The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_asconf.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
    3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
    4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions are met:
    8  *
    9  * a) Redistributions of source code must retain the above copyright notice,
   10  *    this list of conditions and the following disclaimer.
   11  *
   12  * b) Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in
   14  *    the documentation and/or other materials provided with the distribution.
   15  *
   16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
   17  *    contributors may be used to endorse or promote products derived
   18  *    from this software without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
   24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   30  * THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __FBSDID("$FreeBSD: releng/10.3/sys/netinet/sctp_asconf.c 296052 2016-02-25 18:46:06Z tuexen $");
   35 
   36 #include <netinet/sctp_os.h>
   37 #include <netinet/sctp_var.h>
   38 #include <netinet/sctp_sysctl.h>
   39 #include <netinet/sctp_pcb.h>
   40 #include <netinet/sctp_header.h>
   41 #include <netinet/sctputil.h>
   42 #include <netinet/sctp_output.h>
   43 #include <netinet/sctp_asconf.h>
   44 #include <netinet/sctp_timer.h>
   45 
   46 /*
   47  * debug flags:
   48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
   49  * SCTP_DEBUG_ASCONF2: detailed info
   50  */
   51 
   52 
   53 /*
   54  * RFC 5061
   55  *
   56  * An ASCONF parameter queue exists per asoc which holds the pending address
   57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
   58  *
   59  * A restricted_addrs list exists per assoc to hold local addresses that are
   60  * not (yet) usable by the assoc as a source address.  These addresses are
   61  * either pending an ASCONF operation (and exist on the ASCONF parameter
   62  * queue), or they are permanently restricted (the peer has returned an
   63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
   64  *
   65  * Deleted addresses are always immediately removed from the lists as they will
   66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
   67  * only if allowed.
   68  */
   69 
   70 /*
   71  * ASCONF parameter processing.
   72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
   73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
   74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
   75  */
   76 static struct mbuf *
   77 sctp_asconf_success_response(uint32_t id)
   78 {
   79         struct mbuf *m_reply = NULL;
   80         struct sctp_asconf_paramhdr *aph;
   81 
   82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
   83             0, M_NOWAIT, 1, MT_DATA);
   84         if (m_reply == NULL) {
   85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
   86                     "asconf_success_response: couldn't get mbuf!\n");
   87                 return (NULL);
   88         }
   89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
   90         aph->correlation_id = id;
   91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
   92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
   93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
   94         aph->ph.param_length = htons(aph->ph.param_length);
   95 
   96         return (m_reply);
   97 }
   98 
   99 static struct mbuf *
  100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
  101     uint16_t tlv_length)
  102 {
  103         struct mbuf *m_reply = NULL;
  104         struct sctp_asconf_paramhdr *aph;
  105         struct sctp_error_cause *error;
  106         uint8_t *tlv;
  107 
  108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
  109             tlv_length +
  110             sizeof(struct sctp_error_cause)),
  111             0, M_NOWAIT, 1, MT_DATA);
  112         if (m_reply == NULL) {
  113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  114                     "asconf_error_response: couldn't get mbuf!\n");
  115                 return (NULL);
  116         }
  117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  118         error = (struct sctp_error_cause *)(aph + 1);
  119 
  120         aph->correlation_id = id;
  121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
  122         error->code = htons(cause);
  123         error->length = tlv_length + sizeof(struct sctp_error_cause);
  124         aph->ph.param_length = error->length +
  125             sizeof(struct sctp_asconf_paramhdr);
  126 
  127         if (aph->ph.param_length > MLEN) {
  128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  129                     "asconf_error_response: tlv_length (%xh) too big\n",
  130                     tlv_length);
  131                 sctp_m_freem(m_reply);  /* discard */
  132                 return (NULL);
  133         }
  134         if (error_tlv != NULL) {
  135                 tlv = (uint8_t *) (error + 1);
  136                 memcpy(tlv, error_tlv, tlv_length);
  137         }
  138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  139         error->length = htons(error->length);
  140         aph->ph.param_length = htons(aph->ph.param_length);
  141 
  142         return (m_reply);
  143 }
  144 
  145 static struct mbuf *
  146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
  147     struct sctp_tcb *stcb, int send_hb, int response_required)
  148 {
  149         struct sctp_nets *net;
  150         struct mbuf *m_reply = NULL;
  151         union sctp_sockstore store;
  152         struct sctp_paramhdr *ph;
  153         uint16_t param_type, aparam_length;
  154 
  155 #if defined(INET) || defined(INET6)
  156         uint16_t param_length;
  157 
  158 #endif
  159         struct sockaddr *sa;
  160         int zero_address = 0;
  161         int bad_address = 0;
  162 
  163 #ifdef INET
  164         struct sockaddr_in *sin;
  165         struct sctp_ipv4addr_param *v4addr;
  166 
  167 #endif
  168 #ifdef INET6
  169         struct sockaddr_in6 *sin6;
  170         struct sctp_ipv6addr_param *v6addr;
  171 
  172 #endif
  173 
  174         aparam_length = ntohs(aph->ph.param_length);
  175         ph = (struct sctp_paramhdr *)(aph + 1);
  176         param_type = ntohs(ph->param_type);
  177 #if defined(INET) || defined(INET6)
  178         param_length = ntohs(ph->param_length);
  179 #endif
  180         sa = &store.sa;
  181         switch (param_type) {
  182 #ifdef INET
  183         case SCTP_IPV4_ADDRESS:
  184                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  185                         /* invalid param size */
  186                         return (NULL);
  187                 }
  188                 v4addr = (struct sctp_ipv4addr_param *)ph;
  189                 sin = &store.sin;
  190                 bzero(sin, sizeof(*sin));
  191                 sin->sin_family = AF_INET;
  192                 sin->sin_len = sizeof(struct sockaddr_in);
  193                 sin->sin_port = stcb->rport;
  194                 sin->sin_addr.s_addr = v4addr->addr;
  195                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
  196                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
  197                         bad_address = 1;
  198                 }
  199                 if (sin->sin_addr.s_addr == INADDR_ANY)
  200                         zero_address = 1;
  201                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
  202                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  203                 break;
  204 #endif
  205 #ifdef INET6
  206         case SCTP_IPV6_ADDRESS:
  207                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  208                         /* invalid param size */
  209                         return (NULL);
  210                 }
  211                 v6addr = (struct sctp_ipv6addr_param *)ph;
  212                 sin6 = &store.sin6;
  213                 bzero(sin6, sizeof(*sin6));
  214                 sin6->sin6_family = AF_INET6;
  215                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  216                 sin6->sin6_port = stcb->rport;
  217                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
  218                     sizeof(struct in6_addr));
  219                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
  220                         bad_address = 1;
  221                 }
  222                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  223                         zero_address = 1;
  224                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
  225                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  226                 break;
  227 #endif
  228         default:
  229                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  230                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
  231                     aparam_length);
  232                 return (m_reply);
  233         }                       /* end switch */
  234 
  235         /* if 0.0.0.0/::0, add the source address instead */
  236         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  237                 sa = src;
  238                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  239                     "process_asconf_add_ip: using source addr ");
  240                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  241         }
  242         /* add the address */
  243         if (bad_address) {
  244                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  245                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
  246                     aparam_length);
  247         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
  248             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
  249                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  250                     "process_asconf_add_ip: error adding address\n");
  251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  252                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
  253                     aparam_length);
  254         } else {
  255                 /* notify upper layer */
  256                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  257                 if (response_required) {
  258                         m_reply =
  259                             sctp_asconf_success_response(aph->correlation_id);
  260                 }
  261                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
  262                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
  263                     stcb, net);
  264                 if (send_hb) {
  265                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
  266                 }
  267         }
  268         return (m_reply);
  269 }
  270 
  271 static int
  272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
  273 {
  274         struct sctp_nets *src_net, *net;
  275 
  276         /* make sure the source address exists as a destination net */
  277         src_net = sctp_findnet(stcb, src);
  278         if (src_net == NULL) {
  279                 /* not found */
  280                 return (-1);
  281         }
  282         /* delete all destination addresses except the source */
  283         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  284                 if (net != src_net) {
  285                         /* delete this address */
  286                         sctp_remove_net(stcb, net);
  287                         SCTPDBG(SCTP_DEBUG_ASCONF1,
  288                             "asconf_del_remote_addrs_except: deleting ");
  289                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
  290                             (struct sockaddr *)&net->ro._l_addr);
  291                         /* notify upper layer */
  292                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
  293                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
  294                 }
  295         }
  296         return (0);
  297 }
  298 
  299 static struct mbuf *
  300 sctp_process_asconf_delete_ip(struct sockaddr *src,
  301     struct sctp_asconf_paramhdr *aph,
  302     struct sctp_tcb *stcb, int response_required)
  303 {
  304         struct mbuf *m_reply = NULL;
  305         union sctp_sockstore store;
  306         struct sctp_paramhdr *ph;
  307         uint16_t param_type, aparam_length;
  308 
  309 #if defined(INET) || defined(INET6)
  310         uint16_t param_length;
  311 
  312 #endif
  313         struct sockaddr *sa;
  314         int zero_address = 0;
  315         int result;
  316 
  317 #ifdef INET
  318         struct sockaddr_in *sin;
  319         struct sctp_ipv4addr_param *v4addr;
  320 
  321 #endif
  322 #ifdef INET6
  323         struct sockaddr_in6 *sin6;
  324         struct sctp_ipv6addr_param *v6addr;
  325 
  326 #endif
  327 
  328         aparam_length = ntohs(aph->ph.param_length);
  329         ph = (struct sctp_paramhdr *)(aph + 1);
  330         param_type = ntohs(ph->param_type);
  331 #if defined(INET) || defined(INET6)
  332         param_length = ntohs(ph->param_length);
  333 #endif
  334         sa = &store.sa;
  335         switch (param_type) {
  336 #ifdef INET
  337         case SCTP_IPV4_ADDRESS:
  338                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  339                         /* invalid param size */
  340                         return (NULL);
  341                 }
  342                 v4addr = (struct sctp_ipv4addr_param *)ph;
  343                 sin = &store.sin;
  344                 bzero(sin, sizeof(*sin));
  345                 sin->sin_family = AF_INET;
  346                 sin->sin_len = sizeof(struct sockaddr_in);
  347                 sin->sin_port = stcb->rport;
  348                 sin->sin_addr.s_addr = v4addr->addr;
  349                 if (sin->sin_addr.s_addr == INADDR_ANY)
  350                         zero_address = 1;
  351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  352                     "process_asconf_delete_ip: deleting ");
  353                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  354                 break;
  355 #endif
  356 #ifdef INET6
  357         case SCTP_IPV6_ADDRESS:
  358                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  359                         /* invalid param size */
  360                         return (NULL);
  361                 }
  362                 v6addr = (struct sctp_ipv6addr_param *)ph;
  363                 sin6 = &store.sin6;
  364                 bzero(sin6, sizeof(*sin6));
  365                 sin6->sin6_family = AF_INET6;
  366                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  367                 sin6->sin6_port = stcb->rport;
  368                 memcpy(&sin6->sin6_addr, v6addr->addr,
  369                     sizeof(struct in6_addr));
  370                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  371                         zero_address = 1;
  372                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  373                     "process_asconf_delete_ip: deleting ");
  374                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  375                 break;
  376 #endif
  377         default:
  378                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  379                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  380                     aparam_length);
  381                 return (m_reply);
  382         }
  383 
  384         /* make sure the source address is not being deleted */
  385         if (sctp_cmpaddr(sa, src)) {
  386                 /* trying to delete the source address! */
  387                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
  388                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  389                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
  390                     aparam_length);
  391                 return (m_reply);
  392         }
  393         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
  394         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  395                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
  396 
  397                 if (result) {
  398                         /* src address did not exist? */
  399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
  400                         /* what error to reply with?? */
  401                         m_reply =
  402                             sctp_asconf_error_response(aph->correlation_id,
  403                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
  404                             aparam_length);
  405                 } else if (response_required) {
  406                         m_reply =
  407                             sctp_asconf_success_response(aph->correlation_id);
  408                 }
  409                 return (m_reply);
  410         }
  411         /* delete the address */
  412         result = sctp_del_remote_addr(stcb, sa);
  413         /*
  414          * note if result == -2, the address doesn't exist in the asoc but
  415          * since it's being deleted anyways, we just ack the delete -- but
  416          * this probably means something has already gone awry
  417          */
  418         if (result == -1) {
  419                 /* only one address in the asoc */
  420                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
  421                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  422                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
  423                     aparam_length);
  424         } else {
  425                 if (response_required) {
  426                         m_reply = sctp_asconf_success_response(aph->correlation_id);
  427                 }
  428                 /* notify upper layer */
  429                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  430         }
  431         return (m_reply);
  432 }
  433 
  434 static struct mbuf *
  435 sctp_process_asconf_set_primary(struct sockaddr *src,
  436     struct sctp_asconf_paramhdr *aph,
  437     struct sctp_tcb *stcb, int response_required)
  438 {
  439         struct mbuf *m_reply = NULL;
  440         union sctp_sockstore store;
  441         struct sctp_paramhdr *ph;
  442         uint16_t param_type, aparam_length;
  443 
  444 #if defined(INET) || defined(INET6)
  445         uint16_t param_length;
  446 
  447 #endif
  448         struct sockaddr *sa;
  449         int zero_address = 0;
  450 
  451 #ifdef INET
  452         struct sockaddr_in *sin;
  453         struct sctp_ipv4addr_param *v4addr;
  454 
  455 #endif
  456 #ifdef INET6
  457         struct sockaddr_in6 *sin6;
  458         struct sctp_ipv6addr_param *v6addr;
  459 
  460 #endif
  461 
  462         aparam_length = ntohs(aph->ph.param_length);
  463         ph = (struct sctp_paramhdr *)(aph + 1);
  464         param_type = ntohs(ph->param_type);
  465 #if defined(INET) || defined(INET6)
  466         param_length = ntohs(ph->param_length);
  467 #endif
  468         sa = &store.sa;
  469         switch (param_type) {
  470 #ifdef INET
  471         case SCTP_IPV4_ADDRESS:
  472                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
  473                         /* invalid param size */
  474                         return (NULL);
  475                 }
  476                 v4addr = (struct sctp_ipv4addr_param *)ph;
  477                 sin = &store.sin;
  478                 bzero(sin, sizeof(*sin));
  479                 sin->sin_family = AF_INET;
  480                 sin->sin_len = sizeof(struct sockaddr_in);
  481                 sin->sin_addr.s_addr = v4addr->addr;
  482                 if (sin->sin_addr.s_addr == INADDR_ANY)
  483                         zero_address = 1;
  484                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
  485                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  486                 break;
  487 #endif
  488 #ifdef INET6
  489         case SCTP_IPV6_ADDRESS:
  490                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
  491                         /* invalid param size */
  492                         return (NULL);
  493                 }
  494                 v6addr = (struct sctp_ipv6addr_param *)ph;
  495                 sin6 = &store.sin6;
  496                 bzero(sin6, sizeof(*sin6));
  497                 sin6->sin6_family = AF_INET6;
  498                 sin6->sin6_len = sizeof(struct sockaddr_in6);
  499                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
  500                     sizeof(struct in6_addr));
  501                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
  502                         zero_address = 1;
  503                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
  504                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
  505                 break;
  506 #endif
  507         default:
  508                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  509                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  510                     aparam_length);
  511                 return (m_reply);
  512         }
  513 
  514         /* if 0.0.0.0/::0, use the source address instead */
  515         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
  516                 sa = src;
  517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  518                     "process_asconf_set_primary: using source addr ");
  519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  520         }
  521         /* set the primary address */
  522         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
  523                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  524                     "process_asconf_set_primary: primary address set\n");
  525                 /* notify upper layer */
  526                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
  527                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
  528                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
  529                     (stcb->asoc.alternate)) {
  530                         sctp_free_remote_addr(stcb->asoc.alternate);
  531                         stcb->asoc.alternate = NULL;
  532                 }
  533                 if (response_required) {
  534                         m_reply = sctp_asconf_success_response(aph->correlation_id);
  535                 }
  536                 /*
  537                  * Mobility adaptation. Ideally, when the reception of SET
  538                  * PRIMARY with DELETE IP ADDRESS of the previous primary
  539                  * destination, unacknowledged DATA are retransmitted
  540                  * immediately to the new primary destination for seamless
  541                  * handover. If the destination is UNCONFIRMED and marked to
  542                  * REQ_PRIM, The retransmission occur when reception of the
  543                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
  544                  * sctp_input.c) Also, when change of the primary
  545                  * destination, it is better that all subsequent new DATA
  546                  * containing already queued DATA are transmitted to the new
  547                  * primary destination. (by micchie)
  548                  */
  549                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
  550                     SCTP_MOBILITY_BASE) ||
  551                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  552                     SCTP_MOBILITY_FASTHANDOFF)) &&
  553                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  554                     SCTP_MOBILITY_PRIM_DELETED) &&
  555                     (stcb->asoc.primary_destination->dest_state &
  556                     SCTP_ADDR_UNCONFIRMED) == 0) {
  557 
  558                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
  559                             stcb->sctp_ep, stcb, NULL,
  560                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
  561                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  562                             SCTP_MOBILITY_FASTHANDOFF)) {
  563                                 sctp_assoc_immediate_retrans(stcb,
  564                                     stcb->asoc.primary_destination);
  565                         }
  566                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  567                             SCTP_MOBILITY_BASE)) {
  568                                 sctp_move_chunks_from_net(stcb,
  569                                     stcb->asoc.deleted_primary);
  570                         }
  571                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
  572                             stcb->asoc.deleted_primary);
  573                 }
  574         } else {
  575                 /* couldn't set the requested primary address! */
  576                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  577                     "process_asconf_set_primary: set primary failed!\n");
  578                 /* must have been an invalid address, so report */
  579                 m_reply = sctp_asconf_error_response(aph->correlation_id,
  580                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
  581                     aparam_length);
  582         }
  583 
  584         return (m_reply);
  585 }
  586 
  587 /*
  588  * handles an ASCONF chunk.
