the tailq} */
 1518         return (0);
 1519 }
 1520 
 1521 /*
 1522  * find a specific asconf param on our "sent" queue
 1523  */
 1524 static struct sctp_asconf_addr *
 1525 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
 1526 {
 1527         struct sctp_asconf_addr *aa;
 1528 
 1529         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 1530                 if (aa->ap.aph.correlation_id == correlation_id &&
 1531                     aa->sent == 1) {
 1532                         /* found it */
 1533                         return (aa);
 1534                 }
 1535         }
 1536         /* didn't find it */
 1537         return (NULL);
 1538 }
 1539 
 1540 /*
 1541  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
 1542  * notifications based on the error response
 1543  */
 1544 static void
 1545 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
 1546     struct sctp_asconf_paramhdr *aph)
 1547 {
 1548         struct sctp_error_cause *eh;
 1549         struct sctp_paramhdr *ph;
 1550         uint16_t param_type;
 1551         uint16_t error_code;
 1552 
 1553         eh = (struct sctp_error_cause *)(aph + 1);
 1554         ph = (struct sctp_paramhdr *)(eh + 1);
 1555         /* validate lengths */
 1556         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
 1557             htons(aph->ph.param_length)) {
 1558                 /* invalid error cause length */
 1559                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1560                     "asconf_process_error: cause element too long\n");
 1561                 return;
 1562         }
 1563         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
 1564             htons(eh->length)) {
 1565                 /* invalid included TLV length */
 1566                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1567                     "asconf_process_error: included TLV too long\n");
 1568                 return;
 1569         }
 1570         /* which error code ? */
 1571         error_code = ntohs(eh->code);
 1572         param_type = ntohs(aph->ph.param_type);
 1573         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
 1574         switch (error_code) {
 1575         case SCTP_CAUSE_RESOURCE_SHORTAGE:
 1576                 /* we allow ourselves to "try again" for this error */
 1577                 break;
 1578         default:
 1579                 /* peer can't handle it... */
 1580                 switch (param_type) {
 1581                 case SCTP_ADD_IP_ADDRESS:
 1582                 case SCTP_DEL_IP_ADDRESS:
 1583                 case SCTP_SET_PRIM_ADDR:
 1584                         break;
 1585                 default:
 1586                         break;
 1587                 }
 1588         }
 1589 }
 1590 
 1591 /*
 1592  * process an asconf queue param.
 1593  * aparam: parameter to process, will be removed from the queue.
 1594  * flag: 1=success case, 0=failure case
 1595  */
 1596 static void
 1597 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
 1598     struct sctp_asconf_addr *aparam, uint32_t flag)
 1599 {
 1600         uint16_t param_type;
 1601 
 1602         /* process this param */
 1603         param_type = aparam->ap.aph.ph.param_type;
 1604         switch (param_type) {
 1605         case SCTP_ADD_IP_ADDRESS:
 1606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1607                     "process_param_ack: added IP address\n");
 1608                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
 1609                 break;
 1610         case SCTP_DEL_IP_ADDRESS:
 1611                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1612                     "process_param_ack: deleted IP address\n");
 1613                 /* nothing really to do... lists already updated */
 1614                 break;
 1615         case SCTP_SET_PRIM_ADDR:
 1616                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1617                     "process_param_ack: set primary IP address\n");
 1618                 /* nothing to do... peer may start using this addr */
 1619                 break;
 1620         default:
 1621                 /* should NEVER happen */
 1622                 break;
 1623         }
 1624 
 1625         /* remove the param and free it */
 1626         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
 1627         if (aparam->ifa)
 1628                 sctp_free_ifa(aparam->ifa);
 1629         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
 1630 }
 1631 
 1632 /*
 1633  * cleanup from a bad asconf ack parameter
 1634  */
 1635 static void
 1636 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
 1637 {
 1638         /* assume peer doesn't really know how to do asconfs */
 1639         /* XXX we could free the pending queue here */
 1640 
 1641 }
 1642 
 1643 void
 1644 sctp_handle_asconf_ack(struct mbuf *m, int offset,
 1645     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
 1646     struct sctp_nets *net, int *abort_no_unlock)
 1647 {
 1648         struct sctp_association *asoc;
 1649         uint32_t serial_num;
 1650         uint16_t ack_length;
 1651         struct sctp_asconf_paramhdr *aph;
 1652         struct sctp_asconf_addr *aa, *aa_next;
 1653         uint32_t last_error_id = 0;     /* last error correlation id */
 1654         uint32_t id;
 1655         struct sctp_asconf_addr *ap;
 1656 
 1657         /* asconf param buffer */
 1658         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 1659 
 1660         /* verify minimum length */
 1661         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
 1662                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1663                     "handle_asconf_ack: chunk too small = %xh\n",
 1664                     ntohs(cp->ch.chunk_length));
 1665                 return;
 1666         }
 1667         asoc = &stcb->asoc;
 1668         serial_num = ntohl(cp->serial_number);
 1669 
 1670         /*
 1671          * NOTE: we may want to handle this differently- currently, we will
 1672          * abort when we get an ack for the expected serial number + 1 (eg.
 1673          * we didn't send it), process an ack normally if it is the expected
 1674          * serial number, and re-send the previous ack for *ALL* other
 1675          * serial numbers
 1676          */
 1677 
 1678         /*
 1679          * if the serial number is the next expected, but I didn't send it,
 1680          * abort the asoc, since someone probably just hijacked us...
 1681          */
 1682         if (serial_num == (asoc->asconf_seq_out + 1)) {
 1683                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
 1684                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
 1685                 *abort_no_unlock = 1;
 1686                 return;
 1687         }
 1688         if (serial_num != asoc->asconf_seq_out_acked + 1) {
 1689                 /* got a duplicate/unexpected ASCONF-ACK */
 1690                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
 1691                     serial_num, asoc->asconf_seq_out_acked + 1);
 1692                 return;
 1693         }
 1694         if (serial_num == asoc->asconf_seq_out - 1) {
 1695                 /* stop our timer */
 1696                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 1697                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
 1698         }
 1699         /* process the ASCONF-ACK contents */
 1700         ack_length = ntohs(cp->ch.chunk_length) -
 1701             sizeof(struct sctp_asconf_ack_chunk);
 1702         offset += sizeof(struct sctp_asconf_ack_chunk);
 1703         /* process through all parameters */
 1704         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
 1705                 unsigned int param_length, param_type;
 1706 
 1707                 /* get pointer to next asconf parameter */
 1708                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 1709                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 1710                 if (aph == NULL) {
 1711                         /* can't get an asconf paramhdr */
 1712                         sctp_asconf_ack_clear(stcb);
 1713                         return;
 1714                 }
 1715                 param_type = ntohs(aph->ph.param_type);
 1716                 param_length = ntohs(aph->ph.param_length);
 1717                 if (param_length > ack_length) {
 1718                         sctp_asconf_ack_clear(stcb);
 1719                         return;
 1720                 }
 1721                 if (param_length < sizeof(struct sctp_paramhdr)) {
 1722                         sctp_asconf_ack_clear(stcb);
 1723                         return;
 1724                 }
 1725                 /* get the complete parameter... */
 1726                 if (param_length > sizeof(aparam_buf)) {
 1727                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 1728                             "param length (%u) larger than buffer size!\n", param_length);
 1729                         sctp_asconf_ack_clear(stcb);
 1730                         return;
 1731                 }
 1732                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 1733                 if (aph == NULL) {
 1734                         sctp_asconf_ack_clear(stcb);
 1735                         return;
 1736                 }
 1737                 /* correlation_id is transparent to peer, no ntohl needed */
 1738                 id = aph->correlation_id;
 1739 
 1740                 switch (param_type) {
 1741                 case SCTP_ERROR_CAUSE_IND:
 1742                         last_error_id = id;
 1743                         /* find the corresponding asconf param in our queue */
 1744                         ap = sctp_asconf_find_param(stcb, id);
 1745                         if (ap == NULL) {
 1746                                 /* hmm... can't find this in our queue! */
 1747                                 break;
 1748                         }
 1749                         /* process the parameter, failed flag */
 1750                         sctp_asconf_process_param_ack(stcb, ap, 0);
 1751                         /* process the error response */
 1752                         sctp_asconf_process_error(stcb, aph);
 1753                         break;
 1754                 case SCTP_SUCCESS_REPORT:
 1755                         /* find the corresponding asconf param in our queue */
 1756                         ap = sctp_asconf_find_param(stcb, id);
 1757                         if (ap == NULL) {
 1758                                 /* hmm... can't find this in our queue! */
 1759                                 break;
 1760                         }
 1761                         /* process the parameter, success flag */
 1762                         sctp_asconf_process_param_ack(stcb, ap, 1);
 1763                         break;
 1764                 default:
 1765                         break;
 1766                 }               /* switch */
 1767 
 1768                 /* update remaining ASCONF-ACK message length to process */
 1769                 ack_length -= SCTP_SIZE32(param_length);
 1770                 if (ack_length <= 0) {
 1771                         /* no more data in the mbuf chain */
 1772                         break;
 1773                 }
 1774                 offset += SCTP_SIZE32(param_length);
 1775         }                       /* while */
 1776 
 1777         /*
 1778          * if there are any "sent" params still on the queue, these are
 1779          * implicitly "success", or "failed" (if we got an error back) ...
