xref: /freebsd/sys/netinet/sctp_asconf.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * a) Redistributions of source code must retain the above copyright notice,
8  *   this list of conditions and the following disclaimer.
9  *
10  * b) Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *   the documentation and/or other materials provided with the distribution.
13  *
14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15  *    contributors may be used to endorse or promote products derived
16  *    from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 /* $KAME: sctp_asconf.c,v 1.24 2005/03/06 16:04:16 itojun Exp $	 */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 #include <netinet/sctp_os.h>
36 #include <netinet/sctp_var.h>
37 #include <netinet/sctp_sysctl.h>
38 #include <netinet/sctp_pcb.h>
39 #include <netinet/sctp_header.h>
40 #include <netinet/sctputil.h>
41 #include <netinet/sctp_output.h>
42 #include <netinet/sctp_asconf.h>
43 #include <netinet/sctp_timer.h>
44 
45 /*
46  * debug flags:
47  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
48  * SCTP_DEBUG_ASCONF2: detailed info
49  */
50 #ifdef SCTP_DEBUG
51 #endif				/* SCTP_DEBUG */
52 
53 
54 static void
55 sctp_asconf_get_source_ip(struct mbuf *m, struct sockaddr *sa)
56 {
57 	struct ip *iph;
58 	struct sockaddr_in *sin;
59 
60 #ifdef INET6
61 	struct sockaddr_in6 *sin6;
62 
63 #endif
64 
65 	iph = mtod(m, struct ip *);
66 	if (iph->ip_v == IPVERSION) {
67 		/* IPv4 source */
68 		sin = (struct sockaddr_in *)sa;
69 		bzero(sin, sizeof(*sin));
70 		sin->sin_family = AF_INET;
71 		sin->sin_len = sizeof(struct sockaddr_in);
72 		sin->sin_port = 0;
73 		sin->sin_addr.s_addr = iph->ip_src.s_addr;
74 		return;
75 	}
76 #ifdef INET6
77 	else if (iph->ip_v == (IPV6_VERSION >> 4)) {
78 		/* IPv6 source */
79 		struct ip6_hdr *ip6;
80 
81 		sin6 = (struct sockaddr_in6 *)sa;
82 		bzero(sin6, sizeof(*sin6));
83 		sin6->sin6_family = AF_INET6;
84 		sin6->sin6_len = sizeof(struct sockaddr_in6);
85 		sin6->sin6_port = 0;
86 		ip6 = mtod(m, struct ip6_hdr *);
87 		sin6->sin6_addr = ip6->ip6_src;
88 		return;
89 	}
90 #endif				/* INET6 */
91 	else
92 		return;
93 }
94 
95 /*
96  * draft-ietf-tsvwg-addip-sctp
97  *
98  * An ASCONF parameter queue exists per asoc which holds the pending address
99  * operations.  Lists are updated upon receipt of ASCONF-ACK.
100  *
101  * A restricted_addrs list exists per assoc to hold local addresses that are
102  * not (yet) usable by the assoc as a source address.  These addresses are
103  * either pending an ASCONF operation (and exist on the ASCONF parameter
104  * queue), or they are permanently restricted (the peer has returned an
105  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
106  *
107  * Deleted addresses are always immediately removed from the lists as they will
108  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
109  * only if allowed.
110  */
111 
112 /*
113  * ASCONF parameter processing.
114  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
115  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
116  * FIX: allocating this many mbufs on the fly is pretty inefficient...
117  */
118 static struct mbuf *
119 sctp_asconf_success_response(uint32_t id)
120 {
121 	struct mbuf *m_reply = NULL;
122 	struct sctp_asconf_paramhdr *aph;
123 
124 	m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
125 	    0, M_DONTWAIT, 1, MT_DATA);
126 	if (m_reply == NULL) {
127 		SCTPDBG(SCTP_DEBUG_ASCONF1,
128 		    "asconf_success_response: couldn't get mbuf!\n");
129 		return NULL;
130 	}
131 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
132 	aph->correlation_id = id;
133 	aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
134 	aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
135 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
136 	aph->ph.param_length = htons(aph->ph.param_length);
137 
138 	return m_reply;
139 }
140 
141 static struct mbuf *
142 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
143     uint16_t tlv_length)
144 {
145 	struct mbuf *m_reply = NULL;
146 	struct sctp_asconf_paramhdr *aph;
147 	struct sctp_error_cause *error;
148 	uint8_t *tlv;
149 
150 	m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
151 	    tlv_length +
152 	    sizeof(struct sctp_error_cause)),
153 	    0, M_DONTWAIT, 1, MT_DATA);
154 	if (m_reply == NULL) {
155 		SCTPDBG(SCTP_DEBUG_ASCONF1,
156 		    "asconf_error_response: couldn't get mbuf!\n");
157 		return NULL;
158 	}
159 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
160 	error = (struct sctp_error_cause *)(aph + 1);
161 
162 	aph->correlation_id = id;
163 	aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
164 	error->code = htons(cause);
165 	error->length = tlv_length + sizeof(struct sctp_error_cause);
166 	aph->ph.param_length = error->length +
167 	    sizeof(struct sctp_asconf_paramhdr);
168 
169 	if (aph->ph.param_length > MLEN) {
170 		SCTPDBG(SCTP_DEBUG_ASCONF1,
171 		    "asconf_error_response: tlv_length (%xh) too big\n",
172 		    tlv_length);
173 		sctp_m_freem(m_reply);	/* discard */
174 		return NULL;
175 	}
176 	if (error_tlv != NULL) {
177 		tlv = (uint8_t *) (error + 1);
178 		memcpy(tlv, error_tlv, tlv_length);
179 	}
180 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
181 	error->length = htons(error->length);
182 	aph->ph.param_length = htons(aph->ph.param_length);
183 
184 	return m_reply;
185 }
186 
187 static struct mbuf *
188 sctp_process_asconf_add_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
189     struct sctp_tcb *stcb, int response_required)
190 {
191 	struct mbuf *m_reply = NULL;
192 	struct sockaddr_storage sa_source, sa_store;
193 	struct sctp_ipv4addr_param *v4addr;
194 	uint16_t param_type, param_length, aparam_length;
195 	struct sockaddr *sa;
196 	struct sockaddr_in *sin;
197 	int zero_address = 0;
198 
199 #ifdef INET6
200 	struct sockaddr_in6 *sin6;
201 	struct sctp_ipv6addr_param *v6addr;
202 
203 #endif				/* INET6 */
204 
205 	aparam_length = ntohs(aph->ph.param_length);
206 	v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
207 #ifdef INET6
208 	v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
209 #endif				/* INET6 */
210 	param_type = ntohs(v4addr->ph.param_type);
211 	param_length = ntohs(v4addr->ph.param_length);
212 
213 	sa = (struct sockaddr *)&sa_store;
214 	switch (param_type) {
215 	case SCTP_IPV4_ADDRESS:
216 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
217 			/* invalid param size */
218 			return NULL;
219 		}
220 		sin = (struct sockaddr_in *)&sa_store;
221 		bzero(sin, sizeof(*sin));
222 		sin->sin_family = AF_INET;
223 		sin->sin_len = sizeof(struct sockaddr_in);
224 		sin->sin_port = stcb->rport;
225 		sin->sin_addr.s_addr = v4addr->addr;
226 		if (sin->sin_addr.s_addr == INADDR_ANY)
227 			zero_address = 1;
228 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
229 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
230 		break;
231 	case SCTP_IPV6_ADDRESS:
232 #ifdef INET6
233 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
234 			/* invalid param size */
235 			return NULL;
236 		}
237 		sin6 = (struct sockaddr_in6 *)&sa_store;
238 		bzero(sin6, sizeof(*sin6));
239 		sin6->sin6_family = AF_INET6;
240 		sin6->sin6_len = sizeof(struct sockaddr_in6);
241 		sin6->sin6_port = stcb->rport;
242 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
243 		    sizeof(struct in6_addr));
244 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
245 			zero_address = 1;
246 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
247 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
248 #else
249 		/* IPv6 not enabled! */
250 		/* FIX ME: currently sends back an invalid param error */
251 		m_reply = sctp_asconf_error_response(aph->correlation_id,
252 		    SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph, aparam_length);
253 		SCTPDBG(SCTP_DEBUG_ASCONF1,
254 		    "process_asconf_add_ip: v6 disabled- skipping ");
255 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
256 		return m_reply;
257 #endif
258 		break;
259 	default:
260 		m_reply = sctp_asconf_error_response(aph->correlation_id,
261 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
262 		    aparam_length);
263 		return m_reply;
264 	}			/* end switch */
265 
266 	/* if 0.0.0.0/::0, add the source address instead */
267 	if (zero_address && sctp_nat_friendly) {
268 		sa = (struct sockaddr *)&sa_source;
269 		sctp_asconf_get_source_ip(m, sa);
270 		SCTPDBG(SCTP_DEBUG_ASCONF1,
271 		    "process_asconf_add_ip: using source addr ");
272 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
273 	}
274 	/* add the address */
275 	if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE,
276 	    SCTP_ADDR_DYNAMIC_ADDED) != 0) {
277 		SCTPDBG(SCTP_DEBUG_ASCONF1,
278 		    "process_asconf_add_ip: error adding address\n");
279 		m_reply = sctp_asconf_error_response(aph->correlation_id,
280 		    SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
281 		    aparam_length);
282 	} else {
283 		/* notify upper layer */
284 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
285 		if (response_required) {
286 			m_reply =
287 			    sctp_asconf_success_response(aph->correlation_id);
288 		}
289 		sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
290 		    NULL, SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
291 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
292 		    stcb, NULL);
293 	}
294 
295 	return m_reply;
296 }
297 
298 static int
299 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
300 {
301 	struct sctp_nets *src_net, *net;
302 
303 	/* make sure the source address exists as a destination net */
304 	src_net = sctp_findnet(stcb, src);
305 	if (src_net == NULL) {
306 		/* not found */
307 		return -1;
308 	}
309 	/* delete all destination addresses except the source */
310 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
311 		if (net != src_net) {
312 			/* delete this address */
313 			sctp_remove_net(stcb, net);
314 			SCTPDBG(SCTP_DEBUG_ASCONF1,
315 			    "asconf_del_remote_addrs_except: deleting ");
316 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
317 			    (struct sockaddr *)&net->ro._l_addr);
318 			/* notify upper layer */
319 			sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
320 			    (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
321 		}
322 	}
323 	return 0;
324 }
325 
326 static struct mbuf *
327 sctp_process_asconf_delete_ip(struct mbuf *m, struct sctp_asconf_paramhdr *aph,
328     struct sctp_tcb *stcb, int response_required)
329 {
330 	struct mbuf *m_reply = NULL;
331 	struct sockaddr_storage sa_source, sa_store;
332 	struct sctp_ipv4addr_param *v4addr;
333 	uint16_t param_type, param_length, aparam_length;
334 	struct sockaddr *sa;
335 	struct sockaddr_in *sin;
336 	int zero_address = 0;
337 	int result;
338 
339 #ifdef INET6
340 	struct sockaddr_in6 *sin6;
341 	struct sctp_ipv6addr_param *v6addr;
342 
343 #endif				/* INET6 */
344 
345 	/* get the source IP address for src and 0.0.0.0/::0 delete checks */
346 	sctp_asconf_get_source_ip(m, (struct sockaddr *)&sa_source);
347 
348 	aparam_length = ntohs(aph->ph.param_length);
349 	v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
350 #ifdef INET6
351 	v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
352 #endif				/* INET6 */
353 	param_type = ntohs(v4addr->ph.param_type);
354 	param_length = ntohs(v4addr->ph.param_length);
355 
356 	sa = (struct sockaddr *)&sa_store;
357 	switch (param_type) {
358 	case SCTP_IPV4_ADDRESS:
359 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
360 			/* invalid param size */
361 			return NULL;
362 		}
363 		sin = (struct sockaddr_in *)&sa_store;
364 		bzero(sin, sizeof(*sin));
365 		sin->sin_family = AF_INET;
366 		sin->sin_len = sizeof(struct sockaddr_in);
367 		sin->sin_port = stcb->rport;
368 		sin->sin_addr.s_addr = v4addr->addr;
369 		if (sin->sin_addr.s_addr == INADDR_ANY)
370 			zero_address = 1;
371 		SCTPDBG(SCTP_DEBUG_ASCONF1,
372 		    "process_asconf_delete_ip: deleting ");
373 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
374 		break;
375 	case SCTP_IPV6_ADDRESS:
376 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
377 			/* invalid param size */
378 			return NULL;
379 		}
380 #ifdef INET6
381 		sin6 = (struct sockaddr_in6 *)&sa_store;
382 		bzero(sin6, sizeof(*sin6));
383 		sin6->sin6_family = AF_INET6;
384 		sin6->sin6_len = sizeof(struct sockaddr_in6);
385 		sin6->sin6_port = stcb->rport;
386 		memcpy(&sin6->sin6_addr, v6addr->addr,
387 		    sizeof(struct in6_addr));
388 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
389 			zero_address = 1;
390 		SCTPDBG(SCTP_DEBUG_ASCONF1,
391 		    "process_asconf_delete_ip: deleting ");
392 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
393 #else
394 		/* IPv6 not enabled!  No "action" needed; just ack it */
395 		SCTPDBG(SCTP_DEBUG_ASCONF1,
396 		    "process_asconf_delete_ip: v6 disabled- ignoring: ");
397 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
398 		/* just respond with a "success" ASCONF-ACK */
399 		return NULL;
400 #endif
401 		break;
402 	default:
403 		m_reply = sctp_asconf_error_response(aph->correlation_id,
404 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
405 		    aparam_length);
406 		return m_reply;
407 	}
408 
409 	/* make sure the source address is not being deleted */
410 	if (sctp_cmpaddr(sa, (struct sockaddr *)&sa_source)) {
411 		/* trying to delete the source address! */
412 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