  589  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
  590  */
  591 void
  592 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
  593     struct sockaddr *src,
  594     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
  595     int first)
  596 {
  597         struct sctp_association *asoc;
  598         uint32_t serial_num;
  599         struct mbuf *n, *m_ack, *m_result, *m_tail;
  600         struct sctp_asconf_ack_chunk *ack_cp;
  601         struct sctp_asconf_paramhdr *aph;
  602         struct sctp_ipv6addr_param *p_addr;
  603         unsigned int asconf_limit, cnt;
  604         int error = 0;          /* did an error occur? */
  605 
  606         /* asconf param buffer */
  607         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
  608         struct sctp_asconf_ack *ack, *ack_next;
  609 
  610         /* verify minimum length */
  611         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
  612                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  613                     "handle_asconf: chunk too small = %xh\n",
  614                     ntohs(cp->ch.chunk_length));
  615                 return;
  616         }
  617         asoc = &stcb->asoc;
  618         serial_num = ntohl(cp->serial_number);
  619 
  620         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
  621                 /* got a duplicate ASCONF */
  622                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  623                     "handle_asconf: got duplicate serial number = %xh\n",
  624                     serial_num);
  625                 return;
  626         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
  627                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
  628                     serial_num, asoc->asconf_seq_in + 1);
  629                 return;
  630         }
  631         /* it's the expected "next" sequence number, so process it */
  632         asoc->asconf_seq_in = serial_num;       /* update sequence */
  633         /* get length of all the param's in the ASCONF */
  634         asconf_limit = offset + ntohs(cp->ch.chunk_length);
  635         SCTPDBG(SCTP_DEBUG_ASCONF1,
  636             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
  637             asconf_limit, serial_num);
  638 
  639         if (first) {
  640                 /* delete old cache */
  641                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
  642 
  643                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
  644                         if (ack->serial_number == serial_num)
  645                                 break;
  646                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
  647                             ack->serial_number, serial_num);
  648                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
  649                         if (ack->data != NULL) {
  650                                 sctp_m_freem(ack->data);
  651                         }
  652                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
  653                 }
  654         }
  655         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
  656             M_NOWAIT, 1, MT_DATA);
  657         if (m_ack == NULL) {
  658                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  659                     "handle_asconf: couldn't get mbuf!\n");
  660                 return;
  661         }
  662         m_tail = m_ack;         /* current reply chain's tail */
  663 
  664         /* fill in ASCONF-ACK header */
  665         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
  666         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
  667         ack_cp->ch.chunk_flags = 0;
  668         ack_cp->serial_number = htonl(serial_num);
  669         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
  670         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
  671         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
  672 
  673         /* skip the lookup address parameter */
  674         offset += sizeof(struct sctp_asconf_chunk);
  675         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
  676         if (p_addr == NULL) {
  677                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  678                     "handle_asconf: couldn't get lookup addr!\n");
  679                 /* respond with a missing/invalid mandatory parameter error */
  680                 return;
  681         }
  682         /* param_length is already validated in process_control... */
  683         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
  684         /* get pointer to first asconf param in ASCONF */
  685         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
  686         if (aph == NULL) {
  687                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
  688                 goto send_reply;
  689         }
  690         /* process through all parameters */
  691         cnt = 0;
  692         while (aph != NULL) {
  693                 unsigned int param_length, param_type;
  694 
  695                 param_type = ntohs(aph->ph.param_type);
  696                 param_length = ntohs(aph->ph.param_length);
  697                 if (offset + param_length > asconf_limit) {
  698                         /* parameter goes beyond end of chunk! */
  699                         sctp_m_freem(m_ack);
  700                         return;
  701                 }
  702                 m_result = NULL;
  703 
  704                 if (param_length > sizeof(aparam_buf)) {
  705                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
  706                         sctp_m_freem(m_ack);
  707                         return;
  708                 }
  709                 if (param_length <= sizeof(struct sctp_paramhdr)) {
  710                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
  711                         sctp_m_freem(m_ack);
  712                 }
  713                 /* get the entire parameter */
  714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
  715                 if (aph == NULL) {
  716                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
  717                         sctp_m_freem(m_ack);
  718                         return;
  719                 }
  720                 switch (param_type) {
  721                 case SCTP_ADD_IP_ADDRESS:
  722                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
  723                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
  724                         cnt++;
  725                         break;
  726                 case SCTP_DEL_IP_ADDRESS:
  727                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
  728                             error);
  729                         break;
  730                 case SCTP_ERROR_CAUSE_IND:
  731                         /* not valid in an ASCONF chunk */
  732                         break;
  733                 case SCTP_SET_PRIM_ADDR:
  734                         m_result = sctp_process_asconf_set_primary(src, aph,
  735                             stcb, error);
  736                         break;
  737                 case SCTP_NAT_VTAGS:
  738                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
  739                         break;
  740                 case SCTP_SUCCESS_REPORT:
  741                         /* not valid in an ASCONF chunk */
  742                         break;
  743                 case SCTP_ULP_ADAPTATION:
  744                         /* FIX */
  745                         break;
  746                 default:
  747                         if ((param_type & 0x8000) == 0) {
  748                                 /* Been told to STOP at this param */
  749                                 asconf_limit = offset;
  750                                 /*
  751                                  * FIX FIX - We need to call
  752                                  * sctp_arethere_unrecognized_parameters()
  753                                  * to get a operr and send it for any
  754                                  * param's with the 0x4000 bit set OR do it
  755                                  * here ourselves... note we still must STOP
  756                                  * if the 0x8000 bit is clear.
  757                                  */
  758                         }
  759                         /* unknown/invalid param type */
  760                         break;
  761                 }               /* switch */
  762 
  763                 /* add any (error) result to the reply mbuf chain */
  764                 if (m_result != NULL) {
  765                         SCTP_BUF_NEXT(m_tail) = m_result;
  766                         m_tail = m_result;
  767                         /* update lengths, make sure it's aligned too */
  768                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
  769                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
  770                         /* set flag to force success reports */
  771                         error = 1;
  772                 }
  773                 offset += SCTP_SIZE32(param_length);
  774                 /* update remaining ASCONF message length to process */
  775                 if (offset >= asconf_limit) {
  776                         /* no more data in the mbuf chain */
  777                         break;
  778                 }
  779                 /* get pointer to next asconf param */
  780                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
  781                     sizeof(struct sctp_asconf_paramhdr),
  782                     (uint8_t *) & aparam_buf);
  783                 if (aph == NULL) {
  784                         /* can't get an asconf paramhdr */
  785                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
  786                         /* FIX ME - add error here... */
  787                 }
  788         }
  789 
  790 send_reply:
  791         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
  792         /* save the ASCONF-ACK reply */
  793         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
  794             struct sctp_asconf_ack);
  795         if (ack == NULL) {
  796                 sctp_m_freem(m_ack);
  797                 return;
  798         }
  799         ack->serial_number = serial_num;
  800         ack->last_sent_to = NULL;
  801         ack->data = m_ack;
  802         ack->len = 0;
  803         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
  804                 ack->len += SCTP_BUF_LEN(n);
  805         }
  806         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
  807 
  808         /* see if last_control_chunk_from is set properly (use IP src addr) */
  809         if (stcb->asoc.last_control_chunk_from == NULL) {
  810                 /*
  811                  * this could happen if the source address was just newly
  812                  * added
  813                  */
  814                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
  815                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
  816                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
  817                 /* look up the from address */
  818                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
  819 #ifdef SCTP_DEBUG
  820                 if (stcb->asoc.last_control_chunk_from == NULL) {
  821                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
  822                 }
  823 #endif
  824         }
  825 }
  826 
  827 /*
  828  * does the address match? returns 0 if not, 1 if so
  829  */
  830 static uint32_t
  831 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
  832 {
  833         switch (sa->sa_family) {
  834 #ifdef INET6
  835         case AF_INET6:
  836                 {
  837                         /* XXX scopeid */
  838                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
  839 
  840                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
  841                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
  842                             sizeof(struct in6_addr)) == 0)) {
  843                                 return (1);
  844                         }
  845                         break;
  846                 }
  847 #endif
  848 #ifdef INET
  849         case AF_INET:
  850                 {
  851                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
  852 
  853                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
  854                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
  855                             sizeof(struct in_addr)) == 0)) {
  856                                 return (1);
  857                         }
  858                         break;
  859                 }
  860 #endif
  861         default:
  862                 break;
  863         }
  864         return (0);
  865 }
  866 
  867 /*
  868  * does the address match? returns 0 if not, 1 if so
  869  */
  870 static uint32_t
  871 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
  872 {
  873 #if defined(INET) || defined(INET6)
  874         uint16_t param_type, param_length;
  875 
  876         param_type = ntohs(ph->param_type);
  877         param_length = ntohs(ph->param_length);
  878 #endif
  879         switch (sa->sa_family) {
  880 #ifdef INET6
  881         case AF_INET6:
  882                 {
  883                         /* XXX scopeid */
  884                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
  885                         struct sctp_ipv6addr_param *v6addr;
  886 
  887                         v6addr = (struct sctp_ipv6addr_param *)ph;
  888                         if ((param_type == SCTP_IPV6_ADDRESS) &&
  889                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
  890                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
  891                             sizeof(struct in6_addr)) == 0)) {
  892                                 return (1);
  893                         }
  894                         break;
  895                 }
  896 #endif
  897 #ifdef INET
  898         case AF_INET:
  899                 {
  900                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
  901                         struct sctp_ipv4addr_param *v4addr;
  902 
  903                         v4addr = (struct sctp_ipv4addr_param *)ph;
  904                         if ((param_type == SCTP_IPV4_ADDRESS) &&
  905                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
  906                             (memcmp(&v4addr->addr, &sin->sin_addr,
  907                             sizeof(struct in_addr)) == 0)) {
  908                                 return (1);
  909                         }
  910                         break;
  911                 }
  912 #endif
  913         default:
  914                 break;
  915         }
  916         return (0);
  917 }
  918 
  919 /*
  920  * Cleanup for non-responded/OP ERR'd ASCONF
  921  */
  922 void
  923 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
  924 {
  925         /*
  926          * clear out any existing asconfs going out
  927          */
  928         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
  929             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
  930         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
  931         /* remove the old ASCONF on our outbound queue */
  932         sctp_toss_old_asconf(stcb);
  933 }
  934 
  935 /*
  936  * cleanup any cached source addresses that may be topologically
  937  * incorrect after a new address has been added to this interface.