 1780          * so process these appropriately
 1781          * 
 1782          * we assume that the correlation_id's are monotonically increasing
 1783          * beginning from 1 and that we don't have *that* many outstanding
 1784          * at any given time
 1785          */
 1786         if (last_error_id == 0)
 1787                 last_error_id--;/* set to "max" value */
 1788         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1789                 if (aa->sent == 1) {
 1790                         /*
 1791                          * implicitly successful or failed if correlation_id
 1792                          * < last_error_id, then success else, failure
 1793                          */
 1794                         if (aa->ap.aph.correlation_id < last_error_id)
 1795                                 sctp_asconf_process_param_ack(stcb, aa, 1);
 1796                         else
 1797                                 sctp_asconf_process_param_ack(stcb, aa, 0);
 1798                 } else {
 1799                         /*
 1800                          * since we always process in order (FIFO queue) if
 1801                          * we reach one that hasn't been sent, the rest
 1802                          * should not have been sent either. so, we're
 1803                          * done...
 1804                          */
 1805                         break;
 1806                 }
 1807         }
 1808 
 1809         /* update the next sequence number to use */
 1810         asoc->asconf_seq_out_acked++;
 1811         /* remove the old ASCONF on our outbound queue */
 1812         sctp_toss_old_asconf(stcb);
 1813         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
 1814 #ifdef SCTP_TIMER_BASED_ASCONF
 1815                 /* we have more params, so restart our timer */
 1816                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
 1817                     stcb, net);
 1818 #else
 1819                 /* we have more params, so send out more */
 1820                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
 1821 #endif
 1822         }
 1823 }
 1824 
 1825 #ifdef INET6
 1826 static uint32_t
 1827 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
 1828 {
 1829         struct sockaddr_in6 *sin6, *net6;
 1830         struct sctp_nets *net;
 1831 
 1832         if (sa->sa_family != AF_INET6) {
 1833                 /* wrong family */
 1834                 return (0);
 1835         }
 1836         sin6 = (struct sockaddr_in6 *)sa;
 1837         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
 1838                 /* not link local address */
 1839                 return (0);
 1840         }
 1841         /* hunt through our destination nets list for this scope_id */
 1842         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1843                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
 1844                     AF_INET6)
 1845                         continue;
 1846                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 1847                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
 1848                         continue;
 1849                 if (sctp_is_same_scope(sin6, net6)) {
 1850                         /* found one */
 1851                         return (1);
 1852                 }
 1853         }
 1854         /* didn't find one */
 1855         return (0);
 1856 }
 1857 
 1858 #endif
 1859 
 1860 /*
 1861  * address management functions
 1862  */
 1863 static void
 1864 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 1865     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
 1866 {
 1867         int status;
 1868 
 1869         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
 1870             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
 1871                 /* subset bound, no ASCONF allowed case, so ignore */
 1872                 return;
 1873         }
 1874         /*
 1875          * note: we know this is not the subset bound, no ASCONF case eg.
 1876          * this is boundall or subset bound w/ASCONF allowed
 1877          */
 1878 
 1879         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
 1880         switch (ifa->address.sa.sa_family) {
 1881 #ifdef INET6
 1882         case AF_INET6:
 1883                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
 1884                     &ifa->address.sin6.sin6_addr) != 0) {
 1885                         return;
 1886                 }
 1887                 break;
 1888 #endif
 1889 #ifdef INET
 1890         case AF_INET:
 1891                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
 1892                     &ifa->address.sin.sin_addr) != 0) {
 1893                         return;
 1894                 }
 1895                 break;
 1896 #endif
 1897         default:
 1898                 return;
 1899         }
 1900 #ifdef INET6
 1901         /* make sure we're "allowed" to add this type of addr */
 1902         if (ifa->address.sa.sa_family == AF_INET6) {
 1903                 /* invalid if we're not a v6 endpoint */
 1904                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
 1905                         return;
 1906                 /* is the v6 addr really valid ? */
 1907                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
 1908                         return;
 1909                 }
 1910         }
 1911 #endif
 1912         /* put this address on the "pending/do not use yet" list */
 1913         sctp_add_local_addr_restricted(stcb, ifa);
 1914         /*
 1915          * check address scope if address is out of scope, don't queue
 1916          * anything... note: this would leave the address on both inp and
 1917          * asoc lists
 1918          */
 1919         switch (ifa->address.sa.sa_family) {
 1920 #ifdef INET6
 1921         case AF_INET6:
 1922                 {
 1923                         struct sockaddr_in6 *sin6;
 1924 
 1925                         sin6 = &ifa->address.sin6;
 1926                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 1927                                 /* we skip unspecifed addresses */
 1928                                 return;
 1929                         }
 1930                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 1931                                 if (stcb->asoc.scope.local_scope == 0) {
 1932                                         return;
 1933                                 }
 1934                                 /* is it the right link local scope? */
 1935                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
 1936                                         return;
 1937                                 }
 1938                         }
 1939                         if (stcb->asoc.scope.site_scope == 0 &&
 1940                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
 1941                                 return;
 1942                         }
 1943                         break;
 1944                 }
 1945 #endif
 1946 #ifdef INET
 1947         case AF_INET:
 1948                 {
 1949                         struct sockaddr_in *sin;
 1950                         struct in6pcb *inp6;
 1951 
 1952                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 1953                         /* invalid if we are a v6 only endpoint */
 1954                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 1955                             SCTP_IPV6_V6ONLY(inp6))
 1956                                 return;
 1957 
 1958                         sin = &ifa->address.sin;
 1959                         if (sin->sin_addr.s_addr == 0) {
 1960                                 /* we skip unspecifed addresses */
 1961                                 return;
 1962                         }
 1963                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 1964                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 1965                                 return;
 1966                         }
 1967                         break;
 1968                 }
 1969 #endif
 1970         default:
 1971                 /* else, not AF_INET or AF_INET6, so skip */
 1972                 return;
 1973         }
 1974 
 1975         /* queue an asconf for this address add/delete */
 1976         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
 1977                 /* does the peer do asconf? */
 1978                 if (stcb->asoc.asconf_supported) {
 1979                         /* queue an asconf for this addr */
 1980                         status = sctp_asconf_queue_add(stcb, ifa, type);
 1981 
 1982                         /*
 1983                          * if queued ok, and in the open state, send out the
 1984                          * ASCONF.  If in the non-open state, these will be
 1985                          * sent when the state goes open.