413 		m_reply = sctp_asconf_error_response(aph->correlation_id,
414 		    SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
415 		    aparam_length);
416 		return m_reply;
417 	}
418 	/* if deleting 0.0.0.0/::0, delete all addresses except src addr */
419 	if (zero_address && sctp_nat_friendly) {
420 		result = sctp_asconf_del_remote_addrs_except(stcb,
421 		    (struct sockaddr *)&sa_source);
422 
423 		if (result) {
424 			/* src address did not exist? */
425 			SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
426 			/* what error to reply with?? */
427 			m_reply =
428 			    sctp_asconf_error_response(aph->correlation_id,
429 			    SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
430 			    aparam_length);
431 		} else if (response_required) {
432 			m_reply =
433 			    sctp_asconf_success_response(aph->correlation_id);
434 		}
435 		return m_reply;
436 	}
437 	/* delete the address */
438 	result = sctp_del_remote_addr(stcb, sa);
439 	/*
440 	 * note if result == -2, the address doesn't exist in the asoc but
441 	 * since it's being deleted anyways, we just ack the delete -- but
442 	 * this probably means something has already gone awry
443 	 */
444 	if (result == -1) {
445 		/* only one address in the asoc */
446 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
447 		m_reply = sctp_asconf_error_response(aph->correlation_id,
448 		    SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
449 		    aparam_length);
450 	} else {
451 		if (response_required) {
452 			m_reply = sctp_asconf_success_response(aph->correlation_id);
453 		}
454 		/* notify upper layer */
455 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
456 	}
457 	return m_reply;
458 }
459 
460 static struct mbuf *
461 sctp_process_asconf_set_primary(struct mbuf *m,
462     struct sctp_asconf_paramhdr *aph,
463     struct sctp_tcb *stcb, int response_required)
464 {
465 	struct mbuf *m_reply = NULL;
466 	struct sockaddr_storage sa_source, sa_store;
467 	struct sctp_ipv4addr_param *v4addr;
468 	uint16_t param_type, param_length, aparam_length;
469 	struct sockaddr *sa;
470 	struct sockaddr_in *sin;
471 	int zero_address = 0;
472 
473 #ifdef INET6
474 	struct sockaddr_in6 *sin6;
475 	struct sctp_ipv6addr_param *v6addr;
476 
477 #endif				/* INET6 */
478 
479 	aparam_length = ntohs(aph->ph.param_length);
480 	v4addr = (struct sctp_ipv4addr_param *)(aph + 1);
481 #ifdef INET6
482 	v6addr = (struct sctp_ipv6addr_param *)(aph + 1);
483 #endif				/* INET6 */
484 	param_type = ntohs(v4addr->ph.param_type);
485 	param_length = ntohs(v4addr->ph.param_length);
486 
487 	sa = (struct sockaddr *)&sa_store;
488 	switch (param_type) {
489 	case SCTP_IPV4_ADDRESS:
490 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
491 			/* invalid param size */
492 			return NULL;
493 		}
494 		sin = (struct sockaddr_in *)&sa_store;
495 		bzero(sin, sizeof(*sin));
496 		sin->sin_family = AF_INET;
497 		sin->sin_len = sizeof(struct sockaddr_in);
498 		sin->sin_addr.s_addr = v4addr->addr;
499 		if (sin->sin_addr.s_addr == INADDR_ANY)
500 			zero_address = 1;
501 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
502 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
503 		break;
504 	case SCTP_IPV6_ADDRESS:
505 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
506 			/* invalid param size */
507 			return NULL;
508 		}
509 #ifdef INET6
510 		sin6 = (struct sockaddr_in6 *)&sa_store;
511 		bzero(sin6, sizeof(*sin6));
512 		sin6->sin6_family = AF_INET6;
513 		sin6->sin6_len = sizeof(struct sockaddr_in6);
514 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
515 		    sizeof(struct in6_addr));
516 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
517 			zero_address = 1;
518 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
519 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
520 #else
521 		/* IPv6 not enabled!  No "action" needed; just ack it */
522 		SCTPDBG(SCTP_DEBUG_ASCONF1,
523 		    "process_asconf_set_primary: v6 disabled- ignoring: ");
524 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
525 		/* just respond with a "success" ASCONF-ACK */
526 		return NULL;
527 #endif
528 		break;
529 	default:
530 		m_reply = sctp_asconf_error_response(aph->correlation_id,
531 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
532 		    aparam_length);
533 		return m_reply;
534 	}
535 
536 	/* if 0.0.0.0/::0, use the source address instead */
537 	if (zero_address && sctp_nat_friendly) {
538 		sa = (struct sockaddr *)&sa_source;
539 		sctp_asconf_get_source_ip(m, sa);
540 		SCTPDBG(SCTP_DEBUG_ASCONF1,
541 		    "process_asconf_set_primary: using source addr ");
542 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
543 	}
544 	/* set the primary address */
545 	if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
546 		SCTPDBG(SCTP_DEBUG_ASCONF1,
547 		    "process_asconf_set_primary: primary address set\n");
548 		/* notify upper layer */
549 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
550 
551 		if (response_required) {
552 			m_reply = sctp_asconf_success_response(aph->correlation_id);
553 		}
554 		/*
555 		 * Mobility adaptation. Ideally, when the reception of SET
556 		 * PRIMARY with DELETE IP ADDRESS of the previous primary
557 		 * destination, unacknowledged DATA are retransmitted
558 		 * immediately to the new primary destination for seamless
559 		 * handover.  If the destination is UNCONFIRMED and marked
560 		 * to REQ_PRIM, The retransmission occur when reception of
561 		 * the HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
562 		 * sctp_input.c) Also, when change of the primary
563 		 * destination, it is better that all subsequent new DATA
564 		 * containing already queued DATA are transmitted to the new
565 		 * primary destination. (by micchie)
566 		 */
567 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
568 		    SCTP_MOBILITY_BASE) ||
569 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
570 		    SCTP_MOBILITY_FASTHANDOFF)) &&
571 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
572 		    SCTP_MOBILITY_PRIM_DELETED) &&
573 		    (stcb->asoc.primary_destination->dest_state &
574 		    SCTP_ADDR_UNCONFIRMED) == 0) {
575 
576 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
577 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
578 			    SCTP_MOBILITY_FASTHANDOFF)) {
579 				sctp_assoc_immediate_retrans(stcb,
580 				    stcb->asoc.primary_destination);
581 			}
582 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
583 			    SCTP_MOBILITY_BASE)) {
584 				sctp_move_chunks_from_deleted_prim(stcb,
585 				    stcb->asoc.primary_destination);
586 			}
587 			sctp_delete_prim_timer(stcb->sctp_ep, stcb,
588 			    stcb->asoc.deleted_primary);
589 		}
590 	} else {
591 		/* couldn't set the requested primary address! */
592 		SCTPDBG(SCTP_DEBUG_ASCONF1,
593 		    "process_asconf_set_primary: set primary failed!\n");
594 		/* must have been an invalid address, so report */
595 		m_reply = sctp_asconf_error_response(aph->correlation_id,
596 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
597 		    aparam_length);
598 	}
599 
600 	return m_reply;
601 }
602 
603 /*
604  * handles an ASCONF chunk.
605  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
606  */
607 void
608 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
609     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
610     int first)
611 {
612 	struct sctp_association *asoc;
613 	uint32_t serial_num;
614 	struct mbuf *n, *m_ack, *m_result, *m_tail;
615 	struct sctp_asconf_ack_chunk *ack_cp;
616 	struct sctp_asconf_paramhdr *aph, *ack_aph;
617 	struct sctp_ipv6addr_param *p_addr;
618 	unsigned int asconf_limit;
619 	int error = 0;		/* did an error occur? */
620 
621 	/* asconf param buffer */
622 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
623 	struct sctp_asconf_ack *ack, *ack_next;
624 
625 	/* verify minimum length */
626 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
627 		SCTPDBG(SCTP_DEBUG_ASCONF1,
628 		    "handle_asconf: chunk too small = %xh\n",
629 		    ntohs(cp->ch.chunk_length));
630 		return;
631 	}
632 	asoc = &stcb->asoc;
633 	serial_num = ntohl(cp->serial_number);
634 
635 	if (compare_with_wrap(asoc->asconf_seq_in, serial_num, MAX_SEQ) ||
636 	    serial_num == asoc->asconf_seq_in) {
637 		/* got a duplicate ASCONF */
638 		SCTPDBG(SCTP_DEBUG_ASCONF1,
639 		    "handle_asconf: got duplicate serial number = %xh\n",
640 		    serial_num);
641 		return;
642 	} else if (serial_num != (asoc->asconf_seq_in + 1)) {
643 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
644 		    serial_num, asoc->asconf_seq_in + 1);
645 		return;
646 	}
647 	/* it's the expected "next" sequence number, so process it */
648 	asoc->asconf_seq_in = serial_num;	/* update sequence */
649 	/* get length of all the param's in the ASCONF */
650 	asconf_limit = offset + ntohs(cp->ch.chunk_length);
651 	SCTPDBG(SCTP_DEBUG_ASCONF1,
652 	    "handle_asconf: asconf_limit=%u, sequence=%xh\n",
653 	    asconf_limit, serial_num);
654 
655 	if (first) {
656 		/* delete old cache */
657 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing firstASCONF. Try to delte old cache\n");
658 
659 		ack = TAILQ_FIRST(&stcb->asoc.asconf_ack_sent);
660 		while (ack != NULL) {
661 			ack_next = TAILQ_NEXT(ack, next);
662 			if (ack->serial_number == serial_num)
663 				break;
664 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
665 			    ack->serial_number, serial_num);
666 			TAILQ_REMOVE(&stcb->asoc.asconf_ack_sent, ack, next);
667 			if (ack->data != NULL) {
668 				sctp_m_freem(ack->data);
669 			}
670 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asconf_ack, ack);
671 			ack = ack_next;
672 		}
673 	}
674 	m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
675 	    M_DONTWAIT, 1, MT_DATA);
676 	if (m_ack == NULL) {
677 		SCTPDBG(SCTP_DEBUG_ASCONF1,
678 		    "handle_asconf: couldn't get mbuf!\n");
679 		return;
680 	}
681 	m_tail = m_ack;		/* current reply chain's tail */
682 
683 	/* fill in ASCONF-ACK header */
684 	ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
685 	ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
686 	ack_cp->ch.chunk_flags = 0;
687 	ack_cp->serial_number = htonl(serial_num);
688 	/* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
689 	SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
690 	ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
691 
692 	/* skip the lookup address parameter */
693 	offset += sizeof(struct sctp_asconf_chunk);
694 	p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
695 	if (p_addr == NULL) {
696 		SCTPDBG(SCTP_DEBUG_ASCONF1,
697 		    "handle_asconf: couldn't get lookup addr!\n");
698 		/* respond with a missing/invalid mandatory parameter error */
699 		return;
700 	}
701 	/* param_length is already validated in process_control... */
702 	offset += ntohs(p_addr->ph.param_length);	/* skip lookup addr */
703 
704 	/* get pointer to first asconf param in ASCONF-ACK */
705 	ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
706 	if (ack_aph == NULL) {
707 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
708 		return;
709 	}
710 	/* get pointer to first asconf param in ASCONF */
711 	aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
712 	if (aph == NULL) {
713 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
714 		goto send_reply;
715 	}
716 	/* process through all parameters */
717 	while (aph != NULL) {
718 		unsigned int param_length, param_type;
719 
720 		param_type = ntohs(aph->ph.param_type);
721 		param_length = ntohs(aph->ph.param_length);
722 		if (offset + param_length > asconf_limit) {
723 			/* parameter goes beyond end of chunk! */
724 			sctp_m_freem(m_ack);
725 			return;
726 		}
727 		m_result = NULL;
728 
729 		if (param_length > sizeof(aparam_buf)) {
730 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
731 			sctp_m_freem(m_ack);
732 			return;
733 		}
734 		if (param_length <= sizeof(struct sctp_paramhdr)) {
735 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
736 			sctp_m_freem(m_ack);
737 		}
738 		/* get the entire parameter */
739 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
740 		if (aph == NULL) {
741 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
742 			sctp_m_freem(m_ack);
743 			return;
744 		}
745 		switch (param_type) {
746 		case SCTP_ADD_IP_ADDRESS:
747 			asoc->peer_supports_asconf = 1;
748 			m_result = sctp_process_asconf_add_ip(m, aph, stcb,
749 			    error);
750 			break;
751 		case SCTP_DEL_IP_ADDRESS:
752 			asoc->peer_supports_asconf = 1;
753 			m_result = sctp_process_asconf_delete_ip(m, aph, stcb,
754 			    error);
755 			break;
756 		case SCTP_ERROR_CAUSE_IND:
757 			/* not valid in an ASCONF chunk */
758 			break;
759 		case SCTP_SET_PRIM_ADDR:
760 			asoc->peer_supports_asconf = 1;
761 			m_result = sctp_process_asconf_set_primary(m, aph,
762 			    stcb, error);
763 			break;
764 		case SCTP_SUCCESS_REPORT:
765 			/* not valid in an ASCONF chunk */
766 			break;
767 		case SCTP_ULP_ADAPTATION:
768 			/* FIX */
769 			break;
770 		default:
771 			if ((param_type & 0x8000) == 0) {
772 				/* Been told to STOP at this param */
773 				asconf_limit = offset;
774 				/*
775 				 * FIX FIX - We need to call
776 				 * sctp_arethere_unrecognized_parameters()
777 				 * to get a operr and send it for any
778 				 * param's with the 0x4000 bit set OR do it
779 				 * here ourselves... note we still must STOP
780 				 * if the 0x8000 bit is clear.