  938  */
  939 static void
  940 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
  941 {
  942         struct sctp_nets *net;
  943 
  944         /*
  945          * Ideally, we want to only clear cached routes and source addresses
  946          * that are topologically incorrect.  But since there is no easy way
  947          * to know whether the newly added address on the ifn would cause a
  948          * routing change (i.e. a new egress interface would be chosen)
  949          * without doing a new routing lookup and source address selection,
  950          * we will (for now) just flush any cached route using a different
  951          * ifn (and cached source addrs) and let output re-choose them
  952          * during the next send on that net.
  953          */
  954         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  955                 /*
  956                  * clear any cached route (and cached source address) if the
  957                  * route's interface is NOT the same as the address change.
  958                  * If it's the same interface, just clear the cached source
  959                  * address.
  960                  */
  961                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
  962                     ((ifn == NULL) ||
  963                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
  964                         /* clear any cached route */
  965                         RTFREE(net->ro.ro_rt);
  966                         net->ro.ro_rt = NULL;
  967                 }
  968                 /* clear any cached source address */
  969                 if (net->src_addr_selected) {
  970                         sctp_free_ifa(net->ro._s_addr);
  971                         net->ro._s_addr = NULL;
  972                         net->src_addr_selected = 0;
  973                 }
  974         }
  975 }
  976 
  977 
  978 void
  979 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
  980 {
  981         int error;
  982 
  983         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
  984                 return;
  985         }
  986         if (stcb->asoc.deleted_primary == NULL) {
  987                 return;
  988         }
  989         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
  990                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
  991                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
  992                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
  993                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
  994                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
  995                     stcb->asoc.deleted_primary,
  996                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
  997                 stcb->asoc.num_send_timers_up--;
  998                 if (stcb->asoc.num_send_timers_up < 0) {
  999                         stcb->asoc.num_send_timers_up = 0;
 1000                 }
 1001                 SCTP_TCB_LOCK_ASSERT(stcb);
 1002                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 1003                     stcb->asoc.deleted_primary);
 1004                 if (error) {
 1005                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 1006                         return;
 1007                 }
 1008                 SCTP_TCB_LOCK_ASSERT(stcb);
 1009 #ifdef SCTP_AUDITING_ENABLED
 1010                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
 1011 #endif
 1012                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
 1013                 if ((stcb->asoc.num_send_timers_up == 0) &&
 1014                     (stcb->asoc.sent_queue_cnt > 0)) {
 1015                         struct sctp_tmit_chunk *chk;
 1016 
 1017                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 1018                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 1019                             stcb, chk->whoTo);
 1020                 }
 1021         }
 1022         return;
 1023 }
 1024 
 1025 static int
 1026     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
 1027 
 1028 void
 1029 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
 1030 {
 1031         struct sctp_tmit_chunk *chk;
 1032 
 1033         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
 1034         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
 1035             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
 1036         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
 1037         net->error_count = 0;
 1038         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 1039                 if (chk->whoTo == net) {
 1040                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
 1041                                 chk->sent = SCTP_DATAGRAM_RESEND;
 1042                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 1043                                 sctp_flight_size_decrease(chk);
 1044                                 sctp_total_flight_decrease(stcb, chk);
 1045                                 net->marked_retrans++;
 1046                                 stcb->asoc.marked_retrans++;
 1047                         }
 1048                 }
 1049         }
 1050         if (net->marked_retrans) {
 1051                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
 1052         }
 1053 }
 1054 
 1055 static void
 1056 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
 1057 {
 1058         struct sctp_nets *net;
 1059         int addrnum, changed;
 1060 
 1061         /*
 1062          * If number of local valid addresses is 1, the valid address is
 1063          * probably newly added address. Several valid addresses in this
 1064          * association.  A source address may not be changed.  Additionally,
 1065          * they can be configured on a same interface as "alias" addresses.
 1066          * (by micchie)
 1067          */
 1068         addrnum = sctp_local_addr_count(stcb);
 1069         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
 1070             addrnum);
 1071         if (addrnum == 1) {
 1072                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1073                         /* clear any cached route and source address */
 1074                         if (net->ro.ro_rt) {
 1075                                 RTFREE(net->ro.ro_rt);
 1076                                 net->ro.ro_rt = NULL;
 1077                         }
 1078                         if (net->src_addr_selected) {
 1079                                 sctp_free_ifa(net->ro._s_addr);
 1080                                 net->ro._s_addr = NULL;
 1081                                 net->src_addr_selected = 0;
 1082                         }
 1083                         /* Retransmit unacknowledged DATA chunks immediately */
 1084                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1085                             SCTP_MOBILITY_FASTHANDOFF)) {
 1086                                 sctp_net_immediate_retrans(stcb, net);
 1087                         }
 1088                         /* also, SET PRIMARY is maybe already sent */
 1089                 }
 1090                 return;
 1091         }
 1092         /* Multiple local addresses exsist in the association.  */
 1093         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1094                 /* clear any cached route and source address */
 1095                 if (net->ro.ro_rt) {
 1096                         RTFREE(net->ro.ro_rt);
 1097                         net->ro.ro_rt = NULL;
 1098                 }
 1099                 if (net->src_addr_selected) {
 1100                         sctp_free_ifa(net->ro._s_addr);
 1101                         net->ro._s_addr = NULL;
 1102                         net->src_addr_selected = 0;
 1103                 }
 1104                 /*
 1105                  * Check if the nexthop is corresponding to the new address.
 1106                  * If the new address is corresponding to the current
 1107                  * nexthop, the path will be changed. If the new address is
 1108                  * NOT corresponding to the current nexthop, the path will
 1109                  * not be changed.
 1110                  */
 1111                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
 1112                     stcb->sctp_ep->def_vrf_id,
 1113                     stcb->sctp_ep->fibnum);
 1114                 if (net->ro.ro_rt == NULL)
 1115                         continue;
 1116 
 1117                 changed = 0;
 1118                 switch (net->ro._l_addr.sa.sa_family) {
 1119 #ifdef INET
 1120                 case AF_INET:
 1121                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
 1122                                 changed = 1;
 1123                         }
 1124                         break;
 1125 #endif
 1126 #ifdef INET6
 1127                 case AF_INET6:
 1128                         if (sctp_v6src_match_nexthop(
 1129                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
 1130                                 changed = 1;
 1131                         }
 1132                         break;
 1133 #endif
 1134                 default:
 1135                         break;
 1136                 }
 1137                 /*
 1138                  * if the newly added address does not relate routing
 1139                  * information, we skip.
 1140                  */
 1141                 if (changed == 0)
 1142                         continue;
 1143                 /* Retransmit unacknowledged DATA chunks immediately */
 1144                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1145                     SCTP_MOBILITY_FASTHANDOFF)) {
 1146                         sctp_net_immediate_retrans(stcb, net);
 1147                 }
 1148                 /* Send SET PRIMARY for this new address */
 1149                 if (net == stcb->asoc.primary_destination) {
 1150                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
 1151                             SCTP_SET_PRIM_ADDR);
 1152                 }
 1153         }
 1154 }
 1155 
 1156 /*
 1157  * process an ADD/DELETE IP ack from peer.
 1158  * addr: corresponding sctp_ifa to the address being added/deleted.
 1159  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
 1160  * flag: 1=success, 0=failure.
 1161  */
 1162 static void
 1163 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
 1164 {
 1165         /*
 1166          * do the necessary asoc list work- if we get a failure indication,
 1167          * leave the address on the assoc's restricted list.  If we get a
 1168          * success indication, remove the address from the restricted list.
 1169          */
 1170         /*
 1171          * Note: this will only occur for ADD_IP_ADDRESS, since
 1172          * DEL_IP_ADDRESS is never actually added to the list...
 1173          */
 1174         if (flag) {
 1175                 /* success case, so remove from the restricted list */
 1176                 sctp_del_local_addr_restricted(stcb, addr);
 1177 
 1178                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 1179                     SCTP_MOBILITY_BASE) ||
 1180                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 1181                     SCTP_MOBILITY_FASTHANDOFF)) {
 1182                         sctp_path_check_and_react(stcb, addr);
 1183                         return;
 1184                 }
 1185                 /* clear any cached/topologically incorrect source addresses */
 1186                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
 1187         }
 1188         /* else, leave it on the list */
 1189 }
 1190 
 1191 /*
 1192  * add an asconf add/delete/set primary IP address parameter to the queue.
 1193  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
 1194  * returns 0 if queued, -1 if not queued/removed.
 1195  * NOTE: if adding, but a delete for the same address is already scheduled
 1196  * (and not yet sent out), simply remove it from queue.  Same for deleting
 1197  * an address already scheduled for add.  If a duplicate operation is found,
 1198  * ignore the new one.
 1199  */
 1200 static int
 1201 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
 1202     uint16_t type)
 1203 {
 1204         struct sctp_asconf_addr *aa, *aa_next;
 1205 
 1206         /* make sure the request isn't already in the queue */
 1207         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1208                 /* address match? */
 1209                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
 1210                         continue;
 1211                 /*
 1212                  * is the request already in queue but not sent? pass the
 1213                  * request already sent in order to resolve the following
 1214                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
 1215                  * can't remove the ADD request already sent 3. arrival of
 1216                  * ADD
 1217                  */
 1218                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
 1219                         return (-1);
 1220                 }
 1221                 /* is the negative request already in queue, and not sent */
 1222                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
 1223                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
 1224                         /* add requested, delete already queued */
 1225                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1226                         /* remove the ifa from the restricted list */
 1227                         sctp_del_local_addr_restricted(stcb, ifa);
 1228                         /* free the asconf param */
 1229                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1230                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
 1231                         return (-1);
 1232                 }
 1233                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
 1234                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
 1235                         /* delete requested, add already queued */
 1236                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1237                         /* remove the aa->ifa from the restricted list */
 1238                         sctp_del_local_addr_restricted(stcb, aa->ifa);
 1239                         /* free the asconf param */
 1240                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1241                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
 1242                         return (-1);
 1243                 }
 1244         }                       /* for each aa */
 1245 
 1246         /* adding new request to the queue */
 1247         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 1248             SCTP_M_ASC_ADDR);
 1249         if (aa == NULL) {
 1250                 /* didn't get memory */
 1251                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
 1252                 return (-1);
 1253         }
 1254         aa->special_del = 0;
 1255         /* fill in asconf address parameter fields */
 1256         /* top level elements are "networked" during send */
 1257         aa->ap.aph.ph.param_type = type;
 1258         aa->ifa = ifa;
 1259         atomic_add_int(&ifa->refcount, 1);
 1260         /* correlation_id filled in during send routine later... */
 1261         switch (ifa->address.sa.sa_family) {
 1262 #ifdef INET6
 1263         case AF_INET6:
 1264                 {
 1265                         struct sockaddr_in6 *sin6;
 1266 
 1267                         sin6 = &ifa->address.sin6;
 1268                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 1269                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
 1270                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
 1271                             sizeof(struct sctp_ipv6addr_param);
 1272                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
 1273                             sizeof(struct in6_addr));
 1274                         break;
 1275                 }
 1276 #endif
 1277 #ifdef INET
 1278         case AF_INET:
 1279                 {
 1280                         struct sockaddr_in *sin;
 1281 
 1282                         sin = &ifa->address.sin;
 1283                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 1284                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
 1285                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
 1286                             sizeof(struct sctp_ipv4addr_param);
 1287                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
 1288                             sizeof(struct in_addr));
 1289                         break;
 1290                 }
 1291 #endif
 1292         default:
 1293                 /* invalid family! */
 1294                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1295                 sctp_free_ifa(ifa);
 1296                 return (-1);
 1297         }
 1298         aa->sent = 0;           /* clear sent flag */
 1299 
 1300         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 1301 #ifdef SCTP_DEBUG
 1302         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
 1303                 if (type == SCTP_ADD_IP_ADDRESS) {
 1304                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
 1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1306                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 1307                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
 1308                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1309                 } else {
 1310                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
 1311                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
 1312                 }
 1313         }
 1314 #endif
 1315 
 1316         return (0);
 1317 }
 1318 
 1319 
 1320 /*
 1321  * add an asconf operation for the given ifa and type.
 1322  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
 1323  * returns 0 if completed, -1 if not completed, 1 if immediate send is
 1324  * advisable.
 1325  */
 1326 static int
 1327 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
 1328     uint16_t type)
 1329 {
 1330         uint32_t status;
 1331         int pending_delete_queued = 0;
 1332         int last;
 1333 
 1334         /* see if peer supports ASCONF */
 1335         if (stcb->asoc.asconf_supported == 0) {
 1336                 return (-1);
 1337         }
 1338         /*
 1339          * if this is deleting the last address from the assoc, mark it as
 1340          * pending.
 1341          */
 1342         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
 1343                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 1344                         last = (sctp_local_addr_count(stcb) == 0);
 1345                 } else {
 1346                         last = (sctp_local_addr_count(stcb) == 1);
 1347                 }
 1348                 if (last) {
 1349                         /* set the pending delete info only */
 1350                         stcb->asoc.asconf_del_pending = 1;
 1351                         stcb->asoc.asconf_addr_del_pending = ifa;
 1352                         atomic_add_int(&ifa->refcount, 1);
 1353                         SCTPDBG(SCTP_DEBUG_ASCONF2,
 1354                             "asconf_queue_add: mark delete last address pending\n");
 1355                         return (-1);
 1356                 }
 1357         }
 1358         /* queue an asconf parameter */
 1359         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
 1360 
 1361         /*
 1362          * if this is an add, and there is a delete also pending (i.e. the
 1363          * last local address is being changed), queue the pending delete
 1364          * too.