 1986                          */
 1987                         if (status == 0 &&
 1988                             ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 1989                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
 1990 #ifdef SCTP_TIMER_BASED_ASCONF
 1991                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
 1992                                     stcb, stcb->asoc.primary_destination);
 1993 #else
 1994                                 sctp_send_asconf(stcb, NULL, addr_locked);
 1995 #endif
 1996                         }
 1997                 }
 1998         }
 1999 }
 2000 
 2001 
 2002 int
 2003 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
 2004 {
 2005         struct sctp_asconf_iterator *asc;
 2006         struct sctp_ifa *ifa;
 2007         struct sctp_laddr *l;
 2008         int cnt_invalid = 0;
 2009 
 2010         asc = (struct sctp_asconf_iterator *)ptr;
 2011         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2012                 ifa = l->ifa;
 2013                 switch (ifa->address.sa.sa_family) {
 2014 #ifdef INET6
 2015                 case AF_INET6:
 2016                         /* invalid if we're not a v6 endpoint */
 2017                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 2018                                 cnt_invalid++;
 2019                                 if (asc->cnt == cnt_invalid)
 2020                                         return (1);
 2021                         }
 2022                         break;
 2023 #endif
 2024 #ifdef INET
 2025                 case AF_INET:
 2026                         {
 2027                                 /* invalid if we are a v6 only endpoint */
 2028                                 struct in6pcb *inp6;
 2029 
 2030                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 2031                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2032                                     SCTP_IPV6_V6ONLY(inp6)) {
 2033                                         cnt_invalid++;
 2034                                         if (asc->cnt == cnt_invalid)
 2035                                                 return (1);
 2036                                 }
 2037                                 break;
 2038                         }
 2039 #endif
 2040                 default:
 2041                         /* invalid address family */
 2042                         cnt_invalid++;
 2043                         if (asc->cnt == cnt_invalid)
 2044                                 return (1);
 2045                 }
 2046         }
 2047         return (0);
 2048 }
 2049 
 2050 static int
 2051 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
 2052 {
 2053         struct sctp_ifa *ifa;
 2054         struct sctp_asconf_iterator *asc;
 2055         struct sctp_laddr *laddr, *nladdr, *l;
 2056 
 2057         /* Only for specific case not bound all */
 2058         asc = (struct sctp_asconf_iterator *)ptr;
 2059         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2060                 ifa = l->ifa;
 2061                 if (l->action == SCTP_ADD_IP_ADDRESS) {
 2062                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
 2063                             sctp_nxt_addr) {
 2064                                 if (laddr->ifa == ifa) {
 2065                                         laddr->action = 0;
 2066                                         break;
 2067                                 }
 2068                         }
 2069                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
 2070                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
 2071                                 /* remove only after all guys are done */
 2072                                 if (laddr->ifa == ifa) {
 2073                                         sctp_del_local_addr_ep(inp, ifa);
 2074                                 }
 2075                         }
 2076                 }
 2077         }
 2078         return (0);
 2079 }
 2080 
 2081 void
 2082 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 2083     void *ptr, uint32_t val SCTP_UNUSED)
 2084 {
 2085         struct sctp_asconf_iterator *asc;
 2086         struct sctp_ifa *ifa;
 2087         struct sctp_laddr *l;
 2088         int cnt_invalid = 0;
 2089         int type, status;
 2090         int num_queued = 0;
 2091 
 2092         asc = (struct sctp_asconf_iterator *)ptr;
 2093         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2094                 ifa = l->ifa;
 2095                 type = l->action;
 2096 
 2097                 /* address's vrf_id must be the vrf_id of the assoc */
 2098                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
 2099                         continue;
 2100                 }
 2101                 /* Same checks again for assoc */
 2102                 switch (ifa->address.sa.sa_family) {
 2103 #ifdef INET6
 2104                 case AF_INET6:
 2105                         {
 2106                                 /* invalid if we're not a v6 endpoint */
 2107                                 struct sockaddr_in6 *sin6;
 2108 
 2109                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 2110                                         cnt_invalid++;
 2111                                         if (asc->cnt == cnt_invalid)
 2112                                                 return;
 2113                                         else
 2114                                                 continue;
 2115                                 }
 2116                                 sin6 = &ifa->address.sin6;
 2117                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 2118                                         /* we skip unspecifed addresses */
 2119                                         continue;
 2120                                 }
 2121                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
 2122                                     &sin6->sin6_addr) != 0) {
 2123                                         continue;
 2124                                 }
 2125                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 2126                                         if (stcb->asoc.scope.local_scope == 0) {
 2127                                                 continue;
 2128                                         }
 2129                                         /* is it the right link local scope? */
 2130                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
 2131                                                 continue;
 2132                                         }
 2133                                 }
 2134                                 break;
 2135                         }
 2136 #endif
 2137 #ifdef INET
 2138                 case AF_INET:
 2139                         {
 2140                                 /* invalid if we are a v6 only endpoint */
 2141                                 struct in6pcb *inp6;
 2142                                 struct sockaddr_in *sin;
 2143 
 2144                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 2145                                 /* invalid if we are a v6 only endpoint */
 2146                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2147                                     SCTP_IPV6_V6ONLY(inp6))
 2148                                         continue;
 2149 
 2150                                 sin = &ifa->address.sin;
 2151                                 if (sin->sin_addr.s_addr == 0) {
 2152                                         /* we skip unspecifed addresses */
 2153                                         continue;
 2154                                 }
 2155                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
 2156                                     &sin->sin_addr) != 0) {
 2157                                         continue;
 2158                                 }
 2159                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 2160                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 2161                                         continue;
 2162                                 }
 2163                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2164                                     SCTP_IPV6_V6ONLY(inp6)) {
 2165                                         cnt_invalid++;
 2166                                         if (asc->cnt == cnt_invalid)
 2167                                                 return;
 2168                                         else
 2169                                                 continue;
 2170                                 }
 2171                                 break;
 2172                         }
 2173 #endif
 2174                 default:
 2175                         /* invalid address family */
 2176                         cnt_invalid++;
 2177                         if (asc->cnt == cnt_invalid)
 2178                                 return;
 2179                         else
 2180                                 continue;
 2181                         break;
 2182                 }
 2183 
 2184                 if (type == SCTP_ADD_IP_ADDRESS) {
 2185                         /* prevent this address from being used as a source */
 2186                         sctp_add_local_addr_restricted(stcb, ifa);
 2187                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 2188                         struct sctp_nets *net;
 2189 
 2190                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 2191                                 sctp_rtentry_t *rt;
 2192 
 2193                                 /* delete this address if cached */
 2194                                 if (net->ro._s_addr == ifa) {
 2195                                         sctp_free_ifa(net->ro._s_addr);
 2196                                         net->ro._s_addr = NULL;
 2197                                         net->src_addr_selected = 0;
 2198                                         rt = net->ro.ro_rt;
 2199                                         if (rt) {
 2200                                                 RTFREE(rt);
 2201                                                 net->ro.ro_rt = NULL;
 2202                                         }
 2203                                         /*
 2204                                          * Now we deleted our src address,
 2205                                          * should we not also now reset the
 2206                                          * cwnd/rto to start as if its a new
 2207                                          * address?
 2208                                          */
 2209                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
 2210                                         net->RTO = 0;
 2211 
 2212                                 }
 2213                         }
 2214                 } else if (type == SCTP_SET_PRIM_ADDR) {
 2215                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 2216                                 /* must validate the ifa is in the ep */
 2217                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
 2218                                         continue;
 2219                                 }
 2220                         } else {
 2221                                 /* Need to check scopes for this guy */
 2222                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
 2223                                         continue;
 2224                                 }
 2225                         }
 2226                 }
 2227                 /* queue an asconf for this address add/delete */
 2228                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
 2229                     stcb->asoc.asconf_supported == 1) {
 2230                         /* queue an asconf for this addr */
 2231                         status = sctp_asconf_queue_add(stcb, ifa, type);
 2232                         /*
 2233                          * if queued ok, and in the open state, update the
 2234                          * count of queued params.  If in the non-open
 2235                          * state, these get sent when the assoc goes open.
 2236                          */
 2237                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2238                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2239                                 if (status >= 0) {
 2240                                         num_queued++;
 2241                                 }
 2242                         }
 2243                 }
 2244         }
 2245         /*
 2246          * If we have queued params in the open state, send out an ASCONF.
 2247          */
 2248         if (num_queued > 0) {
 2249                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2250         }
 2251 }
 2252 
 2253 void
 2254 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
 2255 {
 2256         struct sctp_asconf_iterator *asc;
 2257         struct sctp_ifa *ifa;
 2258         struct sctp_laddr *l, *nl;
 2259 
 2260         asc = (struct sctp_asconf_iterator *)ptr;
 2261         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
 2262                 ifa = l->ifa;
 2263                 if (l->action == SCTP_ADD_IP_ADDRESS) {
 2264                         /* Clear the defer use flag */
 2265                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
 2266                 }
 2267                 sctp_free_ifa(ifa);
 2268                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
 2269                 SCTP_DECR_LADDR_COUNT();
 2270         }
 2271         SCTP_FREE(asc, SCTP_M_ASC_IT);
 2272 }
 2273 
 2274 /*
 2275  * sa is the sockaddr to ask the peer to set primary to.