781 				 */
782 			}
783 			/* unknown/invalid param type */
784 			break;
785 		}		/* switch */
786 
787 		/* add any (error) result to the reply mbuf chain */
788 		if (m_result != NULL) {
789 			SCTP_BUF_NEXT(m_tail) = m_result;
790 			m_tail = m_result;
791 			/* update lengths, make sure it's aligned too */
792 			SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
793 			ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
794 			/* set flag to force success reports */
795 			error = 1;
796 		}
797 		offset += SCTP_SIZE32(param_length);
798 		/* update remaining ASCONF message length to process */
799 		if (offset >= asconf_limit) {
800 			/* no more data in the mbuf chain */
801 			break;
802 		}
803 		/* get pointer to next asconf param */
804 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
805 		    sizeof(struct sctp_asconf_paramhdr),
806 		    (uint8_t *) & aparam_buf);
807 		if (aph == NULL) {
808 			/* can't get an asconf paramhdr */
809 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
810 			/* FIX ME - add error here... */
811 		}
812 	}
813 
814 send_reply:
815 	ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
816 	/* save the ASCONF-ACK reply */
817 	ack = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asconf_ack,
818 	    struct sctp_asconf_ack);
819 	if (ack == NULL) {
820 		sctp_m_freem(m_ack);
821 		return;
822 	}
823 	ack->serial_number = serial_num;
824 	ack->last_sent_to = NULL;
825 	ack->data = m_ack;
826 	n = m_ack;
827 	while (n) {
828 		ack->len += SCTP_BUF_LEN(n);
829 		n = SCTP_BUF_NEXT(n);
830 	}
831 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
832 
833 	/* see if last_control_chunk_from is set properly (use IP src addr) */
834 	if (stcb->asoc.last_control_chunk_from == NULL) {
835 		/*
836 		 * this could happen if the source address was just newly
837 		 * added
838 		 */
839 		struct ip *iph;
840 		struct sctphdr *sh;
841 		struct sockaddr_storage from_store;
842 		struct sockaddr *from = (struct sockaddr *)&from_store;
843 
844 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
845 		/* pullup already done, IP options already stripped */
846 		iph = mtod(m, struct ip *);
847 		sh = (struct sctphdr *)((caddr_t)iph + sizeof(*iph));
848 		if (iph->ip_v == IPVERSION) {
849 			struct sockaddr_in *from4;
850 
851 			from4 = (struct sockaddr_in *)&from_store;
852 			bzero(from4, sizeof(*from4));
853 			from4->sin_family = AF_INET;
854 			from4->sin_len = sizeof(struct sockaddr_in);
855 			from4->sin_addr.s_addr = iph->ip_src.s_addr;
856 			from4->sin_port = sh->src_port;
857 		} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
858 			struct ip6_hdr *ip6;
859 			struct sockaddr_in6 *from6;
860 
861 			ip6 = mtod(m, struct ip6_hdr *);
862 			from6 = (struct sockaddr_in6 *)&from_store;
863 			bzero(from6, sizeof(*from6));
864 			from6->sin6_family = AF_INET6;
865 			from6->sin6_len = sizeof(struct sockaddr_in6);
866 			from6->sin6_addr = ip6->ip6_src;
867 			from6->sin6_port = sh->src_port;
868 			/* Get the scopes in properly to the sin6 addr's */
869 			/* we probably don't need these operations */
870 			(void)sa6_recoverscope(from6);
871 			sa6_embedscope(from6, ip6_use_defzone);
872 		} else {
873 			/* unknown address type */
874 			from = NULL;
875 		}
876 		if (from != NULL) {
877 			SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
878 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, from);
879 			/* look up the from address */
880 			stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, from);
881 #ifdef SCTP_DEBUG
882 			if (stcb->asoc.last_control_chunk_from == NULL)
883 				SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
884 #endif
885 		}
886 	}
887 }
888 
889 /*
890  * does the address match? returns 0 if not, 1 if so
891  */
892 static uint32_t
893 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
894 {
895 #ifdef INET6
896 	if (sa->sa_family == AF_INET6) {
897 		/* IPv6 sa address */
898 		/* XXX scopeid */
899 		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
900 
901 		if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
902 		    (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
903 		    sizeof(struct in6_addr)) == 0)) {
904 			return (1);
905 		}
906 	} else
907 #endif				/* INET6 */
908 	if (sa->sa_family == AF_INET) {
909 		/* IPv4 sa address */
910 		struct sockaddr_in *sin = (struct sockaddr_in *)sa;
911 
912 		if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
913 		    (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
914 		    sizeof(struct in_addr)) == 0)) {
915 			return (1);
916 		}
917 	}
918 	return (0);
919 }
920 
921 /*
922  * Cleanup for non-responded/OP ERR'd ASCONF
923  */
924 void
925 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
926 {
927 	/* mark peer as ASCONF incapable */
928 	stcb->asoc.peer_supports_asconf = 0;
929 	/*
930 	 * clear out any existing asconfs going out
931 	 */
932 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
933 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
934 	stcb->asoc.asconf_seq_out++;
935 	/* remove the old ASCONF on our outbound queue */
936 	sctp_toss_old_asconf(stcb);
937 }
938 
939 /*
940  * cleanup any cached source addresses that may be topologically
941  * incorrect after a new address has been added to this interface.
942  */
943 static void
944 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
945 {
946 	struct sctp_nets *net;
947 
948 	/*
949 	 * Ideally, we want to only clear cached routes and source addresses
950 	 * that are topologically incorrect.  But since there is no easy way
951 	 * to know whether the newly added address on the ifn would cause a
952 	 * routing change (i.e. a new egress interface would be chosen)
953 	 * without doing a new routing lookup and source address selection,
954 	 * we will (for now) just flush any cached route using a different
955 	 * ifn (and cached source addrs) and let output re-choose them
956 	 * during the next send on that net.
957 	 */
958 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
959 		/*
960 		 * clear any cached route (and cached source address) if the
961 		 * route's interface is NOT the same as the address change.
962 		 * If it's the same interface, just clear the cached source
963 		 * address.
964 		 */
965 		if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
966 		    SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index) {
967 			/* clear any cached route */
968 			RTFREE(net->ro.ro_rt);
969 			net->ro.ro_rt = NULL;
970 		}
971 		/* clear any cached source address */
972 		if (net->src_addr_selected) {
973 			sctp_free_ifa(net->ro._s_addr);
974 			net->ro._s_addr = NULL;
975 			net->src_addr_selected = 0;
976 		}
977 	}
978 }
979 
980 void
981 sctp_move_chunks_from_deleted_prim(struct sctp_tcb *stcb, struct sctp_nets *dst)
982 {
983 	struct sctp_association *asoc;
984 	struct sctp_stream_out *outs;
985 	struct sctp_tmit_chunk *chk;
986 	struct sctp_stream_queue_pending *sp;
987 
988 	if (dst->dest_state & SCTP_ADDR_UNCONFIRMED) {
989 		return;
990 	}
991 	if (stcb->asoc.deleted_primary == NULL) {
992 		return;
993 	}
994 	asoc = &stcb->asoc;
995 
996 	/*
997 	 * now through all the streams checking for chunks sent to our bad
998 	 * network.
999 	 */
1000 	TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
1001 		/* now clean up any chunks here */
1002 		TAILQ_FOREACH(sp, &outs->outqueue, next) {
1003 			if (sp->net == asoc->deleted_primary) {
1004 				sctp_free_remote_addr(sp->net);
1005 				sp->net = dst;
1006 				atomic_add_int(&dst->ref_count, 1);
1007 			}
1008 		}
1009 	}
1010 	/* Now check the pending queue */
1011 	TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
1012 		if (chk->whoTo == asoc->deleted_primary) {
1013 			sctp_free_remote_addr(chk->whoTo);
1014 			chk->whoTo = dst;
1015 			atomic_add_int(&dst->ref_count, 1);
1016 		}
1017 	}
1018 
1019 }
1020 
1021 
1022 void
1023 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
1024 {
1025 	int error;
1026 
1027 	if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1028 		return;
1029 	}
1030 	if (stcb->asoc.deleted_primary == NULL) {
1031 		return;
1032 	}
1033 	if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1034 		SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1035 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1036 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1037 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1038 		sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1039 		    stcb->asoc.deleted_primary,
1040 		    SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1041 		stcb->asoc.num_send_timers_up--;
1042 		if (stcb->asoc.num_send_timers_up < 0) {
1043 			stcb->asoc.num_send_timers_up = 0;
1044 		}
1045 		SCTP_TCB_LOCK_ASSERT(stcb);
1046 		error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1047 		    stcb->asoc.deleted_primary);
1048 		if (error) {
1049 			SCTP_INP_DECR_REF(stcb->sctp_ep);
1050 			return;
1051 		}
1052 		SCTP_TCB_LOCK_ASSERT(stcb);
1053 #ifdef SCTP_AUDITING_ENABLED
1054 		sctp_auditing(4, stcb->sctp_ep, stcb->asoc.deleted_primary);
1055 #endif
1056 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1057 		if ((stcb->asoc.num_send_timers_up == 0) &&
1058 		    (stcb->asoc.sent_queue_cnt > 0)) {
1059 			struct sctp_tmit_chunk *chk;
1060 
1061 			chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1062 			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1063 			    stcb, chk->whoTo);
1064 		}
1065 	}
1066 	return;
1067 }
1068 
1069 static int
1070     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1071 
1072 void
1073 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1074 {
1075 	struct sctp_tmit_chunk *chk;
1076 
1077 	SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1078 	sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1079 	    SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1080 	stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1081 	net->error_count = 0;
1082 	TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1083 		if (chk->whoTo == net) {
1084 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
1085 				chk->sent = SCTP_DATAGRAM_RESEND;
1086 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1087 				sctp_flight_size_decrease(chk);
1088 				sctp_total_flight_decrease(stcb, chk);
1089 				net->marked_retrans++;
1090 				stcb->asoc.marked_retrans++;
1091 			}
1092 		}
1093 	}
1094 	if (net->marked_retrans) {
1095 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1096 	}
1097 }
1098 
1099 static void
1100 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1101 {
1102 	struct sctp_nets *net;
1103 	int addrnum, changed;
1104 
1105 	/*
1106 	 * If number of local valid addresses is 1, the valid address is
1107 	 * probably newly added address.  Several valid addresses in this
1108 	 * association.  A source address may not be changed.  Additionally,
1109 	 * they can be configured on a same interface as "alias" addresses.
1110 	 * (by micchie)
1111 	 */
1112 	addrnum = sctp_local_addr_count(stcb);
1113 	SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1114 	    addrnum);
1115 	if (addrnum == 1) {
1116 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1117 			/* clear any cached route and source address */
1118 			if (net->ro.ro_rt) {
1119 				RTFREE(net->ro.ro_rt);
1120 				net->ro.ro_rt = NULL;
1121 			}
1122 			if (net->src_addr_selected) {
1123 				sctp_free_ifa(net->ro._s_addr);
1124 				net->ro._s_addr = NULL;
1125 				net->src_addr_selected = 0;
1126 			}
1127 			/* Retransmit unacknowledged DATA chunks immediately */
1128 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1129 			    SCTP_MOBILITY_FASTHANDOFF)) {
1130 				sctp_net_immediate_retrans(stcb, net);
1131 			}
1132 			/* also, SET PRIMARY is maybe already sent */
1133 		}
1134 		return;
1135 	}
1136 	/* Multiple local addresses exsist in the association.  */
1137 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1138 		/* clear any cached route and source address */
1139 		if (net->ro.ro_rt) {
1140 			RTFREE(net->ro.ro_rt);
1141 			net->ro.ro_rt = NULL;
1142 		}
1143 		if (net->src_addr_selected) {
1144 			sctp_free_ifa(net->ro._s_addr);
1145 			net->ro._s_addr = NULL;
1146 			net->src_addr_selected = 0;
1147 		}
1148 		/*
1149 		 * Check if the nexthop is corresponding to the new address.