 1365          */
 1366         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
 1367                 /* queue in the pending delete */
 1368                 if (sctp_asconf_queue_mgmt(stcb,
 1369                     stcb->asoc.asconf_addr_del_pending,
 1370                     SCTP_DEL_IP_ADDRESS) == 0) {
 1371                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
 1372                         pending_delete_queued = 1;
 1373                         /* clear out the pending delete info */
 1374                         stcb->asoc.asconf_del_pending = 0;
 1375                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
 1376                         stcb->asoc.asconf_addr_del_pending = NULL;
 1377                 }
 1378         }
 1379         if (pending_delete_queued) {
 1380                 struct sctp_nets *net;
 1381 
 1382                 /*
 1383                  * since we know that the only/last address is now being
 1384                  * changed in this case, reset the cwnd/rto on all nets to
 1385                  * start as a new address and path.  Also clear the error
 1386                  * counts to give the assoc the best chance to complete the
 1387                  * address change.
 1388                  */
 1389                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1390                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
 1391                             net);
 1392                         net->RTO = 0;
 1393                         net->error_count = 0;
 1394                 }
 1395                 stcb->asoc.overall_error_count = 0;
 1396                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 1397                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 1398                             stcb->asoc.overall_error_count,
 1399                             0,
 1400                             SCTP_FROM_SCTP_ASCONF,
 1401                             __LINE__);
 1402                 }
 1403                 /* queue in an advisory set primary too */
 1404                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
 1405                 /* let caller know we should send this out immediately */
 1406                 status = 1;
 1407         }
 1408         return (status);
 1409 }
 1410 
 1411 /*-
 1412  * add an asconf delete IP address parameter to the queue by sockaddr and
 1413  * possibly with no sctp_ifa available.  This is only called by the routine
 1414  * that checks the addresses in an INIT-ACK against the current address list.
 1415  * returns 0 if completed, non-zero if not completed.
 1416  * NOTE: if an add is already scheduled (and not yet sent out), simply
 1417  * remove it from queue.  If a duplicate operation is found, ignore the
 1418  * new one.
 1419  */
 1420 static int
 1421 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
 1422 {
 1423         struct sctp_ifa *ifa;
 1424         struct sctp_asconf_addr *aa, *aa_next;
 1425 
 1426         if (stcb == NULL) {
 1427                 return (-1);
 1428         }
 1429         /* see if peer supports ASCONF */
 1430         if (stcb->asoc.asconf_supported == 0) {
 1431                 return (-1);
 1432         }
 1433         /* make sure the request isn't already in the queue */
 1434         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1435                 /* address match? */
 1436                 if (sctp_asconf_addr_match(aa, sa) == 0)
 1437                         continue;
 1438                 /* is the request already in queue (sent or not) */
 1439                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
 1440                         return (-1);
 1441                 }
 1442                 /* is the negative request already in queue, and not sent */
 1443                 if (aa->sent == 1)
 1444                         continue;
 1445                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
 1446                         /* add already queued, so remove existing entry */
 1447                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
 1448                         sctp_del_local_addr_restricted(stcb, aa->ifa);
 1449                         /* free the entry */
 1450                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1451                         return (-1);
 1452                 }
 1453         }                       /* for each aa */
 1454 
 1455         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
 1456         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
 1457 
 1458         /* adding new request to the queue */
 1459         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 1460             SCTP_M_ASC_ADDR);
 1461         if (aa == NULL) {
 1462                 /* didn't get memory */
 1463                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1464                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
 1465                 return (-1);
 1466         }
 1467         aa->special_del = 0;
 1468         /* fill in asconf address parameter fields */
 1469         /* top level elements are "networked" during send */
 1470         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
 1471         aa->ifa = ifa;
 1472         if (ifa)
 1473                 atomic_add_int(&ifa->refcount, 1);
 1474         /* correlation_id filled in during send routine later... */
 1475         switch (sa->sa_family) {
 1476 #ifdef INET6
 1477         case AF_INET6:
 1478                 {
 1479                         /* IPv6 address */
 1480                         struct sockaddr_in6 *sin6;
 1481 
 1482                         sin6 = (struct sockaddr_in6 *)sa;
 1483                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 1484                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
 1485                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
 1486                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
 1487                             sizeof(struct in6_addr));
 1488                         break;
 1489                 }
 1490 #endif
 1491 #ifdef INET
 1492         case AF_INET:
 1493                 {
 1494                         /* IPv4 address */
 1495                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 1496 
 1497                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 1498                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
 1499                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
 1500                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
 1501                             sizeof(struct in_addr));
 1502                         break;
 1503                 }
 1504 #endif
 1505         default:
 1506                 /* invalid family! */
 1507                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 1508                 if (ifa)
 1509                         sctp_free_ifa(ifa);
 1510                 return (-1);
 1511         }
 1512         aa->sent = 0;           /* clear sent flag */
 1513 
 1514         /* delete goes to the back of the queue */
 1515         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 1516 
 1517         /* sa_ignore MEMLEAK {memory is put on the tailq} */
 1518         return (0);
 1519 }
 1520 
 1521 /*
 1522  * find a specific asconf param on our "sent" queue
 1523  */
 1524 static struct sctp_asconf_addr *
 1525 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
 1526 {
 1527         struct sctp_asconf_addr *aa;
 1528 
 1529         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 1530                 if (aa->ap.aph.correlation_id == correlation_id &&
 1531                     aa->sent == 1) {
 1532                         /* found it */
 1533                         return (aa);
 1534                 }
 1535         }
 1536         /* didn't find it */
 1537         return (NULL);
 1538 }
 1539 
 1540 /*
 1541  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
 1542  * notifications based on the error response
 1543  */
 1544 static void
 1545 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
 1546     struct sctp_asconf_paramhdr *aph)
 1547 {
 1548         struct sctp_error_cause *eh;
 1549         struct sctp_paramhdr *ph;
 1550         uint16_t param_type;
 1551         uint16_t error_code;
 1552 
 1553         eh = (struct sctp_error_cause *)(aph + 1);
 1554         ph = (struct sctp_paramhdr *)(eh + 1);
 1555         /* validate lengths */
 1556         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
 1557             htons(aph->ph.param_length)) {
 1558                 /* invalid error cause length */
 1559                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1560                     "asconf_process_error: cause element too long\n");
 1561                 return;
 1562         }
 1563         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
 1564             htons(eh->length)) {
 1565                 /* invalid included TLV length */
 1566                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1567                     "asconf_process_error: included TLV too long\n");
 1568                 return;
 1569         }
 1570         /* which error code ? */
 1571         error_code = ntohs(eh->code);
 1572         param_type = ntohs(aph->ph.param_type);
 1573         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
 1574         switch (error_code) {
 1575         case SCTP_CAUSE_RESOURCE_SHORTAGE:
 1576                 /* we allow ourselves to "try again" for this error */
 1577                 break;
 1578         default:
 1579                 /* peer can't handle it... */
 1580                 switch (param_type) {
 1581                 case SCTP_ADD_IP_ADDRESS:
 1582                 case SCTP_DEL_IP_ADDRESS:
 1583                 case SCTP_SET_PRIM_ADDR:
 1584                         break;
 1585                 default:
 1586                         break;
 1587                 }
 1588         }
 1589 }
 1590 
 1591 /*
 1592  * process an asconf queue param.
 1593  * aparam: parameter to process, will be removed from the queue.
 1594  * flag: 1=success case, 0=failure case
 1595  */
 1596 static void
 1597 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
 1598     struct sctp_asconf_addr *aparam, uint32_t flag)
 1599 {
 1600         uint16_t param_type;
 1601 
 1602         /* process this param */
 1603         param_type = aparam->ap.aph.ph.param_type;
 1604         switch (param_type) {
 1605         case SCTP_ADD_IP_ADDRESS:
 1606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1607                     "process_param_ack: added IP address\n");
 1608                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
 1609                 break;
 1610         case SCTP_DEL_IP_ADDRESS:
 1611                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1612                     "process_param_ack: deleted IP address\n");
 1613                 /* nothing really to do... lists already updated */
 1614                 break;
 1615         case SCTP_SET_PRIM_ADDR:
 1616                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1617                     "process_param_ack: set primary IP address\n");
 1618                 /* nothing to do... peer may start using this addr */
 1619                 break;
 1620         default:
 1621                 /* should NEVER happen */
 1622                 break;
 1623         }
 1624 
 1625         /* remove the param and free it */
 1626         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
 1627         if (aparam->ifa)
 1628                 sctp_free_ifa(aparam->ifa);
 1629         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
 1630 }
 1631 
 1632 /*
 1633  * cleanup from a bad asconf ack parameter
 1634  */
 1635 static void
 1636 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
 1637 {
 1638         /* assume peer doesn't really know how to do asconfs */
 1639         /* XXX we could free the pending queue here */
 1640 
 1641 }
 1642 
 1643 void
 1644 sctp_handle_asconf_ack(struct mbuf *m, int offset,
 1645     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
 1646     struct sctp_nets *net, int *abort_no_unlock)
 1647 {
 1648         struct sctp_association *asoc;
 1649         uint32_t serial_num;
 1650         uint16_t ack_length;
 1651         struct sctp_asconf_paramhdr *aph;
 1652         struct sctp_asconf_addr *aa, *aa_next;
 1653         uint32_t last_error_id = 0;     /* last error correlation id */
 1654         uint32_t id;
 1655         struct sctp_asconf_addr *ap;
 1656 
 1657         /* asconf param buffer */
 1658         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 1659 
 1660         /* verify minimum length */
 1661         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
 1662                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 1663                     "handle_asconf_ack: chunk too small = %xh\n",
 1664                     ntohs(cp->ch.chunk_length));
 1665                 return;
 1666         }
 1667         asoc = &stcb->asoc;
 1668         serial_num = ntohl(cp->serial_number);
 1669 
 1670         /*
 1671          * NOTE: we may want to handle this differently- currently, we will
 1672          * abort when we get an ack for the expected serial number + 1 (eg.
 1673          * we didn't send it), process an ack normally if it is the expected
 1674          * serial number, and re-send the previous ack for *ALL* other
 1675          * serial numbers
 1676          */
 1677 
 1678         /*
 1679          * if the serial number is the next expected, but I didn't send it,
 1680          * abort the asoc, since someone probably just hijacked us...
 1681          */
 1682         if (serial_num == (asoc->asconf_seq_out + 1)) {
 1683                 struct mbuf *op_err;
 1684                 char msg[SCTP_DIAG_INFO_LEN];
 1685 
 1686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
 1687                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
 1688                     serial_num);
 1689                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
 1690                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 1691                 *abort_no_unlock = 1;
 1692                 return;
 1693         }
 1694         if (serial_num != asoc->asconf_seq_out_acked + 1) {
 1695                 /* got a duplicate/unexpected ASCONF-ACK */
 1696                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
 1697                     serial_num, asoc->asconf_seq_out_acked + 1);
 1698                 return;
 1699         }
 1700         if (serial_num == asoc->asconf_seq_out - 1) {
 1701                 /* stop our timer */
 1702                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 1703                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
 1704         }
 1705         /* process the ASCONF-ACK contents */
 1706         ack_length = ntohs(cp->ch.chunk_length) -
 1707             sizeof(struct sctp_asconf_ack_chunk);
 1708         offset += sizeof(struct sctp_asconf_ack_chunk);
 1709         /* process through all parameters */
 1710         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
 1711                 unsigned int param_length, param_type;
 1712 
 1713                 /* get pointer to next asconf parameter */
 1714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 1715                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 1716                 if (aph == NULL) {
 1717                         /* can't get an asconf paramhdr */
 1718                         sctp_asconf_ack_clear(stcb);
 1719                         return;
 1720                 }
 1721                 param_type = ntohs(aph->ph.param_type);
 1722                 param_length = ntohs(aph->ph.param_length);
 1723                 if (param_length > ack_length) {
 1724                         sctp_asconf_ack_clear(stcb);
 1725                         return;
 1726                 }
 1727                 if (param_length < sizeof(struct sctp_paramhdr)) {
 1728                         sctp_asconf_ack_clear(stcb);
 1729                         return;
 1730                 }
 1731                 /* get the complete parameter... */
 1732                 if (param_length > sizeof(aparam_buf)) {
 1733                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 1734                             "param length (%u) larger than buffer size!\n", param_length);
 1735                         sctp_asconf_ack_clear(stcb);
 1736                         return;
 1737                 }
 1738                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 1739                 if (aph == NULL) {
 1740                         sctp_asconf_ack_clear(stcb);
 1741                         return;
 1742                 }
 1743                 /* correlation_id is transparent to peer, no ntohl needed */
 1744                 id = aph->correlation_id;
 1745 
 1746                 switch (param_type) {
 1747                 case SCTP_ERROR_CAUSE_IND:
 1748                         last_error_id = id;
 1749                         /* find the corresponding asconf param in our queue */
 1750                         ap = sctp_asconf_find_param(stcb, id);
 1751                         if (ap == NULL) {
 1752                                 /* hmm... can't find this in our queue! */
 1753                                 break;
 1754                         }
 1755                         /* process the parameter, failed flag */
 1756                         sctp_asconf_process_param_ack(stcb, ap, 0);
 1757                         /* process the error response */
 1758                         sctp_asconf_process_error(stcb, aph);
 1759                         break;
 1760                 case SCTP_SUCCESS_REPORT:
 1761                         /* find the corresponding asconf param in our queue */
 1762                         ap = sctp_asconf_find_param(stcb, id);
 1763                         if (ap == NULL) {
 1764                                 /* hmm... can't find this in our queue! */
 1765                                 break;
 1766                         }
 1767                         /* process the parameter, success flag */
 1768                         sctp_asconf_process_param_ack(stcb, ap, 1);
 1769                         break;
 1770                 default:
 1771                         break;
 1772                 }               /* switch */
 1773 
 1774                 /* update remaining ASCONF-ACK message length to process */
 1775                 ack_length -= SCTP_SIZE32(param_length);
 1776                 if (ack_length <= 0) {
 1777                         /* no more data in the mbuf chain */
 1778                         break;
 1779                 }
 1780                 offset += SCTP_SIZE32(param_length);
 1781         }                       /* while */
 1782 
 1783         /*
 1784          * if there are any "sent" params still on the queue, these are
 1785          * implicitly "success", or "failed" (if we got an error back) ...