 2276  * returns: 0 = completed, -1 = error
 2277  */
 2278 int32_t
 2279 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
 2280 {
 2281         uint32_t vrf_id;
 2282         struct sctp_ifa *ifa;
 2283 
 2284         /* find the ifa for the desired set primary */
 2285         vrf_id = stcb->asoc.vrf_id;
 2286         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
 2287         if (ifa == NULL) {
 2288                 /* Invalid address */
 2289                 return (-1);
 2290         }
 2291         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
 2292         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
 2293                 /* set primary queuing succeeded */
 2294                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2295                     "set_primary_ip_address_sa: queued on tcb=%p, ",
 2296                     (void *)stcb);
 2297                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 2298                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2299                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2300 #ifdef SCTP_TIMER_BASED_ASCONF
 2301                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2302                             stcb->sctp_ep, stcb,
 2303                             stcb->asoc.primary_destination);
 2304 #else
 2305                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2306 #endif
 2307                 }
 2308         } else {
 2309                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
 2310                     (void *)stcb);
 2311                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 2312                 return (-1);
 2313         }
 2314         return (0);
 2315 }
 2316 
 2317 void
 2318 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
 2319 {
 2320         struct sctp_inpcb *inp;
 2321 
 2322         /* go through all our PCB's */
 2323         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
 2324                 struct sctp_tcb *stcb;
 2325 
 2326                 /* process for all associations for this endpoint */
 2327                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 2328                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
 2329                         if (!sctp_asconf_queue_add(stcb, ifa,
 2330                             SCTP_SET_PRIM_ADDR)) {
 2331                                 /* set primary queuing succeeded */
 2332                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
 2333                                     (void *)stcb);
 2334                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
 2335                                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2336                                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2337 #ifdef SCTP_TIMER_BASED_ASCONF
 2338                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2339                                             stcb->sctp_ep, stcb,
 2340                                             stcb->asoc.primary_destination);
 2341 #else
 2342                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2343 #endif
 2344                                 }
 2345                         }
 2346                 }               /* for each stcb */
 2347         }                       /* for each inp */
 2348 }
 2349 
 2350 int
 2351 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
 2352 {
 2353         struct sctp_tmit_chunk *chk, *nchk;
 2354         unsigned int offset, asconf_limit;
 2355         struct sctp_asconf_chunk *acp;
 2356         struct sctp_asconf_paramhdr *aph;
 2357         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 2358         struct sctp_paramhdr *ph;
 2359         int add_cnt, del_cnt;
 2360         uint16_t last_param_type;
 2361 
 2362         add_cnt = del_cnt = 0;
 2363         last_param_type = 0;
 2364         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
 2365                 if (chk->data == NULL) {
 2366                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
 2367                         continue;
 2368                 }
 2369                 offset = 0;
 2370                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
 2371                 offset += sizeof(struct sctp_asconf_chunk);
 2372                 asconf_limit = ntohs(acp->ch.chunk_length);
 2373                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
 2374                 if (ph == NULL) {
 2375                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
 2376                         continue;
 2377                 }
 2378                 offset += ntohs(ph->param_length);
 2379 
 2380                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 2381                 if (aph == NULL) {
 2382                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
 2383                         continue;
 2384                 }
 2385                 while (aph != NULL) {
 2386                         unsigned int param_length, param_type;
 2387 
 2388                         param_type = ntohs(aph->ph.param_type);
 2389                         param_length = ntohs(aph->ph.param_length);
 2390                         if (offset + param_length > asconf_limit) {
 2391                                 /* parameter goes beyond end of chunk! */
 2392                                 break;
 2393                         }
 2394                         if (param_length > sizeof(aparam_buf)) {
 2395                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
 2396                                 break;
 2397                         }
 2398                         if (param_length <= sizeof(struct sctp_paramhdr)) {
 2399                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
 2400                                 break;
 2401                         }
 2402                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
 2403                         if (aph == NULL) {
 2404                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
 2405                                 break;
 2406                         }
 2407                         ph = (struct sctp_paramhdr *)(aph + 1);
 2408                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
 2409                                 switch (param_type) {
 2410                                 case SCTP_ADD_IP_ADDRESS:
 2411                                         add_cnt++;
 2412                                         break;
 2413                                 case SCTP_DEL_IP_ADDRESS:
 2414                                         del_cnt++;
 2415                                         break;
 2416                                 default:
 2417                                         break;
 2418                                 }
 2419                                 last_param_type = param_type;
 2420                         }
 2421                         offset += SCTP_SIZE32(param_length);
 2422                         if (offset >= asconf_limit) {
 2423                                 /* no more data in the mbuf chain */
 2424                                 break;
 2425                         }
 2426                         /* get pointer to next asconf param */
 2427                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 2428                 }
 2429         }
 2430 
 2431         /*
 2432          * we want to find the sequences which consist of ADD -> DEL -> ADD
 2433          * or DEL -> ADD
 2434          */
 2435         if (add_cnt > del_cnt ||
 2436             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
 2437                 return (1);
 2438         }
 2439         return (0);
 2440 }
 2441 
 2442 static struct sockaddr *
 2443 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
 2444 {
 2445         struct sctp_vrf *vrf = NULL;
 2446         struct sctp_ifn *sctp_ifn;
 2447         struct sctp_ifa *sctp_ifa;
 2448 
 2449         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2450                 SCTP_IPI_ADDR_RLOCK();
 2451         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
 2452         if (vrf == NULL) {
 2453                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2454                         SCTP_IPI_ADDR_RUNLOCK();
 2455                 return (NULL);
 2456         }
 2457         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
 2458                 if (stcb->asoc.scope.loopback_scope == 0 &&
 2459                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
 2460                         /* Skip if loopback_scope not set */
 2461                         continue;
 2462                 }
 2463                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
 2464                         switch (sctp_ifa->address.sa.sa_family) {
 2465 #ifdef INET
 2466                         case AF_INET:
 2467                                 if (stcb->asoc.scope.ipv4_addr_legal) {
 2468                                         struct sockaddr_in *sin;
 2469 
 2470                                         sin = &sctp_ifa->address.sin;
 2471                                         if (sin->sin_addr.s_addr == 0) {
 2472                                                 /* skip unspecifed addresses */
 2473                                                 continue;
 2474                                         }
 2475                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 2476                                             &sin->sin_addr) != 0) {
 2477                                                 continue;
 2478                                         }
 2479                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 2480                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
 2481                                                 continue;
 2482 
 2483                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
 2484                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
 2485                                                 continue;
 2486                                         /*
 2487                                          * found a valid local v4 address to
 2488                                          * use
 2489                                          */
 2490                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2491                                                 SCTP_IPI_ADDR_RUNLOCK();
 2492                                         return (&sctp_ifa->address.sa);
 2493                                 }
 2494                                 break;
 2495 #endif
 2496 #ifdef INET6
 2497                         case AF_INET6:
 2498                                 if (stcb->asoc.scope.ipv6_addr_legal) {
 2499                                         struct sockaddr_in6 *sin6;
 2500 
 2501                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
 2502                                                 continue;
 2503                                         }
 2504                                         sin6 = &sctp_ifa->address.sin6;
 2505                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 2506                                                 /*
 2507                                                  * we skip unspecifed
 2508                                                  * addresses
 2509                                                  */
 2510                                                 continue;
 2511                                         }
 2512                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 2513                                             &sin6->sin6_addr) != 0) {
 2514                                                 continue;
 2515                                         }
 2516                                         if (stcb->asoc.scope.local_scope == 0 &&
 2517                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
 2518                                                 continue;
 2519                                         if (stcb->asoc.scope.site_scope == 0 &&
 2520                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
 2521                                                 continue;
 2522 
 2523                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
 2524                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
 2525                                                 continue;
 2526                                         /*
 2527                                          * found a valid local v6 address to
 2528                                          * use
 2529                                          */
 2530                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2531                                                 SCTP_IPI_ADDR_RUNLOCK();
 2532                                         return (&sctp_ifa->address.sa);
 2533                                 }
 2534                                 break;
 2535 #endif
 2536                         default:
 2537                                 break;
 2538                         }
 2539                 }
 2540         }
 2541         /* no valid addresses found */
 2542         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2543                 SCTP_IPI_ADDR_RUNLOCK();
 2544         return (NULL);
 2545 }
 2546 
 2547 static struct sockaddr *
 2548 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
 2549 {
 2550         struct sctp_laddr *laddr;
 2551 
 2552         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 2553                 if (laddr->ifa == NULL) {
 2554                         continue;
 2555                 }
 2556                 /* is the address restricted ? */
 2557                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
 2558                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
 2559                         continue;
 2560 
 2561                 /* found a valid local address to use */
 2562                 return (&laddr->ifa->address.sa);
 2563         }
 2564         /* no valid addresses found */
 2565         return (NULL);
 2566 }
 2567 
 2568 /*
 2569  * builds an ASCONF chunk from queued ASCONF params.