1150 		 * If the new address is corresponding to the current
1151 		 * nexthop, the path will be changed.  If the new address is
1152 		 * NOT corresponding to the current nexthop, the path will
1153 		 * not be changed.
1154 		 */
1155 		SCTP_RTALLOC((sctp_route_t *) & net->ro,
1156 		    stcb->sctp_ep->def_vrf_id);
1157 		if (net->ro.ro_rt == NULL)
1158 			continue;
1159 
1160 		changed = 0;
1161 		if (net->ro._l_addr.sa.sa_family == AF_INET) {
1162 			if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro))
1163 				changed = 1;
1164 		}
1165 		if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1166 			if (sctp_v6src_match_nexthop(
1167 			    &newifa->address.sin6, (sctp_route_t *) & net->ro))
1168 				changed = 1;
1169 		}
1170 		/*
1171 		 * if the newly added address does not relate routing
1172 		 * information, we skip.
1173 		 */
1174 		if (changed == 0)
1175 			continue;
1176 		/* Retransmit unacknowledged DATA chunks immediately */
1177 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1178 		    SCTP_MOBILITY_FASTHANDOFF)) {
1179 			sctp_net_immediate_retrans(stcb, net);
1180 		}
1181 		/* Send SET PRIMARY for this new address */
1182 		if (net == stcb->asoc.primary_destination) {
1183 			(void)sctp_asconf_queue_mgmt(stcb, newifa,
1184 			    SCTP_SET_PRIM_ADDR);
1185 		}
1186 	}
1187 }
1188 
1189 /*
1190  * process an ADD/DELETE IP ack from peer.
1191  * addr: corresponding sctp_ifa to the address being added/deleted.
1192  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1193  * flag: 1=success, 0=failure.
1194  */
1195 static void
1196 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr,
1197     uint16_t type, uint32_t flag)
1198 {
1199 	/*
1200 	 * do the necessary asoc list work- if we get a failure indication,
1201 	 * leave the address on the assoc's restricted list.  If we get a
1202 	 * success indication, remove the address from the restricted list.
1203 	 */
1204 	/*
1205 	 * Note: this will only occur for ADD_IP_ADDRESS, since
1206 	 * DEL_IP_ADDRESS is never actually added to the list...
1207 	 */
1208 	if (flag) {
1209 		/* success case, so remove from the restricted list */
1210 		sctp_del_local_addr_restricted(stcb, addr);
1211 
1212 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1213 		    SCTP_MOBILITY_BASE) ||
1214 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
1215 		    SCTP_MOBILITY_FASTHANDOFF)) {
1216 			sctp_path_check_and_react(stcb, addr);
1217 			return;
1218 		}
1219 		/* clear any cached/topologically incorrect source addresses */
1220 		sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1221 	}
1222 	/* else, leave it on the list */
1223 }
1224 
1225 /*
1226  * add an asconf add/delete/set primary IP address parameter to the queue.
1227  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1228  * returns 0 if queued, -1 if not queued/removed.
1229  * NOTE: if adding, but a delete for the same address is already scheduled
1230  * (and not yet sent out), simply remove it from queue.  Same for deleting
1231  * an address already scheduled for add.  If a duplicate operation is found,
1232  * ignore the new one.
1233  */
1234 static int
1235 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1236     uint16_t type)
1237 {
1238 	struct sctp_asconf_addr *aa, *aa_next;
1239 	struct sockaddr *sa;
1240 
1241 	/* make sure the request isn't already in the queue */
1242 	for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1243 	    aa = aa_next) {
1244 		aa_next = TAILQ_NEXT(aa, next);
1245 		/* address match? */
1246 		if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1247 			continue;
1248 		/* is the request already in queue (sent or not) */
1249 		if (aa->ap.aph.ph.param_type == type) {
1250 			return (-1);
1251 		}
1252 		/* is the negative request already in queue, and not sent */
1253 		if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1254 		    (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1255 			/* add requested, delete already queued */
1256 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1257 			/* remove the ifa from the restricted list */
1258 			sctp_del_local_addr_restricted(stcb, ifa);
1259 			/* free the asconf param */
1260 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1261 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1262 			return (-1);
1263 		}
1264 		if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1265 		    (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1266 			/* delete requested, add already queued */
1267 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1268 			/* remove the aa->ifa from the restricted list */
1269 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1270 			/* free the asconf param */
1271 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1272 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1273 			return (-1);
1274 		}
1275 	}			/* for each aa */
1276 
1277 	/* adding new request to the queue */
1278 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1279 	    SCTP_M_ASC_ADDR);
1280 	if (aa == NULL) {
1281 		/* didn't get memory */
1282 		SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1283 		return (-1);
1284 	}
1285 	/* fill in asconf address parameter fields */
1286 	/* top level elements are "networked" during send */
1287 	aa->ap.aph.ph.param_type = type;
1288 	aa->ifa = ifa;
1289 	atomic_add_int(&ifa->refcount, 1);
1290 	/* correlation_id filled in during send routine later... */
1291 	if (ifa->address.sa.sa_family == AF_INET6) {
1292 		/* IPv6 address */
1293 		struct sockaddr_in6 *sin6;
1294 
1295 		sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1296 		sa = (struct sockaddr *)sin6;
1297 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1298 		aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1299 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1300 		    sizeof(struct sctp_ipv6addr_param);
1301 		memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1302 		    sizeof(struct in6_addr));
1303 	} else if (ifa->address.sa.sa_family == AF_INET) {
1304 		/* IPv4 address */
1305 		struct sockaddr_in *sin;
1306 
1307 		sin = (struct sockaddr_in *)&ifa->address.sa;
1308 		sa = (struct sockaddr *)sin;
1309 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1310 		aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1311 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1312 		    sizeof(struct sctp_ipv4addr_param);
1313 		memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1314 		    sizeof(struct in_addr));
1315 	} else {
1316 		/* invalid family! */
1317 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1318 		sctp_free_ifa(ifa);
1319 		return (-1);
1320 	}
1321 	aa->sent = 0;		/* clear sent flag */
1322 
1323 	/*
1324 	 * if we are deleting an address it should go out last otherwise,
1325 	 * add it to front of the pending queue
1326 	 */
1327 	if (type == SCTP_ADD_IP_ADDRESS) {
1328 		/* add goes to the front of the queue */
1329 		TAILQ_INSERT_HEAD(&stcb->asoc.asconf_queue, aa, next);
1330 		SCTPDBG(SCTP_DEBUG_ASCONF2,
1331 		    "asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1332 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1333 	} else {
1334 		/* delete and set primary goes to the back of the queue */
1335 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1336 #ifdef SCTP_DEBUG
1337 		if (sctp_debug_on && SCTP_DEBUG_ASCONF2) {
1338 			if (type == SCTP_DEL_IP_ADDRESS) {
1339 				SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1340 				SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1341 			} else {
1342 				SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1343 				SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1344 			}
1345 		}
1346 #endif
1347 	}
1348 
1349 	return (0);
1350 }
1351 
1352 
1353 /*
1354  * add an asconf operation for the given ifa and type.
1355  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1356  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1357  * advisable.
1358  */
1359 static int
1360 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1361     uint16_t type)
1362 {
1363 	uint32_t status;
1364 	int pending_delete_queued = 0;
1365 
1366 	/* see if peer supports ASCONF */
1367 	if (stcb->asoc.peer_supports_asconf == 0) {
1368 		return (-1);
1369 	}
1370 	/*
1371 	 * if this is deleting the last address from the assoc, mark it as
1372 	 * pending.
1373 	 */
1374 	if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1375 	    (sctp_local_addr_count(stcb) < 2)) {
1376 		/* set the pending delete info only */
1377 		stcb->asoc.asconf_del_pending = 1;
1378 		stcb->asoc.asconf_addr_del_pending = ifa;
1379 		atomic_add_int(&ifa->refcount, 1);
1380 		SCTPDBG(SCTP_DEBUG_ASCONF2,
1381 		    "asconf_queue_add: mark delete last address pending\n");
1382 		return (-1);
1383 	}
1384 	/*
1385 	 * if this is an add, and there is a delete also pending (i.e. the
1386 	 * last local address is being changed), queue the pending delete
1387 	 * too.
1388 	 */
1389 	if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending) {
1390 		/* queue in the pending delete */
1391 		if (sctp_asconf_queue_mgmt(stcb,
1392 		    stcb->asoc.asconf_addr_del_pending,
1393 		    SCTP_DEL_IP_ADDRESS) == 0) {
1394 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1395 			pending_delete_queued = 1;
1396 			/* clear out the pending delete info */
1397 			stcb->asoc.asconf_del_pending = 0;
1398 			sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1399 			stcb->asoc.asconf_addr_del_pending = NULL;
1400 		}
1401 	}
1402 	/* queue an asconf parameter */
1403 	status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1404 
1405 	if (pending_delete_queued && (status == 0)) {
1406 		struct sctp_nets *net;
1407 
1408 		/*
1409 		 * since we know that the only/last address is now being
1410 		 * changed in this case, reset the cwnd/rto on all nets to
1411 		 * start as a new address and path.  Also clear the error
1412 		 * counts to give the assoc the best chance to complete the
1413 		 * address change.
1414 		 */
1415 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1416 			stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1417 			    net);
1418 			net->RTO = 0;
1419 			net->error_count = 0;
1420 		}
1421 		stcb->asoc.overall_error_count = 0;
1422 		if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
1423 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1424 			    stcb->asoc.overall_error_count,
1425 			    0,
1426 			    SCTP_FROM_SCTP_ASCONF,
1427 			    __LINE__);
1428 		}
1429 		/* queue in an advisory set primary too */
1430 		(void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1431 		/* let caller know we should send this out immediately */
1432 		status = 1;
1433 	}
1434 	return (status);
1435 }
1436 
1437 /*-
1438  * add an asconf delete IP address parameter to the queue by sockaddr and
1439  * possibly with no sctp_ifa available.  This is only called by the routine
1440  * that checks the addresses in an INIT-ACK against the current address list.
1441  * returns 0 if completed, non-zero if not completed.
1442  * NOTE: if an add is already scheduled (and not yet sent out), simply
1443  * remove it from queue.  If a duplicate operation is found, ignore the
1444  * new one.
1445  */
1446 static int
1447 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1448 {
1449 	struct sctp_ifa *ifa;
1450 	struct sctp_asconf_addr *aa, *aa_next;
1451 	uint32_t vrf_id;
1452 
1453 	if (stcb == NULL) {
1454 		return (-1);
1455 	}
1456 	/* see if peer supports ASCONF */
1457 	if (stcb->asoc.peer_supports_asconf == 0) {
1458 		return (-1);
1459 	}
1460 	/* make sure the request isn't already in the queue */
1461 	for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1462 	    aa = aa_next) {
1463 		aa_next = TAILQ_NEXT(aa, next);
1464 		/* address match? */
1465 		if (sctp_asconf_addr_match(aa, sa) == 0)
1466 			continue;
1467 		/* is the request already in queue (sent or not) */
1468 		if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1469 			return (-1);
1470 		}
1471 		/* is the negative request already in queue, and not sent */
1472 		if (aa->sent == 1)
1473 			continue;
1474 		if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1475 			/* add already queued, so remove existing entry */
1476 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1477 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1478 			/* free the entry */
1479 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1480 			return (-1);
1481 		}
1482 	}			/* for each aa */
1483 
1484 	/* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1485 	if (stcb) {
1486 		vrf_id = stcb->asoc.vrf_id;
1487 	} else {
1488 		vrf_id = SCTP_DEFAULT_VRFID;
1489 	}
1490 	ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1491 
1492 	/* adding new request to the queue */
1493 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1494 	    SCTP_M_ASC_ADDR);
1495 	if (aa == NULL) {
1496 		/* didn't get memory */
1497 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1498 		    "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1499 		return (-1);
1500 	}
1501 	/* fill in asconf address parameter fields */
1502 	/* top level elements are "networked" during send */
1503 	aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1504 	aa->ifa = ifa;
1505 	if (ifa)
1506 		atomic_add_int(&ifa->refcount, 1);
1507 	/* correlation_id filled in during send routine later... */
1508 	if (sa->sa_family == AF_INET6) {
1509 		/* IPv6 address */
1510 		struct sockaddr_in6 *sin6;
1511 
1512 		sin6 = (struct sockaddr_in6 *)sa;
1513 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1514 		aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1515 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1516 		memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1517 		    sizeof(struct in6_addr));
1518 	} else if (sa->sa_family == AF_INET) {
1519 		/* IPv4 address */
1520 		struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1521 
1522 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1523 		aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1524 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1525 		memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1526 		    sizeof(struct in_addr));
1527 	} else {
1528 		/* invalid family! */
1529 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1530 		if (ifa)
1531 			sctp_free_ifa(ifa);
1532 		return (-1);
1533 	}
1534 	aa->sent = 0;		/* clear sent flag */
1535 
1536 	/* delete goes to the back of the queue */
1537 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1538 
1539 	/* sa_ignore MEMLEAK {memory is put on the tailq} */
1540 	return (0);
1541 }
1542 
1543 /*
1544  * find a specific asconf param on our "sent" queue
1545  */
1546 static struct sctp_asconf_addr *
1547 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1548 {
1549 	struct sctp_asconf_addr *aa;
1550 
1551 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1552 		if (aa->ap.aph.correlation_id == correlation_id &&
1553 		    aa->sent == 1) {
1554 			/* found it */
1555 			return (aa);
1556 		}
1557 	}
1558 	/* didn't find it */
1559 	return (NULL);
1560 }
1561 
1562 /*
1563  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1564  * notifications based on the error response
1565  */
1566 static void
1567 sctp_asconf_process_error(struct sctp_tcb *stcb,
1568     struct sctp_asconf_paramhdr *aph)
1569 {
1570 	struct sctp_error_cause *eh;
1571 	struct sctp_paramhdr *ph;
1572 	uint16_t param_type;
1573 	uint16_t error_code;
1574 
1575 	eh = (struct sctp_error_cause *)(aph + 1);
1576 	ph = (struct sctp_paramhdr *)(eh + 1);
1577 	/* validate lengths */
1578 	if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1579 	    htons(aph->ph.param_length)) {
1580 		/* invalid error cause length */
1581 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1582 		    "asconf_process_error: cause element too long\n");
1583 		return;
1584 	}
1585 	if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1586 	    htons(eh->length)) {
1587 		/* invalid included TLV length */
1588 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1589 		    "asconf_process_error: included TLV too long\n");
1590 		return;
1591 	}
1592 	/* which error code ? */
1593 	error_code = ntohs(eh->code);
1594 	param_type = ntohs(aph->ph.param_type);
1595 	/* FIX: this should go back up the REMOTE_ERROR ULP notify */
1596 	switch (error_code) {
1597 	case SCTP_CAUSE_RESOURCE_SHORTAGE:
1598 		/* we allow ourselves to "try again" for this error */
1599 		break;
1600 	default:
1601 		/* peer can't handle it... */
1602 		switch (param_type) {
1603 		case SCTP_ADD_IP_ADDRESS:
1604 		case SCTP_DEL_IP_ADDRESS:
1605 			stcb->asoc.peer_supports_asconf = 0;
1606 			break;
1607 		case SCTP_SET_PRIM_ADDR:
1608 			stcb->asoc.peer_supports_asconf = 0;
1609 			break;
1610 		default:
1611 			break;
1612 		}
1613 	}
1614 }
1615 
1616 /*
1617  * process an asconf queue param.