 1786          * so process these appropriately
 1787          * 
 1788          * we assume that the correlation_id's are monotonically increasing
 1789          * beginning from 1 and that we don't have *that* many outstanding
 1790          * at any given time
 1791          */
 1792         if (last_error_id == 0)
 1793                 last_error_id--;/* set to "max" value */
 1794         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
 1795                 if (aa->sent == 1) {
 1796                         /*
 1797                          * implicitly successful or failed if correlation_id
 1798                          * < last_error_id, then success else, failure
 1799                          */
 1800                         if (aa->ap.aph.correlation_id < last_error_id)
 1801                                 sctp_asconf_process_param_ack(stcb, aa, 1);
 1802                         else
 1803                                 sctp_asconf_process_param_ack(stcb, aa, 0);
 1804                 } else {
 1805                         /*
 1806                          * since we always process in order (FIFO queue) if
 1807                          * we reach one that hasn't been sent, the rest
 1808                          * should not have been sent either. so, we're
 1809                          * done...
 1810                          */
 1811                         break;
 1812                 }
 1813         }
 1814 
 1815         /* update the next sequence number to use */
 1816         asoc->asconf_seq_out_acked++;
 1817         /* remove the old ASCONF on our outbound queue */
 1818         sctp_toss_old_asconf(stcb);
 1819         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
 1820 #ifdef SCTP_TIMER_BASED_ASCONF
 1821                 /* we have more params, so restart our timer */
 1822                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
 1823                     stcb, net);
 1824 #else
 1825                 /* we have more params, so send out more */
 1826                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
 1827 #endif
 1828         }
 1829 }
 1830 
 1831 #ifdef INET6
 1832 static uint32_t
 1833 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
 1834 {
 1835         struct sockaddr_in6 *sin6, *net6;
 1836         struct sctp_nets *net;
 1837 
 1838         if (sa->sa_family != AF_INET6) {
 1839                 /* wrong family */
 1840                 return (0);
 1841         }
 1842         sin6 = (struct sockaddr_in6 *)sa;
 1843         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
 1844                 /* not link local address */
 1845                 return (0);
 1846         }
 1847         /* hunt through our destination nets list for this scope_id */
 1848         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 1849                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
 1850                     AF_INET6)
 1851                         continue;
 1852                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 1853                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
 1854                         continue;
 1855                 if (sctp_is_same_scope(sin6, net6)) {
 1856                         /* found one */
 1857                         return (1);
 1858                 }
 1859         }
 1860         /* didn't find one */
 1861         return (0);
 1862 }
 1863 
 1864 #endif
 1865 
 1866 /*
 1867  * address management functions
 1868  */
 1869 static void
 1870 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 1871     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
 1872 {
 1873         int status;
 1874 
 1875         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
 1876             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
 1877                 /* subset bound, no ASCONF allowed case, so ignore */
 1878                 return;
 1879         }
 1880         /*
 1881          * note: we know this is not the subset bound, no ASCONF case eg.
 1882          * this is boundall or subset bound w/ASCONF allowed
 1883          */
 1884 
 1885         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
 1886         switch (ifa->address.sa.sa_family) {
 1887 #ifdef INET6
 1888         case AF_INET6:
 1889                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
 1890                     &ifa->address.sin6.sin6_addr) != 0) {
 1891                         return;
 1892                 }
 1893                 break;
 1894 #endif
 1895 #ifdef INET
 1896         case AF_INET:
 1897                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
 1898                     &ifa->address.sin.sin_addr) != 0) {
 1899                         return;
 1900                 }
 1901                 break;
 1902 #endif
 1903         default:
 1904                 return;
 1905         }
 1906 #ifdef INET6
 1907         /* make sure we're "allowed" to add this type of addr */
 1908         if (ifa->address.sa.sa_family == AF_INET6) {
 1909                 /* invalid if we're not a v6 endpoint */
 1910                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
 1911                         return;
 1912                 /* is the v6 addr really valid ? */
 1913                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
 1914                         return;
 1915                 }
 1916         }
 1917 #endif
 1918         /* put this address on the "pending/do not use yet" list */
 1919         sctp_add_local_addr_restricted(stcb, ifa);
 1920         /*
 1921          * check address scope if address is out of scope, don't queue
 1922          * anything... note: this would leave the address on both inp and
 1923          * asoc lists
 1924          */
 1925         switch (ifa->address.sa.sa_family) {
 1926 #ifdef INET6
 1927         case AF_INET6:
 1928                 {
 1929                         struct sockaddr_in6 *sin6;
 1930 
 1931                         sin6 = &ifa->address.sin6;
 1932                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 1933                                 /* we skip unspecifed addresses */
 1934                                 return;
 1935                         }
 1936                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 1937                                 if (stcb->asoc.scope.local_scope == 0) {
 1938                                         return;
 1939                                 }
 1940                                 /* is it the right link local scope? */
 1941                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
 1942                                         return;
 1943                                 }
 1944                         }
 1945                         if (stcb->asoc.scope.site_scope == 0 &&
 1946                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
 1947                                 return;
 1948                         }
 1949                         break;
 1950                 }
 1951 #endif
 1952 #ifdef INET
 1953         case AF_INET:
 1954                 {
 1955                         struct sockaddr_in *sin;
 1956                         struct in6pcb *inp6;
 1957 
 1958                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 1959                         /* invalid if we are a v6 only endpoint */
 1960                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 1961                             SCTP_IPV6_V6ONLY(inp6))
 1962                                 return;
 1963 
 1964                         sin = &ifa->address.sin;
 1965                         if (sin->sin_addr.s_addr == 0) {
 1966                                 /* we skip unspecifed addresses */
 1967                                 return;
 1968                         }
 1969                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 1970                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 1971                                 return;
 1972                         }
 1973                         break;
 1974                 }
 1975 #endif
 1976         default:
 1977                 /* else, not AF_INET or AF_INET6, so skip */
 1978                 return;
 1979         }
 1980 
 1981         /* queue an asconf for this address add/delete */
 1982         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
 1983                 /* does the peer do asconf? */
 1984                 if (stcb->asoc.asconf_supported) {
 1985                         /* queue an asconf for this addr */
 1986                         status = sctp_asconf_queue_add(stcb, ifa, type);
 1987 
 1988                         /*
 1989                          * if queued ok, and in the open state, send out the
 1990                          * ASCONF.  If in the non-open state, these will be
 1991                          * sent when the state goes open.
 1992                          */
 1993                         if (status == 0 &&
 1994                             ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 1995                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
 1996 #ifdef SCTP_TIMER_BASED_ASCONF
 1997                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
 1998                                     stcb, stcb->asoc.primary_destination);
 1999 #else
 2000                                 sctp_send_asconf(stcb, NULL, addr_locked);
 2001 #endif
 2002                         }
 2003                 }
 2004         }
 2005 }
 2006 
 2007 
 2008 int
 2009 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
 2010 {
 2011         struct sctp_asconf_iterator *asc;
 2012         struct sctp_ifa *ifa;
 2013         struct sctp_laddr *l;
 2014         int cnt_invalid = 0;
 2015 
 2016         asc = (struct sctp_asconf_iterator *)ptr;
 2017         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2018                 ifa = l->ifa;
 2019                 switch (ifa->address.sa.sa_family) {
 2020 #ifdef INET6
 2021                 case AF_INET6:
 2022                         /* invalid if we're not a v6 endpoint */
 2023                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 2024                                 cnt_invalid++;
 2025                                 if (asc->cnt == cnt_invalid)
 2026                                         return (1);
 2027                         }
 2028                         break;
 2029 #endif
 2030 #ifdef INET
 2031                 case AF_INET:
 2032                         {
 2033                                 /* invalid if we are a v6 only endpoint */
 2034                                 struct in6pcb *inp6;
 2035 
 2036                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 2037                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2038                                     SCTP_IPV6_V6ONLY(inp6)) {
 2039                                         cnt_invalid++;
 2040                                         if (asc->cnt == cnt_invalid)
 2041                                                 return (1);
 2042                                 }
 2043                                 break;
 2044                         }
 2045 #endif
 2046                 default:
 2047                         /* invalid address family */
 2048                         cnt_invalid++;
 2049                         if (asc->cnt == cnt_invalid)
 2050                                 return (1);
 2051                 }
 2052         }
 2053         return (0);
 2054 }
 2055 
 2056 static int
 2057 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
 2058 {
 2059         struct sctp_ifa *ifa;
 2060         struct sctp_asconf_iterator *asc;
 2061         struct sctp_laddr *laddr, *nladdr, *l;
 2062 
 2063         /* Only for specific case not bound all */
 2064         asc = (struct sctp_asconf_iterator *)ptr;
 2065         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2066                 ifa = l->ifa;
 2067                 if (l->action == SCTP_ADD_IP_ADDRESS) {
 2068                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
 2069                             sctp_nxt_addr) {
 2070                                 if (laddr->ifa == ifa) {
 2071                                         laddr->action = 0;
 2072                                         break;
 2073                                 }
 2074                         }
 2075                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
 2076                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
 2077                                 /* remove only after all guys are done */
 2078                                 if (laddr->ifa == ifa) {
 2079                                         sctp_del_local_addr_ep(inp, ifa);
 2080                                 }
 2081                         }
 2082                 }
 2083         }
 2084         return (0);
 2085 }
 2086 
 2087 void
 2088 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 2089     void *ptr, uint32_t val SCTP_UNUSED)
 2090 {
 2091         struct sctp_asconf_iterator *asc;
 2092         struct sctp_ifa *ifa;
 2093         struct sctp_laddr *l;
 2094         int cnt_invalid = 0;
 2095         int type, status;
 2096         int num_queued = 0;
 2097 
 2098         asc = (struct sctp_asconf_iterator *)ptr;
 2099         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
 2100                 ifa = l->ifa;
 2101                 type = l->action;
 2102 
 2103                 /* address's vrf_id must be the vrf_id of the assoc */
 2104                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
 2105                         continue;
 2106                 }
 2107                 /* Same checks again for assoc */
 2108                 switch (ifa->address.sa.sa_family) {
 2109 #ifdef INET6
 2110                 case AF_INET6:
 2111                         {
 2112                                 /* invalid if we're not a v6 endpoint */
 2113                                 struct sockaddr_in6 *sin6;
 2114 
 2115                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 2116                                         cnt_invalid++;
 2117                                         if (asc->cnt == cnt_invalid)
 2118                                                 return;
 2119                                         else
 2120                                                 continue;
 2121                                 }
 2122                                 sin6 = &ifa->address.sin6;
 2123                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 2124                                         /* we skip unspecifed addresses */
 2125                                         continue;
 2126                                 }
 2127                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
 2128                                     &sin6->sin6_addr) != 0) {
 2129                                         continue;
 2130                                 }
 2131                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 2132                                         if (stcb->asoc.scope.local_scope == 0) {
 2133                                                 continue;
 2134                                         }
 2135                                         /* is it the right link local scope? */
 2136                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
 2137                                                 continue;
 2138                                         }
 2139                                 }
 2140                                 break;
 2141                         }
 2142 #endif
 2143 #ifdef INET
 2144                 case AF_INET:
 2145                         {
 2146                                 /* invalid if we are a v6 only endpoint */
 2147                                 struct in6pcb *inp6;
 2148                                 struct sockaddr_in *sin;
 2149 
 2150                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
 2151                                 /* invalid if we are a v6 only endpoint */
 2152                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2153                                     SCTP_IPV6_V6ONLY(inp6))
 2154                                         continue;
 2155 
 2156                                 sin = &ifa->address.sin;
 2157                                 if (sin->sin_addr.s_addr == 0) {
 2158                                         /* we skip unspecifed addresses */
 2159                                         continue;
 2160                                 }
 2161                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
 2162                                     &sin->sin_addr) != 0) {
 2163                                         continue;
 2164                                 }
 2165                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 2166                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 2167                                         continue;
 2168                                 }
 2169                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 2170                                     SCTP_IPV6_V6ONLY(inp6)) {
 2171                                         cnt_invalid++;
 2172                                         if (asc->cnt == cnt_invalid)
 2173                                                 return;
 2174                                         else
 2175                                                 continue;
 2176                                 }
 2177                                 break;
 2178                         }
 2179 #endif
 2180                 default:
 2181                         /* invalid address family */
 2182                         cnt_invalid++;
 2183                         if (asc->cnt == cnt_invalid)
 2184                                 return;
 2185                         else
 2186                                 continue;
 2187                         break;
 2188                 }
 2189 
 2190                 if (type == SCTP_ADD_IP_ADDRESS) {
 2191                         /* prevent this address from being used as a source */
 2192                         sctp_add_local_addr_restricted(stcb, ifa);
 2193                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 2194                         struct sctp_nets *net;
 2195 
 2196                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 2197                                 sctp_rtentry_t *rt;
 2198 
 2199                                 /* delete this address if cached */
 2200                                 if (net->ro._s_addr == ifa) {
 2201                                         sctp_free_ifa(net->ro._s_addr);
 2202                                         net->ro._s_addr = NULL;
 2203                                         net->src_addr_selected = 0;
 2204                                         rt = net->ro.ro_rt;
 2205                                         if (rt) {
 2206                                                 RTFREE(rt);
 2207                                                 net->ro.ro_rt = NULL;
 2208                                         }
 2209                                         /*
 2210                                          * Now we deleted our src address,
 2211                                          * should we not also now reset the
 2212                                          * cwnd/rto to start as if its a new
 2213                                          * address?