 2570  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
 2571  */
 2572 struct mbuf *
 2573 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
 2574 {
 2575         struct mbuf *m_asconf, *m_asconf_chk;
 2576         struct sctp_asconf_addr *aa;
 2577         struct sctp_asconf_chunk *acp;
 2578         struct sctp_asconf_paramhdr *aph;
 2579         struct sctp_asconf_addr_param *aap;
 2580         uint32_t p_length;
 2581         uint32_t correlation_id = 1;    /* 0 is reserved... */
 2582         caddr_t ptr, lookup_ptr;
 2583         uint8_t lookup_used = 0;
 2584 
 2585         /* are there any asconf params to send? */
 2586         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 2587                 if (aa->sent == 0)
 2588                         break;
 2589         }
 2590         if (aa == NULL)
 2591                 return (NULL);
 2592 
 2593         /*
 2594          * get a chunk header mbuf and a cluster for the asconf params since
 2595          * it's simpler to fill in the asconf chunk header lookup address on
 2596          * the fly
 2597          */
 2598         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
 2599         if (m_asconf_chk == NULL) {
 2600                 /* no mbuf's */
 2601                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2602                     "compose_asconf: couldn't get chunk mbuf!\n");
 2603                 return (NULL);
 2604         }
 2605         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
 2606         if (m_asconf == NULL) {
 2607                 /* no mbuf's */
 2608                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2609                     "compose_asconf: couldn't get mbuf!\n");
 2610                 sctp_m_freem(m_asconf_chk);
 2611                 return (NULL);
 2612         }
 2613         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
 2614         SCTP_BUF_LEN(m_asconf) = 0;
 2615         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
 2616         bzero(acp, sizeof(struct sctp_asconf_chunk));
 2617         /* save pointers to lookup address and asconf params */
 2618         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
 2619         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
 2620 
 2621         /* fill in chunk header info */
 2622         acp->ch.chunk_type = SCTP_ASCONF;
 2623         acp->ch.chunk_flags = 0;
 2624         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
 2625         stcb->asoc.asconf_seq_out++;
 2626 
 2627         /* add parameters... up to smallest MTU allowed */
 2628         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 2629                 if (aa->sent)
 2630                         continue;
 2631                 /* get the parameter length */
 2632                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
 2633                 /* will it fit in current chunk? */
 2634                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
 2635                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
 2636                         /* won't fit, so we're done with this chunk */
 2637                         break;
 2638                 }
 2639                 /* assign (and store) a correlation id */
 2640                 aa->ap.aph.correlation_id = correlation_id++;
 2641 
 2642                 /*
 2643                  * fill in address if we're doing a delete this is a simple
 2644                  * way for us to fill in the correlation address, which
 2645                  * should only be used by the peer if we're deleting our
 2646                  * source address and adding a new address (e.g. renumbering
 2647                  * case)
 2648                  */
 2649                 if (lookup_used == 0 &&
 2650                     (aa->special_del == 0) &&
 2651                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
 2652                         struct sctp_ipv6addr_param *lookup;
 2653                         uint16_t p_size, addr_size;
 2654 
 2655                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
 2656                         lookup->ph.param_type =
 2657                             htons(aa->ap.addrp.ph.param_type);
 2658                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
 2659                                 /* copy IPv6 address */
 2660                                 p_size = sizeof(struct sctp_ipv6addr_param);
 2661                                 addr_size = sizeof(struct in6_addr);
 2662                         } else {
 2663                                 /* copy IPv4 address */
 2664                                 p_size = sizeof(struct sctp_ipv4addr_param);
 2665                                 addr_size = sizeof(struct in_addr);
 2666                         }
 2667                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
 2668                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
 2669                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
 2670                         lookup_used = 1;
 2671                 }
 2672                 /* copy into current space */
 2673                 memcpy(ptr, &aa->ap, p_length);
 2674 
 2675                 /* network elements and update lengths */
 2676                 aph = (struct sctp_asconf_paramhdr *)ptr;
 2677                 aap = (struct sctp_asconf_addr_param *)ptr;
 2678                 /* correlation_id is transparent to peer, no htonl needed */
 2679                 aph->ph.param_type = htons(aph->ph.param_type);
 2680                 aph->ph.param_length = htons(aph->ph.param_length);
 2681                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
 2682                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
 2683 
 2684                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
 2685                 ptr += SCTP_SIZE32(p_length);
 2686 
 2687                 /*
 2688                  * these params are removed off the pending list upon
 2689                  * getting an ASCONF-ACK back from the peer, just set flag
 2690                  */
 2691                 aa->sent = 1;
 2692         }
 2693         /* check to see if the lookup addr has been populated yet */
 2694         if (lookup_used == 0) {
 2695                 /* NOTE: if the address param is optional, can skip this... */
 2696                 /* add any valid (existing) address... */
 2697                 struct sctp_ipv6addr_param *lookup;
 2698                 uint16_t p_size, addr_size;
 2699                 struct sockaddr *found_addr;
 2700                 caddr_t addr_ptr;
 2701 
 2702                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
 2703                         found_addr = sctp_find_valid_localaddr(stcb,
 2704                             addr_locked);
 2705                 else
 2706                         found_addr = sctp_find_valid_localaddr_ep(stcb);
 2707 
 2708                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
 2709                 if (found_addr != NULL) {
 2710                         switch (found_addr->sa_family) {
 2711 #ifdef INET6
 2712                         case AF_INET6:
 2713                                 /* copy IPv6 address */
 2714                                 lookup->ph.param_type =
 2715                                     htons(SCTP_IPV6_ADDRESS);
 2716                                 p_size = sizeof(struct sctp_ipv6addr_param);
 2717                                 addr_size = sizeof(struct in6_addr);
 2718                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
 2719                                     found_addr)->sin6_addr;
 2720                                 break;
 2721 #endif
 2722 #ifdef INET
 2723                         case AF_INET:
 2724                                 /* copy IPv4 address */
 2725                                 lookup->ph.param_type =
 2726                                     htons(SCTP_IPV4_ADDRESS);
 2727                                 p_size = sizeof(struct sctp_ipv4addr_param);
 2728                                 addr_size = sizeof(struct in_addr);
 2729                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
 2730                                     found_addr)->sin_addr;
 2731                                 break;
 2732 #endif
 2733                         default:
 2734                                 p_size = 0;
 2735                                 addr_size = 0;
 2736                                 addr_ptr = NULL;
 2737                                 break;
 2738                         }
 2739                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
 2740                         memcpy(lookup->addr, addr_ptr, addr_size);
 2741                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
 2742                 } else {
 2743                         /* uh oh... don't have any address?? */
 2744                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 2745                             "compose_asconf: no lookup addr!\n");
 2746                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
 2747                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
 2748                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
 2749                         bzero(lookup->addr, sizeof(struct in_addr));
 2750                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
 2751                 }
 2752         }
 2753         /* chain it all together */
 2754         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
 2755         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
 2756         acp->ch.chunk_length = htons(*retlen);
 2757 
 2758         return (m_asconf_chk);
 2759 }
 2760 
 2761 /*
 2762  * section to handle address changes before an association is up eg. changes
 2763  * during INIT/INIT-ACK/COOKIE-ECHO handshake
 2764  */
 2765 
 2766 /*
 2767  * processes the (local) addresses in the INIT-ACK chunk
 2768  */
 2769 static void
 2770 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
 2771     unsigned int offset, unsigned int length)
 2772 {
 2773         struct sctp_paramhdr tmp_param, *ph;
 2774         uint16_t plen, ptype;
 2775         struct sctp_ifa *sctp_ifa;
 2776         union sctp_sockstore store;
 2777 
 2778 #ifdef INET6
 2779         struct sctp_ipv6addr_param addr6_store;
 2780 
 2781 #endif
 2782 #ifdef INET
 2783         struct sctp_ipv4addr_param addr4_store;