1618  * aparam: parameter to process, will be removed from the queue.
1619  * flag: 1=success case, 0=failure case
1620  */
1621 static void
1622 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1623     struct sctp_asconf_addr *aparam, uint32_t flag)
1624 {
1625 	uint16_t param_type;
1626 
1627 	/* process this param */
1628 	param_type = aparam->ap.aph.ph.param_type;
1629 	switch (param_type) {
1630 	case SCTP_ADD_IP_ADDRESS:
1631 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1632 		    "process_param_ack: added IP address\n");
1633 		sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, param_type, flag);
1634 		break;
1635 	case SCTP_DEL_IP_ADDRESS:
1636 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1637 		    "process_param_ack: deleted IP address\n");
1638 		/* nothing really to do... lists already updated */
1639 		break;
1640 	case SCTP_SET_PRIM_ADDR:
1641 		/* nothing to do... peer may start using this addr */
1642 		if (flag == 0)
1643 			stcb->asoc.peer_supports_asconf = 0;
1644 		break;
1645 	default:
1646 		/* should NEVER happen */
1647 		break;
1648 	}
1649 
1650 	/* remove the param and free it */
1651 	TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1652 	if (aparam->ifa)
1653 		sctp_free_ifa(aparam->ifa);
1654 	SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1655 }
1656 
1657 /*
1658  * cleanup from a bad asconf ack parameter
1659  */
1660 static void
1661 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1662 {
1663 	/* assume peer doesn't really know how to do asconfs */
1664 	stcb->asoc.peer_supports_asconf = 0;
1665 	/* XXX we could free the pending queue here */
1666 }
1667 
1668 void
1669 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1670     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1671     struct sctp_nets *net, int *abort_no_unlock)
1672 {
1673 	struct sctp_association *asoc;
1674 	uint32_t serial_num;
1675 	uint16_t ack_length;
1676 	struct sctp_asconf_paramhdr *aph;
1677 	struct sctp_asconf_addr *aa, *aa_next;
1678 	uint32_t last_error_id = 0;	/* last error correlation id */
1679 	uint32_t id;
1680 	struct sctp_asconf_addr *ap;
1681 
1682 	/* asconf param buffer */
1683 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1684 
1685 	/* verify minimum length */
1686 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1687 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1688 		    "handle_asconf_ack: chunk too small = %xh\n",
1689 		    ntohs(cp->ch.chunk_length));
1690 		return;
1691 	}
1692 	asoc = &stcb->asoc;
1693 	serial_num = ntohl(cp->serial_number);
1694 
1695 	/*
1696 	 * NOTE: we may want to handle this differently- currently, we will
1697 	 * abort when we get an ack for the expected serial number + 1 (eg.
1698 	 * we didn't send it), process an ack normally if it is the expected
1699 	 * serial number, and re-send the previous ack for *ALL* other
1700 	 * serial numbers
1701 	 */
1702 
1703 	/*
1704 	 * if the serial number is the next expected, but I didn't send it,
1705 	 * abort the asoc, since someone probably just hijacked us...
1706 	 */
1707 	if (serial_num == (asoc->asconf_seq_out + 1)) {
1708 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1709 		sctp_abort_an_association(stcb->sctp_ep, stcb,
1710 		    SCTP_CAUSE_ILLEGAL_ASCONF_ACK, NULL, SCTP_SO_NOT_LOCKED);
1711 		*abort_no_unlock = 1;
1712 		return;
1713 	}
1714 	if (serial_num != asoc->asconf_seq_out) {
1715 		/* got a duplicate/unexpected ASCONF-ACK */
1716 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1717 		    serial_num, asoc->asconf_seq_out);
1718 		return;
1719 	}
1720 	if (stcb->asoc.asconf_sent == 0) {
1721 		/* got a unexpected ASCONF-ACK for serial not in flight */
1722 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got serial number = %xh but not in flight\n",
1723 		    serial_num);
1724 		/* nothing to do... duplicate ACK received */
1725 		return;
1726 	}
1727 	/* stop our timer */
1728 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1729 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1730 
1731 	/* process the ASCONF-ACK contents */
1732 	ack_length = ntohs(cp->ch.chunk_length) -
1733 	    sizeof(struct sctp_asconf_ack_chunk);
1734 	offset += sizeof(struct sctp_asconf_ack_chunk);
1735 	/* process through all parameters */
1736 	while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1737 		unsigned int param_length, param_type;
1738 
1739 		/* get pointer to next asconf parameter */
1740 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1741 		    sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1742 		if (aph == NULL) {
1743 			/* can't get an asconf paramhdr */
1744 			sctp_asconf_ack_clear(stcb);
1745 			return;
1746 		}
1747 		param_type = ntohs(aph->ph.param_type);
1748 		param_length = ntohs(aph->ph.param_length);
1749 		if (param_length > ack_length) {
1750 			sctp_asconf_ack_clear(stcb);
1751 			return;
1752 		}
1753 		if (param_length < sizeof(struct sctp_paramhdr)) {
1754 			sctp_asconf_ack_clear(stcb);
1755 			return;
1756 		}
1757 		/* get the complete parameter... */
1758 		if (param_length > sizeof(aparam_buf)) {
1759 			SCTPDBG(SCTP_DEBUG_ASCONF1,
1760 			    "param length (%u) larger than buffer size!\n", param_length);
1761 			sctp_asconf_ack_clear(stcb);
1762 			return;
1763 		}
1764 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1765 		if (aph == NULL) {
1766 			sctp_asconf_ack_clear(stcb);
1767 			return;
1768 		}
1769 		/* correlation_id is transparent to peer, no ntohl needed */
1770 		id = aph->correlation_id;
1771 
1772 		switch (param_type) {
1773 		case SCTP_ERROR_CAUSE_IND:
1774 			last_error_id = id;
1775 			/* find the corresponding asconf param in our queue */
1776 			ap = sctp_asconf_find_param(stcb, id);
1777 			if (ap == NULL) {
1778 				/* hmm... can't find this in our queue! */
1779 				break;
1780 			}
1781 			/* process the parameter, failed flag */
1782 			sctp_asconf_process_param_ack(stcb, ap, 0);
1783 			/* process the error response */
1784 			sctp_asconf_process_error(stcb, aph);
1785 			break;
1786 		case SCTP_SUCCESS_REPORT:
1787 			/* find the corresponding asconf param in our queue */
1788 			ap = sctp_asconf_find_param(stcb, id);
1789 			if (ap == NULL) {
1790 				/* hmm... can't find this in our queue! */
1791 				break;
1792 			}
1793 			/* process the parameter, success flag */
1794 			sctp_asconf_process_param_ack(stcb, ap, 1);
1795 			break;
1796 		default:
1797 			break;
1798 		}		/* switch */
1799 
1800 		/* update remaining ASCONF-ACK message length to process */
1801 		ack_length -= SCTP_SIZE32(param_length);
1802 		if (ack_length <= 0) {
1803 			/* no more data in the mbuf chain */
1804 			break;
1805 		}
1806 		offset += SCTP_SIZE32(param_length);
1807 	}			/* while */
1808 
1809 	/*
1810 	 * if there are any "sent" params still on the queue, these are
1811 	 * implicitly "success", or "failed" (if we got an error back) ...
1812 	 * so process these appropriately
1813 	 *
1814 	 * we assume that the correlation_id's are monotonically increasing
1815 	 * beginning from 1 and that we don't have *that* many outstanding
1816 	 * at any given time
1817 	 */
1818 	if (last_error_id == 0)
1819 		last_error_id--;/* set to "max" value */
1820 	for (aa = TAILQ_FIRST(&stcb->asoc.asconf_queue); aa != NULL;
1821 	    aa = aa_next) {
1822 		aa_next = TAILQ_NEXT(aa, next);
1823 		if (aa->sent == 1) {
1824 			/*
1825 			 * implicitly successful or failed if correlation_id
1826 			 * < last_error_id, then success else, failure
1827 			 */
1828 			if (aa->ap.aph.correlation_id < last_error_id)
1829 				sctp_asconf_process_param_ack(stcb, aa, 1);
1830 			else
1831 				sctp_asconf_process_param_ack(stcb, aa, 0);
1832 		} else {
1833 			/*
1834 			 * since we always process in order (FIFO queue) if
1835 			 * we reach one that hasn't been sent, the rest
1836 			 * should not have been sent either. so, we're
1837 			 * done...
1838 			 */
1839 			break;
1840 		}
1841 	}
1842 
1843 	/* update the next sequence number to use */
1844 	asoc->asconf_seq_out++;
1845 	/* remove the old ASCONF on our outbound queue */
1846 	sctp_toss_old_asconf(stcb);
1847 	/* clear the sent flag to allow new ASCONFs */
1848 	asoc->asconf_sent = 0;
1849 	if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1850 #ifdef SCTP_TIMER_BASED_ASCONF
1851 		/* we have more params, so restart our timer */
1852 		sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1853 		    stcb, net);
1854 #else
1855 		/* we have more params, so send out more */
1856 		sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1857 #endif
1858 	}
1859 }
1860 
1861 static uint32_t
1862 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1863 {
1864 	struct sockaddr_in6 *sin6, *net6;
1865 	struct sctp_nets *net;
1866 
1867 	if (sa->sa_family != AF_INET6) {
1868 		/* wrong family */
1869 		return (0);
1870 	}
1871 	sin6 = (struct sockaddr_in6 *)sa;
1872 	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1873 		/* not link local address */
1874 		return (0);
1875 	}
1876 	/* hunt through our destination nets list for this scope_id */
1877 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1878 		if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1879 		    AF_INET6)
1880 			continue;
1881 		net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1882 		if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1883 			continue;
1884 		if (sctp_is_same_scope(sin6, net6)) {
1885 			/* found one */
1886 			return (1);
1887 		}
1888 	}
1889 	/* didn't find one */
1890 	return (0);
1891 }
1892 
1893 /*
1894  * address management functions
1895  */
1896 static void
1897 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1898     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1899 {
1900 	int status;
1901 
1902 
1903 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 &&
1904 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1905 		/* subset bound, no ASCONF allowed case, so ignore */
1906 		return;
1907 	}
1908 	/*
1909 	 * note: we know this is not the subset bound, no ASCONF case eg.