 2214                                          */
 2215                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
 2216                                         net->RTO = 0;
 2217 
 2218                                 }
 2219                         }
 2220                 } else if (type == SCTP_SET_PRIM_ADDR) {
 2221                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 2222                                 /* must validate the ifa is in the ep */
 2223                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
 2224                                         continue;
 2225                                 }
 2226                         } else {
 2227                                 /* Need to check scopes for this guy */
 2228                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
 2229                                         continue;
 2230                                 }
 2231                         }
 2232                 }
 2233                 /* queue an asconf for this address add/delete */
 2234                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
 2235                     stcb->asoc.asconf_supported == 1) {
 2236                         /* queue an asconf for this addr */
 2237                         status = sctp_asconf_queue_add(stcb, ifa, type);
 2238                         /*
 2239                          * if queued ok, and in the open state, update the
 2240                          * count of queued params.  If in the non-open
 2241                          * state, these get sent when the assoc goes open.
 2242                          */
 2243                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2244                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2245                                 if (status >= 0) {
 2246                                         num_queued++;
 2247                                 }
 2248                         }
 2249                 }
 2250         }
 2251         /*
 2252          * If we have queued params in the open state, send out an ASCONF.
 2253          */
 2254         if (num_queued > 0) {
 2255                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2256         }
 2257 }
 2258 
 2259 void
 2260 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
 2261 {
 2262         struct sctp_asconf_iterator *asc;
 2263         struct sctp_ifa *ifa;
 2264         struct sctp_laddr *l, *nl;
 2265 
 2266         asc = (struct sctp_asconf_iterator *)ptr;
 2267         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
 2268                 ifa = l->ifa;
 2269                 if (l->action == SCTP_ADD_IP_ADDRESS) {
 2270                         /* Clear the defer use flag */
 2271                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
 2272                 }
 2273                 sctp_free_ifa(ifa);
 2274                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
 2275                 SCTP_DECR_LADDR_COUNT();
 2276         }
 2277         SCTP_FREE(asc, SCTP_M_ASC_IT);
 2278 }
 2279 
 2280 /*
 2281  * sa is the sockaddr to ask the peer to set primary to.
 2282  * returns: 0 = completed, -1 = error
 2283  */
 2284 int32_t
 2285 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
 2286 {
 2287         uint32_t vrf_id;
 2288         struct sctp_ifa *ifa;
 2289 
 2290         /* find the ifa for the desired set primary */
 2291         vrf_id = stcb->asoc.vrf_id;
 2292         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
 2293         if (ifa == NULL) {
 2294                 /* Invalid address */
 2295                 return (-1);
 2296         }
 2297         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
 2298         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
 2299                 /* set primary queuing succeeded */
 2300                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2301                     "set_primary_ip_address_sa: queued on tcb=%p, ",
 2302                     (void *)stcb);
 2303                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 2304                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2305                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2306 #ifdef SCTP_TIMER_BASED_ASCONF
 2307                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2308                             stcb->sctp_ep, stcb,
 2309                             stcb->asoc.primary_destination);
 2310 #else
 2311                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2312 #endif
 2313                 }
 2314         } else {
 2315                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
 2316                     (void *)stcb);
 2317                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 2318                 return (-1);
 2319         }
 2320         return (0);
 2321 }
 2322 
 2323 void
 2324 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
 2325 {
 2326         struct sctp_inpcb *inp;
 2327 
 2328         /* go through all our PCB's */
 2329         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
 2330                 struct sctp_tcb *stcb;
 2331 
 2332                 /* process for all associations for this endpoint */
 2333                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 2334                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
 2335                         if (!sctp_asconf_queue_add(stcb, ifa,
 2336                             SCTP_SET_PRIM_ADDR)) {
 2337                                 /* set primary queuing succeeded */
 2338                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
 2339                                     (void *)stcb);
 2340                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
 2341                                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 2342                                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 2343 #ifdef SCTP_TIMER_BASED_ASCONF
 2344                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2345                                             stcb->sctp_ep, stcb,
 2346                                             stcb->asoc.primary_destination);
 2347 #else
 2348                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2349 #endif
 2350                                 }
 2351                         }
 2352                 }               /* for each stcb */
 2353         }                       /* for each inp */
 2354 }
 2355 
 2356 int
 2357 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
 2358 {
 2359         struct sctp_tmit_chunk *chk, *nchk;
 2360         unsigned int offset, asconf_limit;
 2361         struct sctp_asconf_chunk *acp;
 2362         struct sctp_asconf_paramhdr *aph;
 2363         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 2364         struct sctp_paramhdr *ph;
 2365         int add_cnt, del_cnt;
 2366         uint16_t last_param_type;
 2367 
 2368         add_cnt = del_cnt = 0;
 2369         last_param_type = 0;
 2370         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
 2371                 if (chk->data == NULL) {
 2372                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
 2373                         continue;
 2374                 }
 2375                 offset = 0;
 2376                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
 2377                 offset += sizeof(struct sctp_asconf_chunk);
 2378                 asconf_limit = ntohs(acp->ch.chunk_length);
 2379                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
 2380                 if (ph == NULL) {
 2381                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
 2382                         continue;
 2383                 }
 2384                 offset += ntohs(ph->param_length);
 2385 
 2386                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 2387                 if (aph == NULL) {
 2388                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
 2389                         continue;
 2390                 }
 2391                 while (aph != NULL) {
 2392                         unsigned int param_length, param_type;
 2393 
 2394                         param_type = ntohs(aph->ph.param_type);
 2395                         param_length = ntohs(aph->ph.param_length);
 2396                         if (offset + param_length > asconf_limit) {
 2397                                 /* parameter goes beyond end of chunk! */
 2398                                 break;
 2399                         }
 2400                         if (param_length > sizeof(aparam_buf)) {
 2401                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
 2402                                 break;
 2403                         }
 2404                         if (param_length <= sizeof(struct sctp_paramhdr)) {
 2405                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
 2406                                 break;
 2407                         }
 2408                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
 2409                         if (aph == NULL) {
 2410                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
 2411                                 break;
 2412                         }
 2413                         ph = (struct sctp_paramhdr *)(aph + 1);
 2414                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
 2415                                 switch (param_type) {
 2416                                 case SCTP_ADD_IP_ADDRESS:
 2417                                         add_cnt++;
 2418                                         break;
 2419                                 case SCTP_DEL_IP_ADDRESS:
 2420                                         del_cnt++;
 2421                                         break;
 2422                                 default:
 2423                                         break;
 2424                                 }
 2425                                 last_param_type = param_type;
 2426                         }
 2427                         offset += SCTP_SIZE32(param_length);
 2428                         if (offset >= asconf_limit) {
 2429                                 /* no more data in the mbuf chain */
 2430                                 break;
 2431                         }
 2432                         /* get pointer to next asconf param */
 2433                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
 2434                 }
 2435         }
 2436 
 2437         /*
 2438          * we want to find the sequences which consist of ADD -> DEL -> ADD
 2439          * or DEL -> ADD
 2440          */
 2441         if (add_cnt > del_cnt ||
 2442             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
 2443                 return (1);
 2444         }
 2445         return (0);
 2446 }
 2447 
 2448 static struct sockaddr *
 2449 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
 2450 {
 2451         struct sctp_vrf *vrf = NULL;
 2452         struct sctp_ifn *sctp_ifn;
 2453         struct sctp_ifa *sctp_ifa;
 2454 
 2455         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2456                 SCTP_IPI_ADDR_RLOCK();
 2457         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
 2458         if (vrf == NULL) {
 2459                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2460                         SCTP_IPI_ADDR_RUNLOCK();
 2461                 return (NULL);
 2462         }
 2463         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
 2464                 if (stcb->asoc.scope.loopback_scope == 0 &&
 2465                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
 2466                         /* Skip if loopback_scope not set */
 2467                         continue;
 2468                 }
 2469                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
 2470                         switch (sctp_ifa->address.sa.sa_family) {
 2471 #ifdef INET
 2472                         case AF_INET:
 2473                                 if (stcb->asoc.scope.ipv4_addr_legal) {
 2474                                         struct sockaddr_in *sin;
 2475 
 2476                                         sin = &sctp_ifa->address.sin;
 2477                                         if (sin->sin_addr.s_addr == 0) {
 2478                                                 /* skip unspecifed addresses */
 2479                                                 continue;
 2480                                         }
 2481                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 2482                                             &sin->sin_addr) != 0) {
 2483                                                 continue;
 2484                                         }
 2485                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
 2486                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
 2487                                                 continue;
 2488 
 2489                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
 2490                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
 2491                                                 continue;
 2492                                         /*
 2493                                          * found a valid local v4 address to
 2494                                          * use
 2495                                          */
 2496                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2497                                                 SCTP_IPI_ADDR_RUNLOCK();
 2498                                         return (&sctp_ifa->address.sa);
 2499                                 }
 2500                                 break;
 2501 #endif
 2502 #ifdef INET6
 2503                         case AF_INET6:
 2504                                 if (stcb->asoc.scope.ipv6_addr_legal) {
 2505                                         struct sockaddr_in6 *sin6;
 2506 
 2507                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
 2508                                                 continue;
 2509                                         }
 2510                                         sin6 = &sctp_ifa->address.sin6;
 2511                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 2512                                                 /*
 2513                                                  * we skip unspecifed
 2514                                                  * addresses
 2515                                                  */
 2516                                                 continue;
 2517                                         }
 2518                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 2519                                             &sin6->sin6_addr) != 0) {
 2520                                                 continue;
 2521                                         }
 2522                                         if (stcb->asoc.scope.local_scope == 0 &&
 2523                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
 2524                                                 continue;
 2525                                         if (stcb->asoc.scope.site_scope == 0 &&
 2526                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
 2527                                                 continue;
 2528 
 2529                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
 2530                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
 2531                                                 continue;
 2532                                         /*
 2533                                          * found a valid local v6 address to
 2534                                          * use
 2535                                          */
 2536                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2537                                                 SCTP_IPI_ADDR_RUNLOCK();
 2538                                         return (&sctp_ifa->address.sa);
 2539                                 }
 2540                                 break;
 2541 #endif
 2542                         default:
 2543                                 break;
 2544                         }
 2545                 }
 2546         }
 2547         /* no valid addresses found */
 2548         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
 2549                 SCTP_IPI_ADDR_RUNLOCK();
 2550         return (NULL);
 2551 }
 2552 
 2553 static struct sockaddr *
 2554 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
 2555 {
 2556         struct sctp_laddr *laddr;
 2557 
 2558         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 2559                 if (laddr->ifa == NULL) {
 2560                         continue;
 2561                 }
 2562                 /* is the address restricted ? */
 2563                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
 2564                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
 2565                         continue;
 2566 
 2567                 /* found a valid local address to use */
 2568                 return (&laddr->ifa->address.sa);
 2569         }
 2570         /* no valid addresses found */
 2571         return (NULL);
 2572 }
 2573 
 2574 /*
 2575  * builds an ASCONF chunk from queued ASCONF params.