 2784 
 2785 #endif
 2786 
 2787         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
 2788         if (stcb == NULL)       /* Un-needed check for SA */
 2789                 return;
 2790 
 2791         /* convert to upper bound */
 2792         length += offset;
 2793 
 2794         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
 2795                 return;
 2796         }
 2797         /* go through the addresses in the init-ack */
 2798         ph = (struct sctp_paramhdr *)
 2799             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
 2800             (uint8_t *) & tmp_param);
 2801         while (ph != NULL) {
 2802                 ptype = ntohs(ph->param_type);
 2803                 plen = ntohs(ph->param_length);
 2804                 switch (ptype) {
 2805 #ifdef INET6
 2806                 case SCTP_IPV6_ADDRESS:
 2807                         {
 2808                                 struct sctp_ipv6addr_param *a6p;
 2809 
 2810                                 /* get the entire IPv6 address param */
 2811                                 a6p = (struct sctp_ipv6addr_param *)
 2812                                     sctp_m_getptr(m, offset,
 2813                                     sizeof(struct sctp_ipv6addr_param),
 2814                                     (uint8_t *) & addr6_store);
 2815                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
 2816                                     a6p == NULL) {
 2817                                         return;
 2818                                 }
 2819                                 memset(&store, 0, sizeof(union sctp_sockstore));
 2820                                 store.sin6.sin6_family = AF_INET6;
 2821                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
 2822                                 store.sin6.sin6_port = stcb->rport;
 2823                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
 2824                                 break;
 2825                         }
 2826 #endif
 2827 #ifdef INET
 2828                 case SCTP_IPV4_ADDRESS:
 2829                         {
 2830                                 struct sctp_ipv4addr_param *a4p;
 2831 
 2832                                 /* get the entire IPv4 address param */
 2833                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
 2834                                     sizeof(struct sctp_ipv4addr_param),
 2835                                     (uint8_t *) & addr4_store);
 2836                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
 2837                                     a4p == NULL) {
 2838                                         return;
 2839                                 }
 2840                                 memset(&store, 0, sizeof(union sctp_sockstore));
 2841                                 store.sin.sin_family = AF_INET;
 2842                                 store.sin.sin_len = sizeof(struct sockaddr_in);
 2843                                 store.sin.sin_port = stcb->rport;
 2844                                 store.sin.sin_addr.s_addr = a4p->addr;
 2845                                 break;
 2846                         }
 2847 #endif
 2848                 default:
 2849                         goto next_addr;
 2850                 }
 2851 
 2852                 /* see if this address really (still) exists */
 2853                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
 2854                     SCTP_ADDR_NOT_LOCKED);
 2855                 if (sctp_ifa == NULL) {
 2856                         /* address doesn't exist anymore */
 2857                         int status;
 2858 
 2859                         /* are ASCONFs allowed ? */
 2860                         if ((sctp_is_feature_on(stcb->sctp_ep,
 2861                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
 2862                             stcb->asoc.asconf_supported) {
 2863                                 /* queue an ASCONF DEL_IP_ADDRESS */
 2864                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
 2865                                 /*
 2866                                  * if queued ok, and in correct state, send
 2867                                  * out the ASCONF.
 2868                                  */
 2869                                 if (status == 0 &&
 2870                                     SCTP_GET_STATE(&stcb->asoc) ==
 2871                                     SCTP_STATE_OPEN) {
 2872 #ifdef SCTP_TIMER_BASED_ASCONF
 2873                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2874                                             stcb->sctp_ep, stcb,
 2875                                             stcb->asoc.primary_destination);
 2876 #else
 2877                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2878 #endif
 2879                                 }
 2880                         }
 2881                 }
 2882 next_addr:
 2883                 /*
 2884                  * Sanity check:  Make sure the length isn't 0, otherwise
 2885                  * we'll be stuck in this loop for a long time...
 2886                  */
 2887                 if (SCTP_SIZE32(plen) == 0) {
 2888                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
 2889                             plen, ptype);
 2890                         return;
 2891                 }
 2892                 /* get next parameter */
 2893                 offset += SCTP_SIZE32(plen);
 2894                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
 2895                         return;
 2896                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
 2897                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
 2898         }                       /* while */
 2899 }
 2900 
 2901 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
 2902 /*
 2903  * checks to see if a specific address is in the initack address list returns
 2904  * 1 if found, 0 if not
 2905  */
 2906 static uint32_t
 2907 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
 2908 {
 2909         struct sctp_paramhdr tmp_param, *ph;
 2910         uint16_t plen, ptype;
 2911 
 2912 #ifdef INET
 2913         struct sockaddr_in *sin;
 2914         struct sctp_ipv4addr_param *a4p;
 2915         struct sctp_ipv6addr_param addr4_store;
 2916 
 2917 #endif
 2918 #ifdef INET6
 2919         struct sockaddr_in6 *sin6;
 2920         struct sctp_ipv6addr_param *a6p;
 2921         struct sctp_ipv6addr_param addr6_store;
 2922         struct sockaddr_in6 sin6_tmp;
 2923 
 2924 #endif
 2925 
 2926         switch (sa->sa_family) {
 2927 #ifdef INET
 2928         case AF_INET:
 2929                 break;
 2930 #endif
 2931 #ifdef INET6
 2932         case AF_INET6:
 2933                 break;
 2934 #endif
 2935         default:
 2936                 return (0);
 2937         }
 2938 
 2939         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
 2940         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
 2941         /* convert to upper bound */
 2942         length += offset;
 2943 
 2944         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
 2945                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2946                     "find_initack_addr: invalid offset?\n");
 2947                 return (0);
 2948         }
 2949         /* go through the addresses in the init-ack */
 2950         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
 2951             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
 2952         while (ph != NULL) {
 2953                 ptype = ntohs(ph->param_type);
 2954                 plen = ntohs(ph->param_length);
 2955                 switch (ptype) {
 2956 #ifdef INET6
 2957                 case SCTP_IPV6_ADDRESS:
 2958                         if (sa->sa_family == AF_INET6) {
 2959                                 /* get the entire IPv6 address param */
 2960                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
 2961                                         break;
 2962                                 }
 2963                                 /* get the entire IPv6 address param */
 2964                                 a6p = (struct sctp_ipv6addr_param *)
 2965                                     sctp_m_getptr(m, offset,
 2966                                     sizeof(struct sctp_ipv6addr_param),
 2967                                     (uint8_t *) & addr6_store);
 2968                                 if (a6p == NULL) {
 2969                                         return (0);
 2970                                 }
 2971                                 sin6 = (struct sockaddr_in6 *)sa;
 2972                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
 2973                                         /* create a copy and clear scope */
 2974                                         memcpy(&sin6_tmp, sin6,
 2975                                             sizeof(struct sockaddr_in6));
 2976                                         sin6 = &sin6_tmp;
 2977                                         in6_clearscope(&sin6->sin6_addr);
 2978                                 }
 2979                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
 2980                                     sizeof(struct in6_addr)) == 0) {
 2981                                         /* found it */
 2982                                         return (1);
 2983                                 }
 2984                         }
 2985                         break;
 2986 #endif                          /* INET6 */
 2987 #ifdef INET
 2988                 case SCTP_IPV4_ADDRESS:
 2989                         if (sa->sa_family == AF_INET) {
 2990                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
 2991                                         break;
 2992                                 }
 2993                                 /* get the entire IPv4 address param */
 2994                                 a4p = (struct sctp_ipv4addr_param *)
 2995                                     sctp_m_getptr(m, offset,
 2996                                     sizeof(struct sctp_ipv4addr_param),
 2997                                     (uint8_t *) & addr4_store);
 2998                                 if (a4p == NULL) {
 2999                                         return (0);
 3000                                 }
 3001                                 sin = (struct sockaddr_in *)sa;