1910 	 * this is boundall or subset bound w/ASCONF allowed
1911 	 */
1912 
1913 	/* first, make sure it's a good address family */
1914 	if (ifa->address.sa.sa_family != AF_INET6 &&
1915 	    ifa->address.sa.sa_family != AF_INET) {
1916 		return;
1917 	}
1918 	/* make sure we're "allowed" to add this type of addr */
1919 	if (ifa->address.sa.sa_family == AF_INET6) {
1920 		/* invalid if we're not a v6 endpoint */
1921 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1922 			return;
1923 		/* is the v6 addr really valid ? */
1924 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1925 			return;
1926 		}
1927 	}
1928 	/* put this address on the "pending/do not use yet" list */
1929 	sctp_add_local_addr_restricted(stcb, ifa);
1930 	/*
1931 	 * check address scope if address is out of scope, don't queue
1932 	 * anything... note: this would leave the address on both inp and
1933 	 * asoc lists
1934 	 */
1935 	if (ifa->address.sa.sa_family == AF_INET6) {
1936 		struct sockaddr_in6 *sin6;
1937 
1938 		sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1939 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1940 			/* we skip unspecifed addresses */
1941 			return;
1942 		}
1943 		if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1944 			if (stcb->asoc.local_scope == 0) {
1945 				return;
1946 			}
1947 			/* is it the right link local scope? */
1948 			if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1949 				return;
1950 			}
1951 		}
1952 		if (stcb->asoc.site_scope == 0 &&
1953 		    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1954 			return;
1955 		}
1956 	} else if (ifa->address.sa.sa_family == AF_INET) {
1957 		struct sockaddr_in *sin;
1958 		struct in6pcb *inp6;
1959 
1960 		inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1961 		/* invalid if we are a v6 only endpoint */
1962 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1963 		    SCTP_IPV6_V6ONLY(inp6))
1964 			return;
1965 
1966 		sin = (struct sockaddr_in *)&ifa->address.sa;
1967 		if (sin->sin_addr.s_addr == 0) {
1968 			/* we skip unspecifed addresses */
1969 			return;
1970 		}
1971 		if (stcb->asoc.ipv4_local_scope == 0 &&
1972 		    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1973 			return;
1974 		}
1975 	} else {
1976 		/* else, not AF_INET or AF_INET6, so skip */
1977 		return;
1978 	}
1979 
1980 	/* queue an asconf for this address add/delete */
1981 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1982 		/* does the peer do asconf? */
1983 		if (stcb->asoc.peer_supports_asconf) {
1984 			/* queue an asconf for this addr */
1985 			status = sctp_asconf_queue_add(stcb, ifa, type);
1986 
1987 			/*
1988 			 * if queued ok, and in the open state, send out the
1989 			 * ASCONF.  If in the non-open state, these will be
1990 			 * sent when the state goes open.
1991 			 */
1992 			if (status == 0 &&
1993 			    SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1994 #ifdef SCTP_TIMER_BASED_ASCONF
1995 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1996 				    stcb, stcb->asoc.primary_destination);
1997 #else
1998 				sctp_send_asconf(stcb, stcb->asoc.primary_destination,
1999 				    addr_locked);
2000 #endif
2001 			}
2002 		}
2003 	}
2004 }
2005 
2006 
2007 int
2008 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2009 {
2010 	struct sctp_asconf_iterator *asc;
2011 	struct sctp_ifa *ifa;
2012 	struct sctp_laddr *l;
2013 	int type;
2014 	int cnt_invalid = 0;
2015 
2016 	asc = (struct sctp_asconf_iterator *)ptr;
2017 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2018 		ifa = l->ifa;
2019 		type = l->action;
2020 		if (ifa->address.sa.sa_family == AF_INET6) {
2021 			/* invalid if we're not a v6 endpoint */
2022 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2023 				cnt_invalid++;
2024 				if (asc->cnt == cnt_invalid)
2025 					return (1);
2026 				else
2027 					continue;
2028 			}
2029 		} else if (ifa->address.sa.sa_family == AF_INET) {
2030 			/* invalid if we are a v6 only endpoint */
2031 			struct in6pcb *inp6;
2032 
2033 			inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2034 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2035 			    SCTP_IPV6_V6ONLY(inp6)) {
2036 				cnt_invalid++;
2037 				if (asc->cnt == cnt_invalid)
2038 					return (1);
2039 				else
2040 					continue;
2041 			}
2042 		} else {
2043 			/* invalid address family */
2044 			cnt_invalid++;
2045 			if (asc->cnt == cnt_invalid)
2046 				return (1);
2047 			else
2048 				continue;
2049 		}
2050 	}
2051 	return (0);
2052 }
2053 
2054 static int
2055 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val)
2056 {
2057 	struct sctp_ifa *ifa;
2058 	struct sctp_asconf_iterator *asc;
2059 	struct sctp_laddr *laddr, *nladdr, *l;
2060 
2061 	/* Only for specific case not bound all */
2062 	asc = (struct sctp_asconf_iterator *)ptr;
2063 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2064 		ifa = l->ifa;
2065 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2066 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
2067 			    sctp_nxt_addr) {
2068 				if (laddr->ifa == ifa) {
2069 					laddr->action = 0;
2070 					break;
2071 				}
2072 			}
2073 		} else if (l->action == SCTP_DEL_IP_ADDRESS) {
2074 			laddr = LIST_FIRST(&inp->sctp_addr_list);
2075 			while (laddr) {
2076 				nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2077 				/* remove only after all guys are done */
2078 				if (laddr->ifa == ifa) {
2079 					sctp_del_local_addr_ep(inp, ifa);
2080 				}
2081 				laddr = nladdr;
2082 			}
2083 		}
2084 	}
2085 	return (0);
2086 }
2087 
2088 void
2089 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2090     void *ptr, uint32_t val)
2091 {
2092 	struct sctp_asconf_iterator *asc;
2093 	struct sctp_ifa *ifa;
2094 	struct sctp_laddr *l;
2095 	int cnt_invalid = 0;
2096 	int type, status;
2097 	int num_queued = 0;
2098 
2099 	asc = (struct sctp_asconf_iterator *)ptr;
2100 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2101 		ifa = l->ifa;
2102 		type = l->action;
2103 
2104 		/* address's vrf_id must be the vrf_id of the assoc */
2105 		if (ifa->vrf_id != stcb->asoc.vrf_id) {
2106 			continue;
2107 		}
2108 		/* Same checks again for assoc */
2109 		if (ifa->address.sa.sa_family == AF_INET6) {
2110 			/* invalid if we're not a v6 endpoint */
2111 			struct sockaddr_in6 *sin6;
2112 
2113 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2114 				cnt_invalid++;
2115 				if (asc->cnt == cnt_invalid)
2116 					return;
2117 				else
2118 					continue;
2119 			}
2120 			sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2121 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2122 				/* we skip unspecifed addresses */
2123 				continue;
2124 			}
2125 			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2126 				if (stcb->asoc.local_scope == 0) {
2127 					continue;
2128 				}
2129 				/* is it the right link local scope? */
2130 				if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2131 					continue;
2132 				}
2133 			}
2134 		} else if (ifa->address.sa.sa_family == AF_INET) {
2135 			/* invalid if we are a v6 only endpoint */
2136 			struct in6pcb *inp6;
2137 			struct sockaddr_in *sin;
2138 
2139 			inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2140 			/* invalid if we are a v6 only endpoint */
2141 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2142 			    SCTP_IPV6_V6ONLY(inp6))
2143 				continue;
2144 
2145 			sin = (struct sockaddr_in *)&ifa->address.sa;
2146 			if (sin->sin_addr.s_addr == 0) {
2147 				/* we skip unspecifed addresses */
2148 				continue;
2149 			}
2150 			if (stcb->asoc.ipv4_local_scope == 0 &&
2151 			    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2152 				continue;;
2153 			}
2154 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2155 			    SCTP_IPV6_V6ONLY(inp6)) {
2156 				cnt_invalid++;
2157 				if (asc->cnt == cnt_invalid)
2158 					return;
2159 				else
2160 					continue;
2161 			}
2162 		} else {
2163 			/* invalid address family */
2164 			cnt_invalid++;
2165 			if (asc->cnt == cnt_invalid)
2166 				return;
2167 			else
2168 				continue;
2169 		}
2170 
2171 		if (type == SCTP_ADD_IP_ADDRESS) {
2172 			/* prevent this address from being used as a source */
2173 			sctp_add_local_addr_restricted(stcb, ifa);
2174 		} else if (type == SCTP_DEL_IP_ADDRESS) {
2175 			struct sctp_nets *net;
2176 
2177 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2178 				sctp_rtentry_t *rt;
2179 
2180 				/* delete this address if cached */
2181 				if (net->ro._s_addr == ifa) {
2182 					sctp_free_ifa(net->ro._s_addr);
2183 					net->ro._s_addr = NULL;
2184 					net->src_addr_selected = 0;
2185 					rt = net->ro.ro_rt;
2186 					if (rt) {
2187 						RTFREE(rt);
2188 						net->ro.ro_rt = NULL;
2189 					}
2190 					/*
2191 					 * Now we deleted our src address,
2192 					 * should we not also now reset the
2193 					 * cwnd/rto to start as if its a new
2194 					 * address?
2195 					 */
2196 					stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2197 					net->RTO = 0;
2198 
2199 				}
2200 			}
2201 		} else if (type == SCTP_SET_PRIM_ADDR) {
2202 			if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2203 				/* must validate the ifa is in the ep */
2204 				if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2205 					continue;
2206 				}
2207 			} else {
2208 				/* Need to check scopes for this guy */
2209 				if (sctp_is_address_in_scope(ifa,
2210 				    stcb->asoc.ipv4_addr_legal,
2211 				    stcb->asoc.ipv6_addr_legal,
2212 				    stcb->asoc.loopback_scope,
2213 				    stcb->asoc.ipv4_local_scope,
2214 				    stcb->asoc.local_scope,
2215 				    stcb->asoc.site_scope, 0) == 0) {
2216 					continue;
2217 				}
2218 			}
2219 		}
2220 		/* queue an asconf for this address add/delete */
2221 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2222 		    stcb->asoc.peer_supports_asconf) {
2223 			/* queue an asconf for this addr */
2224 			status = sctp_asconf_queue_add(stcb, ifa, type);
2225 			/*
2226 			 * if queued ok, and in the open state, update the
2227 			 * count of queued params.  If in the non-open
2228 			 * state, these get sent when the assoc goes open.
2229 			 */
2230 			if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2231 				if (status >= 0) {
2232 					num_queued++;
2233 				}
2234 			}
2235 		}
2236 	}
2237 	/*
2238 	 * If we have queued params in the open state, send out an ASCONF.
2239 	 */
2240 	if (num_queued > 0) {
2241 		sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2242 		    SCTP_ADDR_NOT_LOCKED);
2243 	}
2244 }
2245 
2246 void
2247 sctp_asconf_iterator_end(void *ptr, uint32_t val)
2248 {
2249 	struct sctp_asconf_iterator *asc;
2250 	struct sctp_ifa *ifa;
2251 	struct sctp_laddr *l, *l_next;
2252 
2253 	asc = (struct sctp_asconf_iterator *)ptr;
2254 	l = LIST_FIRST(&asc->list_of_work);
2255 	while (l != NULL) {
2256 		l_next = LIST_NEXT(l, sctp_nxt_addr);
2257 		ifa = l->ifa;
2258 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2259 			/* Clear the defer use flag */
2260 			ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2261 		}
2262 		sctp_free_ifa(ifa);
2263 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, l);
2264 		SCTP_DECR_LADDR_COUNT();
2265 		l = l_next;
2266 	}
2267 	SCTP_FREE(asc, SCTP_M_ASC_IT);
2268 }
2269 
2270 /*
2271  * sa is the sockaddr to ask the peer to set primary to.