 2576  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
 2577  */
 2578 struct mbuf *
 2579 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
 2580 {
 2581         struct mbuf *m_asconf, *m_asconf_chk;
 2582         struct sctp_asconf_addr *aa;
 2583         struct sctp_asconf_chunk *acp;
 2584         struct sctp_asconf_paramhdr *aph;
 2585         struct sctp_asconf_addr_param *aap;
 2586         uint32_t p_length;
 2587         uint32_t correlation_id = 1;    /* 0 is reserved... */
 2588         caddr_t ptr, lookup_ptr;
 2589         uint8_t lookup_used = 0;
 2590 
 2591         /* are there any asconf params to send? */
 2592         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 2593                 if (aa->sent == 0)
 2594                         break;
 2595         }
 2596         if (aa == NULL)
 2597                 return (NULL);
 2598 
 2599         /*
 2600          * get a chunk header mbuf and a cluster for the asconf params since
 2601          * it's simpler to fill in the asconf chunk header lookup address on
 2602          * the fly
 2603          */
 2604         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
 2605         if (m_asconf_chk == NULL) {
 2606                 /* no mbuf's */
 2607                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2608                     "compose_asconf: couldn't get chunk mbuf!\n");
 2609                 return (NULL);
 2610         }
 2611         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
 2612         if (m_asconf == NULL) {
 2613                 /* no mbuf's */
 2614                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2615                     "compose_asconf: couldn't get mbuf!\n");
 2616                 sctp_m_freem(m_asconf_chk);
 2617                 return (NULL);
 2618         }
 2619         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
 2620         SCTP_BUF_LEN(m_asconf) = 0;
 2621         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
 2622         bzero(acp, sizeof(struct sctp_asconf_chunk));
 2623         /* save pointers to lookup address and asconf params */
 2624         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
 2625         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
 2626 
 2627         /* fill in chunk header info */
 2628         acp->ch.chunk_type = SCTP_ASCONF;
 2629         acp->ch.chunk_flags = 0;
 2630         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
 2631         stcb->asoc.asconf_seq_out++;
 2632 
 2633         /* add parameters... up to smallest MTU allowed */
 2634         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
 2635                 if (aa->sent)
 2636                         continue;
 2637                 /* get the parameter length */
 2638                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
 2639                 /* will it fit in current chunk? */
 2640                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
 2641                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
 2642                         /* won't fit, so we're done with this chunk */
 2643                         break;
 2644                 }
 2645                 /* assign (and store) a correlation id */
 2646                 aa->ap.aph.correlation_id = correlation_id++;
 2647 
 2648                 /*
 2649                  * fill in address if we're doing a delete this is a simple
 2650                  * way for us to fill in the correlation address, which
 2651                  * should only be used by the peer if we're deleting our
 2652                  * source address and adding a new address (e.g. renumbering
 2653                  * case)
 2654                  */
 2655                 if (lookup_used == 0 &&
 2656                     (aa->special_del == 0) &&
 2657                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
 2658                         struct sctp_ipv6addr_param *lookup;
 2659                         uint16_t p_size, addr_size;
 2660 
 2661                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
 2662                         lookup->ph.param_type =
 2663                             htons(aa->ap.addrp.ph.param_type);
 2664                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
 2665                                 /* copy IPv6 address */
 2666                                 p_size = sizeof(struct sctp_ipv6addr_param);
 2667                                 addr_size = sizeof(struct in6_addr);
 2668                         } else {
 2669                                 /* copy IPv4 address */
 2670                                 p_size = sizeof(struct sctp_ipv4addr_param);
 2671                                 addr_size = sizeof(struct in_addr);
 2672                         }
 2673                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
 2674                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
 2675                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
 2676                         lookup_used = 1;
 2677                 }
 2678                 /* copy into current space */
 2679                 memcpy(ptr, &aa->ap, p_length);
 2680 
 2681                 /* network elements and update lengths */
 2682                 aph = (struct sctp_asconf_paramhdr *)ptr;
 2683                 aap = (struct sctp_asconf_addr_param *)ptr;
 2684                 /* correlation_id is transparent to peer, no htonl needed */
 2685                 aph->ph.param_type = htons(aph->ph.param_type);
 2686                 aph->ph.param_length = htons(aph->ph.param_length);
 2687                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
 2688                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
 2689 
 2690                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
 2691                 ptr += SCTP_SIZE32(p_length);
 2692 
 2693                 /*
 2694                  * these params are removed off the pending list upon
 2695                  * getting an ASCONF-ACK back from the peer, just set flag
 2696                  */
 2697                 aa->sent = 1;
 2698         }
 2699         /* check to see if the lookup addr has been populated yet */
 2700         if (lookup_used == 0) {
 2701                 /* NOTE: if the address param is optional, can skip this... */
 2702                 /* add any valid (existing) address... */
 2703                 struct sctp_ipv6addr_param *lookup;
 2704                 uint16_t p_size, addr_size;
 2705                 struct sockaddr *found_addr;
 2706                 caddr_t addr_ptr;
 2707 
 2708                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
 2709                         found_addr = sctp_find_valid_localaddr(stcb,
 2710                             addr_locked);
 2711                 else
 2712                         found_addr = sctp_find_valid_localaddr_ep(stcb);
 2713 
 2714                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
 2715                 if (found_addr != NULL) {
 2716                         switch (found_addr->sa_family) {
 2717 #ifdef INET6
 2718                         case AF_INET6:
 2719                                 /* copy IPv6 address */
 2720                                 lookup->ph.param_type =
 2721                                     htons(SCTP_IPV6_ADDRESS);
 2722                                 p_size = sizeof(struct sctp_ipv6addr_param);
 2723                                 addr_size = sizeof(struct in6_addr);
 2724                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
 2725                                     found_addr)->sin6_addr;
 2726                                 break;
 2727 #endif
 2728 #ifdef INET
 2729                         case AF_INET:
 2730                                 /* copy IPv4 address */
 2731                                 lookup->ph.param_type =
 2732                                     htons(SCTP_IPV4_ADDRESS);
 2733                                 p_size = sizeof(struct sctp_ipv4addr_param);
 2734                                 addr_size = sizeof(struct in_addr);
 2735                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
 2736                                     found_addr)->sin_addr;
 2737                                 break;
 2738 #endif
 2739                         default:
 2740                                 p_size = 0;
 2741                                 addr_size = 0;
 2742                                 addr_ptr = NULL;
 2743                                 break;
 2744                         }
 2745                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
 2746                         memcpy(lookup->addr, addr_ptr, addr_size);
 2747                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
 2748                 } else {
 2749                         /* uh oh... don't have any address?? */
 2750                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 2751                             "compose_asconf: no lookup addr!\n");
 2752                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
 2753                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
 2754                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
 2755                         bzero(lookup->addr, sizeof(struct in_addr));
 2756                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
 2757                 }
 2758         }
 2759         /* chain it all together */
 2760         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
 2761         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
 2762         acp->ch.chunk_length = htons(*retlen);
 2763 
 2764         return (m_asconf_chk);
 2765 }
 2766 
 2767 /*
 2768  * section to handle address changes before an association is up eg. changes
 2769  * during INIT/INIT-ACK/COOKIE-ECHO handshake
 2770  */
 2771 
 2772 /*
 2773  * processes the (local) addresses in the INIT-ACK chunk
 2774  */
 2775 static void
 2776 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
 2777     unsigned int offset, unsigned int length)
 2778 {
 2779         struct sctp_paramhdr tmp_param, *ph;
 2780         uint16_t plen, ptype;
 2781         struct sctp_ifa *sctp_ifa;
 2782         union sctp_sockstore store;
 2783 
 2784 #ifdef INET6
 2785         struct sctp_ipv6addr_param addr6_store;
 2786 
 2787 #endif
 2788 #ifdef INET
 2789         struct sctp_ipv4addr_param addr4_store;
 2790 
 2791 #endif
 2792 
 2793         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
 2794         if (stcb == NULL)       /* Un-needed check for SA */
 2795                 return;
 2796 
 2797         /* convert to upper bound */
 2798         length += offset;
 2799 
 2800         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
 2801                 return;
 2802         }
 2803         /* go through the addresses in the init-ack */
 2804         ph = (struct sctp_paramhdr *)
 2805             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
 2806             (uint8_t *) & tmp_param);
 2807         while (ph != NULL) {
 2808                 ptype = ntohs(ph->param_type);
 2809                 plen = ntohs(ph->param_length);
 2810                 switch (ptype) {
 2811 #ifdef INET6
 2812                 case SCTP_IPV6_ADDRESS:
 2813                         {
 2814                                 struct sctp_ipv6addr_param *a6p;
 2815 
 2816                                 /* get the entire IPv6 address param */
 2817                                 a6p = (struct sctp_ipv6addr_param *)
 2818                                     sctp_m_getptr(m, offset,
 2819                                     sizeof(struct sctp_ipv6addr_param),
 2820                                     (uint8_t *) & addr6_store);
 2821                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
 2822                                     a6p == NULL) {
 2823                                         return;
 2824                                 }
 2825                                 memset(&store, 0, sizeof(union sctp_sockstore));
 2826                                 store.sin6.sin6_family = AF_INET6;
 2827                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
 2828                                 store.sin6.sin6_port = stcb->rport;
 2829                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
 2830                                 break;
 2831                         }
 2832 #endif
 2833 #ifdef INET
 2834                 case SCTP_IPV4_ADDRESS:
 2835                         {
 2836                                 struct sctp_ipv4addr_param *a4p;
 2837 
 2838                                 /* get the entire IPv4 address param */
 2839                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
 2840                                     sizeof(struct sctp_ipv4addr_param),
 2841                                     (uint8_t *) & addr4_store);
 2842                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
 2843                                     a4p == NULL) {
 2844                                         return;
 2845                                 }
 2846                                 memset(&store, 0, sizeof(union sctp_sockstore));
 2847                                 store.sin.sin_family = AF_INET;
 2848                                 store.sin.sin_len = sizeof(struct sockaddr_in);
 2849                                 store.sin.sin_port = stcb->rport;
 2850                                 store.sin.sin_addr.s_addr = a4p->addr;
 2851                                 break;
 2852                         }
 2853 #endif
 2854                 default:
 2855                         goto next_addr;
 2856                 }
 2857 
 2858                 /* see if this address really (still) exists */
 2859                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
 2860                     SCTP_ADDR_NOT_LOCKED);
 2861                 if (sctp_ifa == NULL) {
 2862                         /* address doesn't exist anymore */
 2863                         int status;
 2864 
 2865                         /* are ASCONFs allowed ? */
 2866                         if ((sctp_is_feature_on(stcb->sctp_ep,
 2867                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
 2868                             stcb->asoc.asconf_supported) {
 2869                                 /* queue an ASCONF DEL_IP_ADDRESS */
 2870                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
 2871                                 /*
 2872                                  * if queued ok, and in correct state, send
 2873                                  * out the ASCONF.
 2874                                  */
 2875                                 if (status == 0 &&
 2876                                     SCTP_GET_STATE(&stcb->asoc) ==
 2877                                     SCTP_STATE_OPEN) {
 2878 #ifdef SCTP_TIMER_BASED_ASCONF
 2879                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2880                                             stcb->sctp_ep, stcb,
 2881                                             stcb->asoc.primary_destination);
 2882 #else
 2883                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
 2884 #endif
 2885                                 }
 2886                         }
 2887                 }
 2888 next_addr:
 2889                 /*
 2890                  * Sanity check:  Make sure the length isn't 0, otherwise
 2891                  * we'll be stuck in this loop for a long time...
 2892                  */
 2893                 if (SCTP_SIZE32(plen) == 0) {
 2894                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
 2895                             plen, ptype);
 2896                         return;
 2897                 }
 2898                 /* get next parameter */
 2899                 offset += SCTP_SIZE32(plen);
 2900                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
 2901                         return;
 2902                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
 2903                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
 2904         }                       /* while */
 2905 }
 2906 
 2907 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
 2908 /*
 2909  * checks to see if a specific address is in the initack address list returns
 2910  * 1 if found, 0 if not
 2911  */
 2912 static uint32_t
 2913 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
 2914 {
 2915         struct sctp_paramhdr tmp_param, *ph;
 2916         uint16_t plen, ptype;
 2917 
 2918 #ifdef INET
 2919         struct sockaddr_in *sin;
 2920         struct sctp_ipv4addr_param *a4p;
 2921         struct sctp_ipv6addr_param addr4_store;
 2922 
 2923 #endif
 2924 #ifdef INET6
 2925         struct sockaddr_in6 *sin6;
 2926         struct sctp_ipv6addr_param *a6p;
 2927         struct sctp_ipv6addr_param addr6_store;
 2928         struct sockaddr_in6 sin6_tmp;
 2929 
 2930 #endif
 2931 
 2932         switch (sa->sa_family) {
 2933 #ifdef INET
 2934         case AF_INET:
 2935                 break;
 2936 #endif
 2937 #ifdef INET6
 2938         case AF_INET6:
 2939                 break;
 2940 #endif
 2941         default:
 2942                 return (0);
 2943         }
 2944 
 2945         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
 2946         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
 2947         /* convert to upper bound */
 2948         length += offset;
 2949 
 2950         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
 2951                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 2952                     "find_initack_addr: invalid offset?\n");
 2953                 return (0);
 2954         }
 2955         /* go through the addresses in the init-ack */
 2956         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
 2957             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
 2958         while (ph != NULL) {
 2959                 ptype = ntohs(ph->param_type);
 2960                 plen = ntohs(ph->param_length);
 2961                 switch (ptype) {
 2962 #ifdef INET6
 2963                 case SCTP_IPV6_ADDRESS:
 2964                         if (sa->sa_family == AF_INET6) {
 2965                                 /* get the entire IPv6 address param */
 2966                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
 2967                                         break;
 2968                                 }
 2969                                 /* get the entire IPv6 address param */
 2970                                 a6p = (struct sctp_ipv6addr_param *)
 2971                                     sctp_m_getptr(m, offset,
 2972                                     sizeof(struct sctp_ipv6addr_param),
 2973                                     (uint8_t *) & addr6_store);
 2974                                 if (a6p == NULL) {
 2975                                         return (0);
 2976                                 }
 2977                                 sin6 = (struct sockaddr_in6 *)sa;
 2978                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
 2979                                         /* create a copy and clear scope */
 2980                                         memcpy(&sin6_tmp, sin6,
 2981                                             sizeof(struct sockaddr_in6));
 2982                                         sin6 = &sin6_tmp;
 2983                                         in6_clearscope(&sin6->sin6_addr);
 2984                                 }
 2985                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
 2986                                     sizeof(struct in6_addr)) == 0) {
 2987                                         /* found it */
 2988                                         return (1);
 2989                                 }
 2990                         }
 2991                         break;
 2992 #endif                          /* INET6 */
 2993 #ifdef INET
 2994                 case SCTP_IPV4_ADDRESS:
 2995                         if (sa->sa_family == AF_INET) {
 2996                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
 2997                                         break;
 2998                                 }
 2999                                 /* get the entire IPv4 address param */
 3000                                 a4p = (struct sctp_ipv4addr_param *)
 3001                                     sctp_m_getptr(m, offset,
 3002                                     sizeof(struct sctp_ipv4addr_param),
 3003                                     (uint8_t *) & addr4_store);
 3004                                 if (a4p == NULL) {
 3005                                         return (0);
 3006                                 }
 3007                                 sin = (struct sockaddr_in *)sa;
 3008                                 if (sin->sin_addr.s_addr == a4p->addr) {
 3009                                         /* found it */
 3010                                         return (1);
 3011                                 }
 3012                         }
 3013                         break;
 3014 #endif
 3015                 default:
 3016                         break;
 3017                 }
 3018                 /* get next parameter */
 3019                 offset += SCTP_SIZE32(plen);
 3020                 if (offset + sizeof(struct sctp_paramhdr) > length) {
 3021                         return (0);
 3022                 }
 3023                 ph = (struct sctp_paramhdr *)
 3024                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
 3025                     (uint8_t *) & tmp_param);
 3026         }                       /* while */
 3027         /* not found! */
 3028         return (0);
 3029 }
 3030 
 3031 /*
 3032  * makes sure that the current endpoint local addr list is consistent with
 3033  * the new association (eg. subset bound, asconf allowed) adds addresses as
 3034  * necessary
 3035  */
 3036 static void
 3037 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3038     int length, struct sockaddr *init_addr)
 3039 {
 3040         struct sctp_laddr *laddr;
 3041 
 3042         /* go through the endpoint list */
 3043         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 3044                 /* be paranoid and validate the laddr */
 3045                 if (laddr->ifa == NULL) {
 3046                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 3047                             "check_addr_list_ep: laddr->ifa is NULL");
 3048                         continue;
 3049                 }
 3050                 if (laddr->ifa == NULL) {