 3002                                 if (sin->sin_addr.s_addr == a4p->addr) {
 3003                                         /* found it */
 3004                                         return (1);
 3005                                 }
 3006                         }
 3007                         break;
 3008 #endif
 3009                 default:
 3010                         break;
 3011                 }
 3012                 /* get next parameter */
 3013                 offset += SCTP_SIZE32(plen);
 3014                 if (offset + sizeof(struct sctp_paramhdr) > length) {
 3015                         return (0);
 3016                 }
 3017                 ph = (struct sctp_paramhdr *)
 3018                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
 3019                     (uint8_t *) & tmp_param);
 3020         }                       /* while */
 3021         /* not found! */
 3022         return (0);
 3023 }
 3024 
 3025 /*
 3026  * makes sure that the current endpoint local addr list is consistent with
 3027  * the new association (eg. subset bound, asconf allowed) adds addresses as
 3028  * necessary
 3029  */
 3030 static void
 3031 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3032     int length, struct sockaddr *init_addr)
 3033 {
 3034         struct sctp_laddr *laddr;
 3035 
 3036         /* go through the endpoint list */
 3037         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 3038                 /* be paranoid and validate the laddr */
 3039                 if (laddr->ifa == NULL) {
 3040                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 3041                             "check_addr_list_ep: laddr->ifa is NULL");
 3042                         continue;
 3043                 }
 3044                 if (laddr->ifa == NULL) {
 3045                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
 3046                         continue;
 3047                 }
 3048                 /* do i have it implicitly? */
 3049                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
 3050                         continue;
 3051                 }
 3052                 /* check to see if in the init-ack */
 3053                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
 3054                         /* try to add it */
 3055                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
 3056                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
 3057                 }
 3058         }
 3059 }
 3060 
 3061 /*
 3062  * makes sure that the current kernel address list is consistent with the new
 3063  * association (with all addrs bound) adds addresses as necessary
 3064  */
 3065 static void
 3066 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3067     int length, struct sockaddr *init_addr,
 3068     uint16_t local_scope, uint16_t site_scope,
 3069     uint16_t ipv4_scope, uint16_t loopback_scope)
 3070 {
 3071         struct sctp_vrf *vrf = NULL;
 3072         struct sctp_ifn *sctp_ifn;
 3073         struct sctp_ifa *sctp_ifa;
 3074         uint32_t vrf_id;
 3075 
 3076 #ifdef INET
 3077         struct sockaddr_in *sin;
 3078 
 3079 #endif
 3080 #ifdef INET6
 3081         struct sockaddr_in6 *sin6;
 3082 
 3083 #endif
 3084 
 3085         if (stcb) {
 3086                 vrf_id = stcb->asoc.vrf_id;
 3087         } else {
 3088                 return;
 3089         }
 3090         SCTP_IPI_ADDR_RLOCK();
 3091         vrf = sctp_find_vrf(vrf_id);
 3092         if (vrf == NULL) {
 3093                 SCTP_IPI_ADDR_RUNLOCK();
 3094                 return;
 3095         }
 3096         /* go through all our known interfaces */
 3097         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
 3098                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
 3099                         /* skip loopback interface */
 3100                         continue;
 3101                 }
 3102                 /* go through each interface address */
 3103                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
 3104                         /* do i have it implicitly? */
 3105                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
 3106                                 continue;
 3107                         }
 3108                         switch (sctp_ifa->address.sa.sa_family) {
 3109 #ifdef INET
 3110                         case AF_INET:
 3111                                 sin = &sctp_ifa->address.sin;
 3112                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3113                                     &sin->sin_addr) != 0) {
 3114                                         continue;
 3115                                 }
 3116                                 if ((ipv4_scope == 0) &&
 3117                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 3118                                         /* private address not in scope */
 3119                                         continue;
 3120                                 }
 3121                                 break;
 3122 #endif
 3123 #ifdef INET6
 3124                         case AF_INET6:
 3125                                 sin6 = &sctp_ifa->address.sin6;
 3126                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3127                                     &sin6->sin6_addr) != 0) {
 3128                                         continue;
 3129                                 }
 3130                                 if ((local_scope == 0) &&
 3131                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
 3132                                         continue;
 3133                                 }
 3134                                 if ((site_scope == 0) &&
 3135                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
 3136                                         continue;
 3137                                 }
 3138                                 break;
 3139 #endif
 3140                         default:
 3141                                 break;
 3142                         }
 3143                         /* check to see if in the init-ack */
 3144                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
 3145                                 /* try to add it */
 3146                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
 3147                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
 3148                                     SCTP_ADDR_LOCKED);
 3149                         }
 3150                 }               /* end foreach ifa */
 3151         }                       /* end foreach ifn */
 3152         SCTP_IPI_ADDR_RUNLOCK();
 3153 }
 3154 
 3155 /*
 3156  * validates an init-ack chunk (from a cookie-echo) with current addresses
 3157  * adds addresses from the init-ack into our local address list, if needed
 3158  * queues asconf adds/deletes addresses as needed and makes appropriate list
 3159  * changes for source address selection m, offset: points to the start of the
 3160  * address list in an init-ack chunk length: total length of the address
 3161  * params only init_addr: address where my INIT-ACK was sent from
 3162  */
 3163 void
 3164 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3165     int length, struct sockaddr *init_addr,
 3166     uint16_t local_scope, uint16_t site_scope,
 3167     uint16_t ipv4_scope, uint16_t loopback_scope)
 3168 {
 3169         /* process the local addresses in the initack */
 3170         sctp_process_initack_addresses(stcb, m, offset, length);
 3171 
 3172         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3173                 /* bound all case */
 3174                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
 3175                     local_scope, site_scope, ipv4_scope, loopback_scope);
 3176         } else {
 3177                 /* subset bound case */
 3178                 if (sctp_is_feature_on(stcb->sctp_ep,
 3179                     SCTP_PCB_FLAGS_DO_ASCONF)) {
 3180                         /* asconf's allowed */
 3181                         sctp_check_address_list_ep(stcb, m, offset, length,
 3182                             init_addr);
 3183                 }
 3184                 /* else, no asconfs allowed, so what we sent is what we get */
 3185         }
 3186 }
 3187 
 3188 /*
 3189  * sctp_bindx() support
 3190  */
 3191 uint32_t
 3192 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
 3193     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
 3194 {
 3195         struct sctp_ifa *ifa;
 3196         struct sctp_laddr *laddr, *nladdr;
 3197 
 3198         if (sa->sa_len == 0) {
 3199                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
 3200                 return (EINVAL);
 3201         }
 3202         if (sctp_ifap) {
 3203                 ifa = sctp_ifap;
 3204         } else if (type == SCTP_ADD_IP_ADDRESS) {
 3205                 /* For an add the address MUST be on the system */
 3206                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
 3207         } else if (type == SCTP_DEL_IP_ADDRESS) {
 3208                 /* For a delete we need to find it in the inp */
 3209                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
 3210         } else {
 3211                 ifa = NULL;
 3212         }
 3213         if (ifa != NULL) {
 3214                 if (type == SCTP_ADD_IP_ADDRESS) {
 3215                         sctp_add_local_addr_ep(inp, ifa, type);
 3216                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 3217                         if (inp->laddr_count < 2) {
 3218                                 /* can't delete the last local address */
 3219                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
 3220                                 return (EINVAL);
 3221                         }
 3222                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
 3223                             sctp_nxt_addr) {
 3224                                 if (ifa == laddr->ifa) {
 3225                                         /* Mark in the delete */
 3226                                         laddr->action = type;
 3227                                 }
 3228                         }
 3229                 }
 3230                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
 3231                         /*
 3232                          * There is no need to start the iterator if the inp
 3233                          * has no associations.