2272  * returns: 0 = completed, -1 = error
2273  */
2274 int32_t
2275 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2276 {
2277 	uint32_t vrf_id;
2278 	struct sctp_ifa *ifa;
2279 
2280 	/* find the ifa for the desired set primary */
2281 	vrf_id = stcb->asoc.vrf_id;
2282 	ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2283 	if (ifa == NULL) {
2284 		/* Invalid address */
2285 		return (-1);
2286 	}
2287 	/* queue an ASCONF:SET_PRIM_ADDR to be sent */
2288 	if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2289 		/* set primary queuing succeeded */
2290 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2291 		    "set_primary_ip_address_sa: queued on tcb=%p, ",
2292 		    stcb);
2293 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2294 		if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2295 #ifdef SCTP_TIMER_BASED_ASCONF
2296 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2297 			    stcb->sctp_ep, stcb,
2298 			    stcb->asoc.primary_destination);
2299 #else
2300 			sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2301 			    SCTP_ADDR_NOT_LOCKED);
2302 #endif
2303 		}
2304 	} else {
2305 		SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2306 		    stcb);
2307 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2308 		return (-1);
2309 	}
2310 	return (0);
2311 }
2312 
2313 void
2314 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2315 {
2316 	struct sctp_inpcb *inp;
2317 
2318 	/* go through all our PCB's */
2319 	LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
2320 		struct sctp_tcb *stcb;
2321 
2322 		/* process for all associations for this endpoint */
2323 		LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2324 			/* queue an ASCONF:SET_PRIM_ADDR to be sent */
2325 			if (!sctp_asconf_queue_add(stcb, ifa,
2326 			    SCTP_SET_PRIM_ADDR)) {
2327 				/* set primary queuing succeeded */
2328 				SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2329 				    stcb);
2330 				SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2331 				if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2332 #ifdef SCTP_TIMER_BASED_ASCONF
2333 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2334 					    stcb->sctp_ep, stcb,
2335 					    stcb->asoc.primary_destination);
2336 #else
2337 					sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2338 					    SCTP_ADDR_NOT_LOCKED);
2339 #endif
2340 				}
2341 			}
2342 		}		/* for each stcb */
2343 	}			/* for each inp */
2344 }
2345 
2346 static struct sockaddr *
2347 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2348 {
2349 	struct sctp_vrf *vrf = NULL;
2350 	struct sctp_ifn *sctp_ifn;
2351 	struct sctp_ifa *sctp_ifa;
2352 
2353 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2354 		SCTP_IPI_ADDR_RLOCK();
2355 	vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2356 	if (vrf == NULL) {
2357 		if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2358 			SCTP_IPI_ADDR_RUNLOCK();
2359 		return (NULL);
2360 	}
2361 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2362 		if (stcb->asoc.loopback_scope == 0 &&
2363 		    SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2364 			/* Skip if loopback_scope not set */
2365 			continue;
2366 		}
2367 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2368 			if (sctp_ifa->address.sa.sa_family == AF_INET &&
2369 			    stcb->asoc.ipv4_addr_legal) {
2370 				struct sockaddr_in *sin;
2371 
2372 				sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2373 				if (sin->sin_addr.s_addr == 0) {
2374 					/* skip unspecifed addresses */
2375 					continue;
2376 				}
2377 				if (stcb->asoc.ipv4_local_scope == 0 &&
2378 				    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2379 					continue;
2380 
2381 				if (sctp_is_addr_restricted(stcb, sctp_ifa))
2382 					continue;
2383 				/* found a valid local v4 address to use */
2384 				if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2385 					SCTP_IPI_ADDR_RUNLOCK();
2386 				return (&sctp_ifa->address.sa);
2387 			} else if (sctp_ifa->address.sa.sa_family == AF_INET6 &&
2388 			    stcb->asoc.ipv6_addr_legal) {
2389 				struct sockaddr_in6 *sin6;
2390 
2391 				if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2392 					continue;
2393 				}
2394 				sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2395 				if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2396 					/* we skip unspecifed addresses */
2397 					continue;
2398 				}
2399 				if (stcb->asoc.local_scope == 0 &&
2400 				    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2401 					continue;
2402 				if (stcb->asoc.site_scope == 0 &&
2403 				    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2404 					continue;
2405 
2406 				/* found a valid local v6 address to use */
2407 				if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2408 					SCTP_IPI_ADDR_RUNLOCK();
2409 				return (&sctp_ifa->address.sa);
2410 			}
2411 		}
2412 	}
2413 	/* no valid addresses found */
2414 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2415 		SCTP_IPI_ADDR_RUNLOCK();
2416 	return (NULL);
2417 }
2418 
2419 static struct sockaddr *
2420 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2421 {
2422 	struct sctp_laddr *laddr;
2423 
2424 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2425 		if (laddr->ifa == NULL) {
2426 			continue;
2427 		}
2428 		/* is the address restricted ? */
2429 		if (sctp_is_addr_restricted(stcb, laddr->ifa))
2430 			continue;
2431 
2432 		/* found a valid local address to use */
2433 		return (&laddr->ifa->address.sa);
2434 	}
2435 	/* no valid addresses found */
2436 	return (NULL);
2437 }
2438 
2439 /*
2440  * builds an ASCONF chunk from queued ASCONF params.
2441  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2442  */
2443 struct mbuf *
2444 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2445 {
2446 	struct mbuf *m_asconf, *m_asconf_chk;
2447 	struct sctp_asconf_addr *aa;
2448 	struct sctp_asconf_chunk *acp;
2449 	struct sctp_asconf_paramhdr *aph;
2450 	struct sctp_asconf_addr_param *aap;
2451 	uint32_t p_length;
2452 	uint32_t correlation_id = 1;	/* 0 is reserved... */
2453 	caddr_t ptr, lookup_ptr;
2454 	uint8_t lookup_used = 0;
2455 
2456 	/* are there any asconf params to send? */
2457 	if (TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
2458 		return (NULL);
2459 	}
2460 	/* can't send a new one if there is one in flight already */
2461 	if (stcb->asoc.asconf_sent > 0) {
2462 		return (NULL);
2463 	}
2464 	/*
2465 	 * get a chunk header mbuf and a cluster for the asconf params since
2466 	 * it's simpler to fill in the asconf chunk header lookup address on
2467 	 * the fly
2468 	 */
2469 	m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2470 	if (m_asconf_chk == NULL) {
2471 		/* no mbuf's */
2472 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2473 		    "compose_asconf: couldn't get chunk mbuf!\n");
2474 		return (NULL);
2475 	}
2476 	m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2477 	if (m_asconf == NULL) {
2478 		/* no mbuf's */
2479 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2480 		    "compose_asconf: couldn't get mbuf!\n");
2481 		sctp_m_freem(m_asconf_chk);
2482 		return (NULL);
2483 	}
2484 	SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2485 	SCTP_BUF_LEN(m_asconf) = 0;
2486 	acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2487 	bzero(acp, sizeof(struct sctp_asconf_chunk));
2488 	/* save pointers to lookup address and asconf params */
2489 	lookup_ptr = (caddr_t)(acp + 1);	/* after the header */
2490 	ptr = mtod(m_asconf, caddr_t);	/* beginning of cluster */
2491 
2492 	/* fill in chunk header info */
2493 	acp->ch.chunk_type = SCTP_ASCONF;
2494 	acp->ch.chunk_flags = 0;
2495 	acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2496 
2497 	/* add parameters... up to smallest MTU allowed */
2498 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2499 		/* get the parameter length */
2500 		p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2501 		/* will it fit in current chunk? */
2502 		if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2503 			/* won't fit, so we're done with this chunk */
2504 			break;
2505 		}
2506 		/* assign (and store) a correlation id */
2507 		aa->ap.aph.correlation_id = correlation_id++;
2508 
2509 		/*
2510 		 * fill in address if we're doing a delete this is a simple
2511 		 * way for us to fill in the correlation address, which
2512 		 * should only be used by the peer if we're deleting our
2513 		 * source address and adding a new address (e.g. renumbering
2514 		 * case)
2515 		 */
2516 		if (lookup_used == 0 &&
2517 		    aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2518 			struct sctp_ipv6addr_param *lookup;
2519 			uint16_t p_size, addr_size;
2520 
2521 			lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2522 			lookup->ph.param_type =
2523 			    htons(aa->ap.addrp.ph.param_type);
2524 			if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2525 				/* copy IPv6 address */
2526 				p_size = sizeof(struct sctp_ipv6addr_param);
2527 				addr_size = sizeof(struct in6_addr);
2528 			} else {
2529 				/* copy IPv4 address */
2530 				p_size = sizeof(struct sctp_ipv4addr_param);
2531 				addr_size = sizeof(struct in_addr);
2532 			}
2533 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2534 			memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2535 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2536 			lookup_used = 1;
2537 		}
2538 		/* copy into current space */
2539 		memcpy(ptr, &aa->ap, p_length);
2540 
2541 		/* network elements and update lengths */
2542 		aph = (struct sctp_asconf_paramhdr *)ptr;
2543 		aap = (struct sctp_asconf_addr_param *)ptr;
2544 		/* correlation_id is transparent to peer, no htonl needed */
2545 		aph->ph.param_type = htons(aph->ph.param_type);
2546 		aph->ph.param_length = htons(aph->ph.param_length);
2547 		aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2548 		aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2549 
2550 		SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2551 		ptr += SCTP_SIZE32(p_length);
2552 
2553 		/*
2554 		 * these params are removed off the pending list upon
2555 		 * getting an ASCONF-ACK back from the peer, just set flag
2556 		 */
2557 		aa->sent = 1;
2558 	}
2559 	/* check to see if the lookup addr has been populated yet */
2560 	if (lookup_used == 0) {
2561 		/* NOTE: if the address param is optional, can skip this... */
2562 		/* add any valid (existing) address... */
2563 		struct sctp_ipv6addr_param *lookup;
2564 		uint16_t p_size, addr_size;
2565 		struct sockaddr *found_addr;
2566 		caddr_t addr_ptr;
2567 
2568 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2569 			found_addr = sctp_find_valid_localaddr(stcb,
2570 			    addr_locked);
2571 		else
2572 			found_addr = sctp_find_valid_localaddr_ep(stcb);
2573 
2574 		lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2575 		if (found_addr != NULL) {
2576 			if (found_addr->sa_family == AF_INET6) {
2577 				/* copy IPv6 address */
2578 				lookup->ph.param_type =
2579 				    htons(SCTP_IPV6_ADDRESS);
2580 				p_size = sizeof(struct sctp_ipv6addr_param);
2581 				addr_size = sizeof(struct in6_addr);
2582 				addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2583 				    found_addr)->sin6_addr;
2584 			} else {
2585 				/* copy IPv4 address */
2586 				lookup->ph.param_type =
2587 				    htons(SCTP_IPV4_ADDRESS);
2588 				p_size = sizeof(struct sctp_ipv4addr_param);
2589 				addr_size = sizeof(struct in_addr);
2590 				addr_ptr = (caddr_t)&((struct sockaddr_in *)
2591 				    found_addr)->sin_addr;
2592 			}
2593 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2594 			memcpy(lookup->addr, addr_ptr, addr_size);
2595 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2596 			lookup_used = 1;
2597 		} else {
2598 			/* uh oh... don't have any address?? */
2599 			SCTPDBG(SCTP_DEBUG_ASCONF1,
2600 			    "compose_asconf: no lookup addr!\n");
2601 			/* for now, we send a IPv4 address of 0.0.0.0 */
2602 			lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2603 			lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2604 			bzero(lookup->addr, sizeof(struct in_addr));
2605 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2606 			lookup_used = 1;
2607 		}
2608 	}
2609 	/* chain it all together */
2610 	SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2611 	*retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2612 	acp->ch.chunk_length = ntohs(*retlen);
2613 
2614 	/* update "sent" flag */
2615 	stcb->asoc.asconf_sent++;
2616 
2617 	return (m_asconf_chk);
2618 }
2619 
2620 /*
2621  * section to handle address changes before an association is up eg. changes
2622  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2623  */
2624 
2625 /*
2626  * processes the (local) addresses in the INIT-ACK chunk
2627  */
2628 static void
2629 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2630     unsigned int offset, unsigned int length)
2631 {
2632 	struct sctp_paramhdr tmp_param, *ph;
2633 	uint16_t plen, ptype;
2634 	struct sctp_ifa *sctp_ifa;
2635 	struct sctp_ipv6addr_param addr_store;
2636 	struct sockaddr_in6 sin6;
2637 	struct sockaddr_in sin;
2638 	struct sockaddr *sa;
2639 	uint32_t vrf_id;
2640 
2641 	SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2642 	if (stcb == NULL)	/* Un-needed check for SA */
2643 		return;
2644 
2645 	/* convert to upper bound */
2646 	length += offset;
2647 
2648 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2649 		return;
2650 	}
2651 	/* init the addresses */
2652 	bzero(&sin6, sizeof(sin6));
2653 	sin6.sin6_family = AF_INET6;
2654 	sin6.sin6_len = sizeof(sin6);
2655 	sin6.sin6_port = stcb->rport;
2656 
2657 	bzero(&sin, sizeof(sin));
2658 	sin.sin_len = sizeof(sin);
2659 	sin.sin_family = AF_INET;
2660 	sin.sin_port = stcb->rport;
2661 
2662 	/* go through the addresses in the init-ack */
2663 	ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2664 	    sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2665 	while (ph != NULL) {
2666 		ptype = ntohs(ph->param_type);
2667 		plen = ntohs(ph->param_length);
2668 		if (ptype == SCTP_IPV6_ADDRESS) {
2669 			struct sctp_ipv6addr_param *a6p;
2670 
2671 			/* get the entire IPv6 address param */
2672 			a6p = (struct sctp_ipv6addr_param *)
2673 			    sctp_m_getptr(m, offset,
2674 			    sizeof(struct sctp_ipv6addr_param),
2675 			    (uint8_t *) & addr_store);
2676 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
2677 			    a6p == NULL) {
2678 				return;
2679 			}
2680 			memcpy(&sin6.sin6_addr, a6p->addr,
2681 			    sizeof(struct in6_addr));
2682 			sa = (struct sockaddr *)&sin6;
2683 		} else if (ptype == SCTP_IPV4_ADDRESS) {
2684 			struct sctp_ipv4addr_param *a4p;
2685 
2686 			/* get the entire IPv4 address param */
2687 			a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2688 			    sizeof(struct sctp_ipv4addr_param),
2689 			    (uint8_t *) & addr_store);
2690 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
2691 			    a4p == NULL) {
2692 				return;
2693 			}
2694 			sin.sin_addr.s_addr = a4p->addr;
2695 			sa = (struct sockaddr *)&sin;
2696 		} else {
2697 			goto next_addr;
2698 		}
2699 
2700 		/* see if this address really (still) exists */
2701 		if (stcb) {
2702 			vrf_id = stcb->asoc.vrf_id;
2703 		} else {
2704 			vrf_id = SCTP_DEFAULT_VRFID;
2705 		}
2706 		sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2707 		    SCTP_ADDR_NOT_LOCKED);
2708 		if (sctp_ifa == NULL) {
2709 			/* address doesn't exist anymore */
2710 			int status;
2711 
2712 			/* are ASCONFs allowed ? */
2713 			if ((sctp_is_feature_on(stcb->sctp_ep,
2714 			    SCTP_PCB_FLAGS_DO_ASCONF)) &&
2715 			    stcb->asoc.peer_supports_asconf) {
2716 				/* queue an ASCONF DEL_IP_ADDRESS */
2717 				status = sctp_asconf_queue_sa_delete(stcb, sa);
2718 				/*
2719 				 * if queued ok, and in correct state, send
2720 				 * out the ASCONF.