 3051                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
 3052                         continue;
 3053                 }
 3054                 /* do i have it implicitly? */
 3055                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
 3056                         continue;
 3057                 }
 3058                 /* check to see if in the init-ack */
 3059                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
 3060                         /* try to add it */
 3061                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
 3062                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
 3063                 }
 3064         }
 3065 }
 3066 
 3067 /*
 3068  * makes sure that the current kernel address list is consistent with the new
 3069  * association (with all addrs bound) adds addresses as necessary
 3070  */
 3071 static void
 3072 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3073     int length, struct sockaddr *init_addr,
 3074     uint16_t local_scope, uint16_t site_scope,
 3075     uint16_t ipv4_scope, uint16_t loopback_scope)
 3076 {
 3077         struct sctp_vrf *vrf = NULL;
 3078         struct sctp_ifn *sctp_ifn;
 3079         struct sctp_ifa *sctp_ifa;
 3080         uint32_t vrf_id;
 3081 
 3082 #ifdef INET
 3083         struct sockaddr_in *sin;
 3084 
 3085 #endif
 3086 #ifdef INET6
 3087         struct sockaddr_in6 *sin6;
 3088 
 3089 #endif
 3090 
 3091         if (stcb) {
 3092                 vrf_id = stcb->asoc.vrf_id;
 3093         } else {
 3094                 return;
 3095         }
 3096         SCTP_IPI_ADDR_RLOCK();
 3097         vrf = sctp_find_vrf(vrf_id);
 3098         if (vrf == NULL) {
 3099                 SCTP_IPI_ADDR_RUNLOCK();
 3100                 return;
 3101         }
 3102         /* go through all our known interfaces */
 3103         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
 3104                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
 3105                         /* skip loopback interface */
 3106                         continue;
 3107                 }
 3108                 /* go through each interface address */
 3109                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
 3110                         /* do i have it implicitly? */
 3111                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
 3112                                 continue;
 3113                         }
 3114                         switch (sctp_ifa->address.sa.sa_family) {
 3115 #ifdef INET
 3116                         case AF_INET:
 3117                                 sin = &sctp_ifa->address.sin;
 3118                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3119                                     &sin->sin_addr) != 0) {
 3120                                         continue;
 3121                                 }
 3122                                 if ((ipv4_scope == 0) &&
 3123                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 3124                                         /* private address not in scope */
 3125                                         continue;
 3126                                 }
 3127                                 break;
 3128 #endif
 3129 #ifdef INET6
 3130                         case AF_INET6:
 3131                                 sin6 = &sctp_ifa->address.sin6;
 3132                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3133                                     &sin6->sin6_addr) != 0) {
 3134                                         continue;
 3135                                 }
 3136                                 if ((local_scope == 0) &&
 3137                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
 3138                                         continue;
 3139                                 }
 3140                                 if ((site_scope == 0) &&
 3141                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
 3142                                         continue;
 3143                                 }
 3144                                 break;
 3145 #endif
 3146                         default:
 3147                                 break;
 3148                         }
 3149                         /* check to see if in the init-ack */
 3150                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
 3151                                 /* try to add it */
 3152                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
 3153                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
 3154                                     SCTP_ADDR_LOCKED);
 3155                         }
 3156                 }               /* end foreach ifa */
 3157         }                       /* end foreach ifn */
 3158         SCTP_IPI_ADDR_RUNLOCK();
 3159 }
 3160 
 3161 /*
 3162  * validates an init-ack chunk (from a cookie-echo) with current addresses
 3163  * adds addresses from the init-ack into our local address list, if needed
 3164  * queues asconf adds/deletes addresses as needed and makes appropriate list
 3165  * changes for source address selection m, offset: points to the start of the
 3166  * address list in an init-ack chunk length: total length of the address
 3167  * params only init_addr: address where my INIT-ACK was sent from
 3168  */
 3169 void
 3170 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3171     int length, struct sockaddr *init_addr,
 3172     uint16_t local_scope, uint16_t site_scope,
 3173     uint16_t ipv4_scope, uint16_t loopback_scope)
 3174 {
 3175         /* process the local addresses in the initack */
 3176         sctp_process_initack_addresses(stcb, m, offset, length);
 3177 
 3178         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3179                 /* bound all case */
 3180                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
 3181                     local_scope, site_scope, ipv4_scope, loopback_scope);
 3182         } else {
 3183                 /* subset bound case */
 3184                 if (sctp_is_feature_on(stcb->sctp_ep,
 3185                     SCTP_PCB_FLAGS_DO_ASCONF)) {
 3186                         /* asconf's allowed */
 3187                         sctp_check_address_list_ep(stcb, m, offset, length,
 3188                             init_addr);
 3189                 }
 3190                 /* else, no asconfs allowed, so what we sent is what we get */
 3191         }
 3192 }
 3193 
 3194 /*
 3195  * sctp_bindx() support
 3196  */
 3197 uint32_t
 3198 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
 3199     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
 3200 {
 3201         struct sctp_ifa *ifa;
 3202         struct sctp_laddr *laddr, *nladdr;
 3203 
 3204         if (sa->sa_len == 0) {
 3205                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
 3206                 return (EINVAL);
 3207         }
 3208         if (sctp_ifap) {
 3209                 ifa = sctp_ifap;
 3210         } else if (type == SCTP_ADD_IP_ADDRESS) {
 3211                 /* For an add the address MUST be on the system */
 3212                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
 3213         } else if (type == SCTP_DEL_IP_ADDRESS) {
 3214                 /* For a delete we need to find it in the inp */
 3215                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
 3216         } else {
 3217                 ifa = NULL;
 3218         }
 3219         if (ifa != NULL) {
 3220                 if (type == SCTP_ADD_IP_ADDRESS) {
 3221                         sctp_add_local_addr_ep(inp, ifa, type);
 3222                 } else if (type == SCTP_DEL_IP_ADDRESS) {
 3223                         if (inp->laddr_count < 2) {
 3224                                 /* can't delete the last local address */
 3225                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
 3226                                 return (EINVAL);
 3227                         }
 3228                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
 3229                             sctp_nxt_addr) {
 3230                                 if (ifa == laddr->ifa) {
 3231                                         /* Mark in the delete */
 3232                                         laddr->action = type;
 3233                                 }
 3234                         }
 3235                 }
 3236                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
 3237                         /*
 3238                          * There is no need to start the iterator if the inp
 3239                          * has no associations.
 3240                          */
 3241                         if (type == SCTP_DEL_IP_ADDRESS) {
 3242                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
 3243                                         if (laddr->ifa == ifa) {
 3244                                                 sctp_del_local_addr_ep(inp, ifa);
 3245                                         }
 3246                                 }
 3247                         }
 3248                 } else {
 3249                         struct sctp_asconf_iterator *asc;
 3250                         struct sctp_laddr *wi;
 3251                         int ret;
 3252 
 3253                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
 3254                             sizeof(struct sctp_asconf_iterator),
 3255                             SCTP_M_ASC_IT);
 3256                         if (asc == NULL) {
 3257                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
 3258                                 return (ENOMEM);
 3259                         }
 3260                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
 3261                         if (wi == NULL) {
 3262                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
 3263                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
 3264                                 return (ENOMEM);
 3265                         }
 3266                         LIST_INIT(&asc->list_of_work);
 3267                         asc->cnt = 1;
 3268                         SCTP_INCR_LADDR_COUNT();
 3269                         wi->ifa = ifa;
 3270                         wi->action = type;
 3271                         atomic_add_int(&ifa->refcount, 1);
 3272                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
 3273                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
 3274                             sctp_asconf_iterator_stcb,
 3275                             sctp_asconf_iterator_ep_end,
 3276                             SCTP_PCB_ANY_FLAGS,
 3277                             SCTP_PCB_ANY_FEATURES,
 3278                             SCTP_ASOC_ANY_STATE,
 3279                             (void *)asc, 0,
 3280                             sctp_asconf_iterator_end, inp, 0);
 3281                         if (ret) {
 3282                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
 3283                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
 3284                                 sctp_asconf_iterator_end(asc, 0);
 3285                                 return (EFAULT);
 3286                         }
 3287                 }
 3288                 return (0);
 3289         } else {
 3290                 /* invalid address! */
 3291                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
 3292                 return (EADDRNOTAVAIL);
 3293         }
 3294 }
 3295 
 3296 void
 3297 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
 3298     struct sctp_nets *net)
 3299 {
 3300         struct sctp_asconf_addr *aa;
 3301         struct sctp_ifa *sctp_ifap;
 3302         struct sctp_asconf_tag_param *vtag;
 3303 
 3304 #ifdef INET
 3305         struct sockaddr_in *to;
 3306 
 3307 #endif
 3308 #ifdef INET6
 3309         struct sockaddr_in6 *to6;
 3310 
 3311 #endif
 3312         if (net == NULL) {
 3313                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
 3314                 return;
 3315         }
 3316         if (stcb == NULL) {
 3317                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
 3318                 return;
 3319         }
 3320         /*
 3321          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
 3322          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
 3323          */
 3324         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3325             SCTP_M_ASC_ADDR);
 3326         if (aa == NULL) {
 3327                 /* didn't get memory */
 3328                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3329                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3330                 return;
 3331         }
 3332         aa->special_del = 0;
 3333         /* fill in asconf address parameter fields */
 3334         /* top level elements are "networked" during send */
 3335         aa->ifa = NULL;
 3336         aa->sent = 0;           /* clear sent flag */
 3337         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
 3338         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
 3339         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
 3340         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
 3341         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
 3342         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3343 
 3344         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3345             SCTP_M_ASC_ADDR);
 3346         if (aa == NULL) {
 3347                 /* didn't get memory */
 3348                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3349                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3350                 return;
 3351         }
 3352         memset(aa, 0, sizeof(struct sctp_asconf_addr));
 3353         /* fill in asconf address parameter fields */
 3354         /* ADD(0.0.0.0) */
 3355         switch (net->ro._l_addr.sa.sa_family) {
 3356 #ifdef INET
 3357         case AF_INET:
 3358                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3359                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
 3360                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 3361                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
 3362                 /* No need to add an address, we are using 0.0.0.0 */
 3363                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3364                 break;
 3365 #endif
 3366 #ifdef INET6
 3367         case AF_INET6:
 3368                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3369                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
 3370                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 3371                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
 3372                 /* No need to add an address, we are using 0.0.0.0 */
 3373                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3374                 break;
 3375 #endif
 3376         default:
 3377                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3378                     "sctp_asconf_send_nat_state_update: unknown address family\n");
 3379                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 3380                 return;
 3381         }
 3382         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
 3383             SCTP_M_ASC_ADDR);
 3384         if (aa == NULL) {
 3385                 /* didn't get memory */
 3386                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3387                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
 3388                 return;
 3389         }
 3390         memset(aa, 0, sizeof(struct sctp_asconf_addr));
 3391         /* fill in asconf address parameter fields */
 3392         /* ADD(0.0.0.0) */
 3393         switch (net->ro._l_addr.sa.sa_family) {
 3394 #ifdef INET
 3395         case AF_INET:
 3396                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
 3397                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
 3398                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
 3399                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
 3400                 /* No need to add an address, we are using 0.0.0.0 */
 3401                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3402                 break;
 3403 #endif
 3404 #ifdef INET6
 3405         case AF_INET6:
 3406                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
 3407                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
 3408                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
 3409                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
 3410                 /* No need to add an address, we are using 0.0.0.0 */
 3411                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
 3412                 break;
 3413 #endif
 3414         default:
 3415                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 3416                     "sctp_asconf_send_nat_state_update: unknown address family\n");
 3417                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
 3418                 return;
 3419         }
 3420         /* Now we must hunt the addresses and add all global addresses */
 3421         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3422                 struct sctp_vrf *vrf = NULL;
 3423                 struct sctp_ifn *sctp_ifnp;
 3424                 uint32_t vrf_id;
 3425 
 3426                 vrf_id = stcb->sctp_ep->def_vrf_id;
 3427                 vrf = sctp_find_vrf(vrf_id);
 3428                 if (vrf == NULL) {
 3429                         goto skip_rest;
 3430                 }
 3431                 SCTP_IPI_ADDR_RLOCK();
 3432                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
 3433                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
 3434                                 switch (sctp_ifap->address.sa.sa_family) {
 3435 #ifdef INET
 3436                                 case AF_INET:
 3437                                         to = &sctp_ifap->address.sin;
 3438                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3439                                             &to->sin_addr) != 0) {
 3440                                                 continue;
 3441                                         }
 3442                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
 3443                                                 continue;
 3444                                         }
 3445                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
 3446                                                 continue;
 3447                                         }
 3448                                         break;
 3449 #endif
 3450 #ifdef INET6
 3451                                 case AF_INET6:
 3452                                         to6 = &sctp_ifap->address.sin6;
 3453                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
 3454                                             &to6->sin6_addr) != 0) {
 3455                                                 continue;
 3456                                         }
 3457                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
 3458                                                 continue;
 3459                                         }
 3460                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
 3461                                                 continue;
 3462                                         }
 3463                                         break;
 3464 #endif
 3465                                 default:
 3466                                         continue;
 3467                                 }
 3468                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
 3469                         }
 3470                 }
 3471                 SCTP_IPI_ADDR_RUNLOCK();
 3472         } else {
 3473                 struct sctp_laddr *laddr;
 3474 
 3475                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
 3476                         if (laddr->ifa == NULL) {
 3477                                 continue;
 3478                         }
 3479                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
 3480                                 /*
 3481                                  * Address being deleted by the system, dont
 3482                                  * list.
 3483                                  */
 3484                                 continue;
 3485                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
 3486                                 /*
 3487                                  * Address being deleted on this ep don't
 3488                                  * list.
 3489                                  */
 3490                                 continue;
 3491                         }
 3492                         sctp_ifap = laddr->ifa;
 3493                         switch (sctp_ifap->address.sa.sa_family) {
 3494 #ifdef INET
 3495                         case AF_INET:
 3496                                 to = &sctp_ifap->address.sin;
 3497                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
 3498                                         continue;
 3499                                 }
 3500                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
 3501                                         continue;
 3502                                 }
 3503                                 break;
 3504 #endif
 3505 #ifdef INET6
 3506                         case AF_INET6:
 3507                                 to6 = &sctp_ifap->address.sin6;
 3508                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
 3509                                         continue;
 3510                                 }
 3511                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
 3512                                         continue;
 3513                                 }
 3514                                 break;
 3515 #endif
 3516                         default:
 3517                                 continue;
 3518                         }
 3519                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
 3520                 }
 3521         }
 3522 skip_rest:
 3523         /* Now we must send the asconf into the queue */
 3524         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
 3525 }

Cache object: c2c43d97dabe1fcc7c9af9c33d07322a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.