 3234                          */
 3235                         if (type == SCTP_DEL_IP_ADDRESS) {
 3236                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
 3237                                         if (laddr->ifa == ifa) {
 3238                                                 sctp_del_local_addr_ep(inp, ifa);
 3239                                         }
 3240                                 }
 3241                         }
 3242                 } else {
 3243                         struct sctp_asconf_iterator *asc;
 3244                         struct sctp_laddr *wi;
 3245 
 3246                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
 3247                             sizeof(struct sctp_asconf_iterator),
 3248                             SCTP_M_ASC_IT);
 3249                         if (asc == NULL) {
 3250                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
 3251                                 return (ENOMEM);
 3252                         }
 3253                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
 3254                         if (wi == NULL) {
 3255                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
 3256                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
 3257                                 return (ENOMEM);
 3258                         }
 3259                         LIST_INIT(&asc->list_of_work);
 3260                         asc->cnt = 1;
 3261                         SCTP_INCR_LADDR_COUNT();
 3262                         wi->ifa = ifa;
 3263                         wi->action = type;
 3264                         atomic_add_int(&ifa->refcount, 1);
 3265                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
 3266                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
 3267                             sctp_asconf_iterator_stcb,
 3268                             sctp_asconf_iterator_ep_end,
 3269                             SCTP_PCB_ANY_FLAGS,
 3270                             SCTP_PCB_ANY_FEATURES,
 3271                             SCTP_ASOC_ANY_STATE,
 3272                             (void *)asc, 0,
 3273                             sctp_asconf_iterator_end, inp, 0);
 3274                 }
 3275                 return (0);
 3276         } else {
 3277                 /* invalid address! */
 3278                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
 3279                 return (EADDRNOTAVAIL);
 3280         }
 3281 }
 3282 
 3283 void
 3284 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
 3285     struct sctp_nets *net)
 3286 {
 3287         struct sctp_asconf_addr *aa;
 3288         struct sctp_ifa *sctp_ifap;
 3289         struct sctp_asconf_tag_param *vtag;
 3290 
 3291 #ifdef INET
 3292         struct sockaddr_in *to;
 3293 
 3294 #endif
 3295 #ifdef INET6
 3296         struct sockaddr_in6 *to6;
 3297 
 3298 #endif
 3299         if (net == NULL) {
 3300                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
 3301                 return;
 3302         }
 3303         if (stcb == NULL) {
 3304                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
 3305                 return;
 3306         }
 3307         /*
 3308          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
 3309          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
 3310          */
 3311         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3312             SCTP_M_ASC_ADDR);
 3313         if (aa == NULL) {
 3314                 /* didn't get memory */
 3315                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3316                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3317                 return;
 3318         }
 3319         aa->special_del = 0;
 3320         /* fill in asconf address parameter fields */
 3321         /* top level elements are "networked" during send */
 3322         aa->ifa = NULL;
 3323         aa->sent = 0;           /* clear sent flag */
 3324         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
 3325         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
 3326         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
 3327         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
 3328         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
 3329         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3330 
 3331         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3332             SCTP_M_ASC_ADDR);
 3333         if (aa == NULL) {
 3334                 /* didn't get memory */
 3335                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3336                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3337                 return;
 3338         }
 3339         memset(aa, 0, sizeof(struct sctp_asconf_addr));
 3340         /* fill in asconf address parameter fields */
 3341         /* ADD(0.0.0.0) */
 3342         switch (net->ro._l_addr.sa.sa_family) {
 3343 #ifdef INET
 3344         case AF_INET:
 3345                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3346                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
 3347                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 3348                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
 3349                 /* No need to add an address, we are using 0.0.0.0 */
 3350                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3351                 break;
 3352 #endif
 3353 #ifdef INET6
 3354         case AF_INET6:
 3355                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3356                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
 3357                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 3358                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
 3359                 /* No need to add an address, we are using 0.0.0.0 */
 3360                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3361                 break;
 3362 #endif
 3363         default:
 3364                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3365                     "sctp_asconf_send_nat_state_update: unknown address family\n");
 3366                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 3367                 return;
 3368         }
 3369         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3370             SCTP_M_ASC_ADDR);
 3371         if (aa == NULL) {
 3372                 /* didn't get memory */
 3373                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3374                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3375                 return;
 3376         }
 3377         memset(aa, 0, sizeof(struct sctp_asconf_addr));
 3378         /* fill in asconf address parameter fields */
 3379         /* ADD(0.0.0.0) */
 3380         switch (net->ro._l_addr.sa.sa_family) {
 3381 #ifdef INET
 3382         case AF_INET:
 3383                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3384                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
 3385                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 3386                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
 3387                 /* No need to add an address, we are using 0.0.0.0 */
 3388                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3389                 break;
 3390 #endif
 3391 #ifdef INET6
 3392         case AF_INET6:
 3393                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
 3394                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
 3395                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 3396                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
 3397                 /* No need to add an address, we are using 0.0.0.0 */
 3398                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3399                 break;
 3400 #endif
 3401         default:
 3402                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3403                     "sctp_asconf_send_nat_state_update: unknown address family\n");
 3404                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 3405                 return;
 3406         }
 3407         /* Now we must hunt the addresses and add all global addresses */
 3408         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3409                 struct sctp_vrf *vrf = NULL;
 3410                 struct sctp_ifn *sctp_ifnp;
 3411                 uint32_t vrf_id;
 3412 
 3413                 vrf_id = stcb->sctp_ep->def_vrf_id;
 3414                 vrf = sctp_find_vrf(vrf_id);
 3415                 if (vrf == NULL) {
 3416                         goto skip_rest;
 3417                 }
 3418                 SCTP_IPI_ADDR_RLOCK();
 3419                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
 3420                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
 3421                                 switch (sctp_ifap->address.sa.sa_family) {
 3422 #ifdef INET
 3423                                 case AF_INET:
 3424                                         to = &sctp_ifap->address.sin;
 3425                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3426                                             &to->sin_addr) != 0) {
 3427                                                 continue;
 3428                                         }
 3429                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
 3430                                                 continue;
 3431                                         }
 3432                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
 3433                                                 continue;
 3434                                         }
 3435                                         break;
 3436 #endif
 3437 #ifdef INET6
 3438                                 case AF_INET6:
 3439                                         to6 = &sctp_ifap->address.sin6;
 3440                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3441                                             &to6->sin6_addr) != 0) {
 3442                                                 continue;
 3443                                         }
 3444                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
 3445                                                 continue;
 3446                                         }
 3447                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
 3448                                                 continue;
 3449                                         }
 3450                                         break;
 3451 #endif
 3452                                 default:
 3453                                         continue;
 3454                                 }
 3455                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
 3456                         }
 3457                 }
 3458                 SCTP_IPI_ADDR_RUNLOCK();
 3459         } else {
 3460                 struct sctp_laddr *laddr;
 3461 
 3462                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 3463                         if (laddr->ifa == NULL) {
 3464                                 continue;
 3465                         }
 3466                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
 3467                                 /*
 3468                                  * Address being deleted by the system, dont
 3469                                  * list.
 3470                                  */
 3471                                 continue;
 3472                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
 3473                                 /*
 3474                                  * Address being deleted on this ep don't
 3475                                  * list.
 3476                                  */
 3477                                 continue;
 3478                         }
 3479                         sctp_ifap = laddr->ifa;
 3480                         switch (sctp_ifap->address.sa.sa_family) {
 3481 #ifdef INET
 3482                         case AF_INET:
 3483                                 to = &sctp_ifap->address.sin;
 3484                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
 3485                                         continue;
 3486                                 }
 3487                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
 3488                                         continue;
 3489                                 }
 3490                                 break;
 3491 #endif
 3492 #ifdef INET6
 3493                         case AF_INET6:
 3494                                 to6 = &sctp_ifap->address.sin6;
 3495                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
 3496                                         continue;
 3497                                 }
 3498                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
 3499                                         continue;
 3500                                 }
 3501                                 break;
 3502 #endif
 3503                         default:
 3504                                 continue;
 3505                         }
 3506                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
 3507                 }
 3508         }
 3509 skip_rest:
 3510         /* Now we must send the asconf into the queue */
 3511         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
 3512 }

Cache object: adf2364958092718996bb40b5cb8ddf3


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.