2721 				 */
2722 				if (status == 0 &&
2723 				    SCTP_GET_STATE(&stcb->asoc) ==
2724 				    SCTP_STATE_OPEN) {
2725 #ifdef SCTP_TIMER_BASED_ASCONF
2726 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2727 					    stcb->sctp_ep, stcb,
2728 					    stcb->asoc.primary_destination);
2729 #else
2730 					sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2731 					    SCTP_ADDR_NOT_LOCKED);
2732 #endif
2733 				}
2734 			}
2735 		}
2736 next_addr:
2737 		/*
2738 		 * Sanity check:  Make sure the length isn't 0, otherwise
2739 		 * we'll be stuck in this loop for a long time...
2740 		 */
2741 		if (SCTP_SIZE32(plen) == 0) {
2742 			SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2743 			    plen, ptype);
2744 			return;
2745 		}
2746 		/* get next parameter */
2747 		offset += SCTP_SIZE32(plen);
2748 		if ((offset + sizeof(struct sctp_paramhdr)) > length)
2749 			return;
2750 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2751 		    sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2752 	}			/* while */
2753 }
2754 
2755 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2756 /*
2757  * checks to see if a specific address is in the initack address list returns
2758  * 1 if found, 0 if not
2759  */
2760 static uint32_t
2761 sctp_addr_in_initack(struct sctp_tcb *stcb, struct mbuf *m, uint32_t offset,
2762     uint32_t length, struct sockaddr *sa)
2763 {
2764 	struct sctp_paramhdr tmp_param, *ph;
2765 	uint16_t plen, ptype;
2766 	struct sctp_ipv6addr_param addr_store;
2767 	struct sockaddr_in *sin;
2768 	struct sctp_ipv4addr_param *a4p;
2769 
2770 #ifdef INET6
2771 	struct sockaddr_in6 *sin6;
2772 	struct sctp_ipv6addr_param *a6p;
2773 	struct sockaddr_in6 sin6_tmp;
2774 
2775 #endif				/* INET6 */
2776 
2777 	if (
2778 #ifdef INET6
2779 	    (sa->sa_family != AF_INET6) &&
2780 #endif				/* INET6 */
2781 	    (sa->sa_family != AF_INET))
2782 		return (0);
2783 
2784 	SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2785 	SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2786 	/* convert to upper bound */
2787 	length += offset;
2788 
2789 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2790 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2791 		    "find_initack_addr: invalid offset?\n");
2792 		return (0);
2793 	}
2794 	/* go through the addresses in the init-ack */
2795 	ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2796 	    sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2797 	while (ph != NULL) {
2798 		ptype = ntohs(ph->param_type);
2799 		plen = ntohs(ph->param_length);
2800 #ifdef INET6
2801 		if (ptype == SCTP_IPV6_ADDRESS && sa->sa_family == AF_INET6) {
2802 			/* get the entire IPv6 address param */
2803 			a6p = (struct sctp_ipv6addr_param *)
2804 			    sctp_m_getptr(m, offset,
2805 			    sizeof(struct sctp_ipv6addr_param),
2806 			    (uint8_t *) & addr_store);
2807 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
2808 			    (ph == NULL) ||
2809 			    (a6p == NULL)) {
2810 				return (0);
2811 			}
2812 			sin6 = (struct sockaddr_in6 *)sa;
2813 			if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2814 				/* create a copy and clear scope */
2815 				memcpy(&sin6_tmp, sin6,
2816 				    sizeof(struct sockaddr_in6));
2817 				sin6 = &sin6_tmp;
2818 				in6_clearscope(&sin6->sin6_addr);
2819 			}
2820 			if (memcmp(&sin6->sin6_addr, a6p->addr,
2821 			    sizeof(struct in6_addr)) == 0) {
2822 				/* found it */
2823 				return (1);
2824 			}
2825 		} else
2826 #endif				/* INET6 */
2827 
2828 			if (ptype == SCTP_IPV4_ADDRESS &&
2829 		    sa->sa_family == AF_INET) {
2830 			/* get the entire IPv4 address param */
2831 			a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m,
2832 			    offset, sizeof(struct sctp_ipv4addr_param),
2833 			    (uint8_t *) & addr_store);
2834 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
2835 			    (ph == NULL) ||
2836 			    (a4p == NULL)) {
2837 				return (0);
2838 			}
2839 			sin = (struct sockaddr_in *)sa;
2840 			if (sin->sin_addr.s_addr == a4p->addr) {
2841 				/* found it */
2842 				return (1);
2843 			}
2844 		}
2845 		/* get next parameter */
2846 		offset += SCTP_SIZE32(plen);
2847 		if (offset + sizeof(struct sctp_paramhdr) > length)
2848 			return (0);
2849 		ph = (struct sctp_paramhdr *)
2850 		    sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2851 		    (uint8_t *) & tmp_param);
2852 	}			/* while */
2853 	/* not found! */
2854 	return (0);
2855 }
2856 
2857 /*
2858  * makes sure that the current endpoint local addr list is consistent with
2859  * the new association (eg. subset bound, asconf allowed) adds addresses as
2860  * necessary
2861  */
2862 static void
2863 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2864     int length, struct sockaddr *init_addr)
2865 {
2866 	struct sctp_laddr *laddr;
2867 
2868 	/* go through the endpoint list */
2869 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2870 		/* be paranoid and validate the laddr */
2871 		if (laddr->ifa == NULL) {
2872 			SCTPDBG(SCTP_DEBUG_ASCONF1,
2873 			    "check_addr_list_ep: laddr->ifa is NULL");
2874 			continue;
2875 		}
2876 		if (laddr->ifa == NULL) {
2877 			SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
2878 			continue;
2879 		}
2880 		/* do i have it implicitly? */
2881 		if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
2882 			continue;
2883 		}
2884 		/* check to see if in the init-ack */
2885 		if (!sctp_addr_in_initack(stcb, m, offset, length,
2886 		    &laddr->ifa->address.sa)) {
2887 			/* try to add it */
2888 			sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
2889 			    SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
2890 		}
2891 	}
2892 }
2893 
2894 /*
2895  * makes sure that the current kernel address list is consistent with the new
2896  * association (with all addrs bound) adds addresses as necessary
2897  */
2898 static void
2899 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2900     int length, struct sockaddr *init_addr,
2901     uint16_t local_scope, uint16_t site_scope,
2902     uint16_t ipv4_scope, uint16_t loopback_scope)
2903 {
2904 	struct sctp_vrf *vrf = NULL;
2905 	struct sctp_ifn *sctp_ifn;
2906 	struct sctp_ifa *sctp_ifa;
2907 	uint32_t vrf_id;
2908 
2909 	if (stcb) {
2910 		vrf_id = stcb->asoc.vrf_id;
2911 	} else {
2912 		return;
2913 	}
2914 	SCTP_IPI_ADDR_RLOCK();
2915 	vrf = sctp_find_vrf(vrf_id);
2916 	if (vrf == NULL) {
2917 		SCTP_IPI_ADDR_RUNLOCK();
2918 		return;
2919 	}
2920 	/* go through all our known interfaces */
2921 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2922 		if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2923 			/* skip loopback interface */
2924 			continue;
2925 		}
2926 		/* go through each interface address */
2927 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2928 			/* do i have it implicitly? */
2929 			if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
2930 				continue;
2931 			}
2932 			/* check to see if in the init-ack */
2933 			if (!sctp_addr_in_initack(stcb, m, offset, length,
2934 			    &sctp_ifa->address.sa)) {
2935 				/* try to add it */
2936 				sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
2937 				    sctp_ifa, SCTP_ADD_IP_ADDRESS,
2938 				    SCTP_ADDR_LOCKED);
2939 			}
2940 		}		/* end foreach ifa */
2941 	}			/* end foreach ifn */
2942 	SCTP_IPI_ADDR_RUNLOCK();
2943 }
2944 
2945 /*
2946  * validates an init-ack chunk (from a cookie-echo) with current addresses
2947  * adds addresses from the init-ack into our local address list, if needed
2948  * queues asconf adds/deletes addresses as needed and makes appropriate list
2949  * changes for source address selection m, offset: points to the start of the
2950  * address list in an init-ack chunk length: total length of the address
2951  * params only init_addr: address where my INIT-ACK was sent from
2952  */
2953 void
2954 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2955     int length, struct sockaddr *init_addr,
2956     uint16_t local_scope, uint16_t site_scope,
2957     uint16_t ipv4_scope, uint16_t loopback_scope)
2958 {
2959 	/* process the local addresses in the initack */
2960 	sctp_process_initack_addresses(stcb, m, offset, length);
2961 
2962 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2963 		/* bound all case */
2964 		sctp_check_address_list_all(stcb, m, offset, length, init_addr,
2965 		    local_scope, site_scope, ipv4_scope, loopback_scope);
2966 	} else {
2967 		/* subset bound case */
2968 		if (sctp_is_feature_on(stcb->sctp_ep,
2969 		    SCTP_PCB_FLAGS_DO_ASCONF)) {
2970 			/* asconf's allowed */
2971 			sctp_check_address_list_ep(stcb, m, offset, length,
2972 			    init_addr);
2973 		}
2974 		/* else, no asconfs allowed, so what we sent is what we get */
2975 	}
2976 }
2977 
2978 /*
2979  * sctp_bindx() support
2980  */
2981 uint32_t
2982 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
2983     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
2984 {
2985 	struct sctp_ifa *ifa;
2986 
2987 	if (sa->sa_len == 0) {
2988 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
2989 		return (EINVAL);
2990 	}
2991 	if (sctp_ifap) {
2992 		ifa = sctp_ifap;
2993 	} else if (type == SCTP_ADD_IP_ADDRESS) {
2994 		/* For an add the address MUST be on the system */
2995 		ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2996 	} else if (type == SCTP_DEL_IP_ADDRESS) {
2997 		/* For a delete we need to find it in the inp */
2998 		ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
2999 	} else {
3000 		ifa = NULL;
3001 	}
3002 	if (ifa != NULL) {
3003 		/* add this address */
3004 		struct sctp_asconf_iterator *asc;
3005 		struct sctp_laddr *wi;
3006 
3007 		SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3008 		    sizeof(struct sctp_asconf_iterator),
3009 		    SCTP_M_ASC_IT);
3010 		if (asc == NULL) {
3011 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3012 			return (ENOMEM);
3013 		}
3014 		wi = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr,
3015 		    struct sctp_laddr);
3016 		if (wi == NULL) {
3017 			SCTP_FREE(asc, SCTP_M_ASC_IT);
3018 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3019 			return (ENOMEM);
3020 		}
3021 		if (type == SCTP_ADD_IP_ADDRESS) {
3022 			sctp_add_local_addr_ep(inp, ifa, type);
3023 		} else if (type == SCTP_DEL_IP_ADDRESS) {
3024 			struct sctp_laddr *laddr;
3025 
3026 			if (inp->laddr_count < 2) {
3027 				/* can't delete the last local address */
3028 				SCTP_FREE(asc, SCTP_M_ASC_IT);
3029 				SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
3030 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3031 				return (EINVAL);
3032 			}
3033 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
3034 			    sctp_nxt_addr) {
3035 				if (ifa == laddr->ifa) {
3036 					/* Mark in the delete */
3037 					laddr->action = type;
3038 				}
3039 			}
3040 		}
3041 		LIST_INIT(&asc->list_of_work);
3042 		asc->cnt = 1;
3043 		SCTP_INCR_LADDR_COUNT();
3044 		wi->ifa = ifa;
3045 		wi->action = type;
3046 		atomic_add_int(&ifa->refcount, 1);
3047 		LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3048 		(void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3049 		    sctp_asconf_iterator_stcb,
3050 		    sctp_asconf_iterator_ep_end,
3051 		    SCTP_PCB_ANY_FLAGS,
3052 		    SCTP_PCB_ANY_FEATURES,
3053 		    SCTP_ASOC_ANY_STATE,
3054 		    (void *)asc, 0,
3055 		    sctp_asconf_iterator_end, inp, 0);
3056 	} else {
3057 		/* invalid address! */
3058 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3059 		return (EADDRNOTAVAIL);
3060 	}
3061 	return (0);
3062 }
3063