xref: /freebsd/sys/netinet/sctp_asconf.c (revision a2aef24aa3c8458e4036735dd6928b4ef77294e5)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * a) Redistributions of source code must retain the above copyright notice,
10  *    this list of conditions and the following disclaimer.
11  *
12  * b) Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in
14  *    the documentation and/or other materials provided with the distribution.
15  *
16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <netinet/sctp_var.h>
38 #include <netinet/sctp_sysctl.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctputil.h>
42 #include <netinet/sctp_output.h>
43 #include <netinet/sctp_asconf.h>
44 #include <netinet/sctp_timer.h>
45 
46 /*
47  * debug flags:
48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
49  * SCTP_DEBUG_ASCONF2: detailed info
50  */
51 
52 
53 /*
54  * RFC 5061
55  *
56  * An ASCONF parameter queue exists per asoc which holds the pending address
57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
58  *
59  * A restricted_addrs list exists per assoc to hold local addresses that are
60  * not (yet) usable by the assoc as a source address.  These addresses are
61  * either pending an ASCONF operation (and exist on the ASCONF parameter
62  * queue), or they are permanently restricted (the peer has returned an
63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
64  *
65  * Deleted addresses are always immediately removed from the lists as they will
66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
67  * only if allowed.
68  */
69 
70 /*
71  * ASCONF parameter processing.
72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
75  */
76 static struct mbuf *
77 sctp_asconf_success_response(uint32_t id)
78 {
79 	struct mbuf *m_reply = NULL;
80 	struct sctp_asconf_paramhdr *aph;
81 
82 	m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
83 	    0, M_NOWAIT, 1, MT_DATA);
84 	if (m_reply == NULL) {
85 		SCTPDBG(SCTP_DEBUG_ASCONF1,
86 		    "asconf_success_response: couldn't get mbuf!\n");
87 		return (NULL);
88 	}
89 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
90 	aph->correlation_id = id;
91 	aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
92 	aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
93 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
94 	aph->ph.param_length = htons(aph->ph.param_length);
95 
96 	return (m_reply);
97 }
98 
99 static struct mbuf *
100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
101     uint16_t tlv_length)
102 {
103 	struct mbuf *m_reply = NULL;
104 	struct sctp_asconf_paramhdr *aph;
105 	struct sctp_error_cause *error;
106 	uint8_t *tlv;
107 
108 	m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
109 	    tlv_length +
110 	    sizeof(struct sctp_error_cause)),
111 	    0, M_NOWAIT, 1, MT_DATA);
112 	if (m_reply == NULL) {
113 		SCTPDBG(SCTP_DEBUG_ASCONF1,
114 		    "asconf_error_response: couldn't get mbuf!\n");
115 		return (NULL);
116 	}
117 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
118 	error = (struct sctp_error_cause *)(aph + 1);
119 
120 	aph->correlation_id = id;
121 	aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
122 	error->code = htons(cause);
123 	error->length = tlv_length + sizeof(struct sctp_error_cause);
124 	aph->ph.param_length = error->length +
125 	    sizeof(struct sctp_asconf_paramhdr);
126 
127 	if (aph->ph.param_length > MLEN) {
128 		SCTPDBG(SCTP_DEBUG_ASCONF1,
129 		    "asconf_error_response: tlv_length (%xh) too big\n",
130 		    tlv_length);
131 		sctp_m_freem(m_reply);	/* discard */
132 		return (NULL);
133 	}
134 	if (error_tlv != NULL) {
135 		tlv = (uint8_t *)(error + 1);
136 		memcpy(tlv, error_tlv, tlv_length);
137 	}
138 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
139 	error->length = htons(error->length);
140 	aph->ph.param_length = htons(aph->ph.param_length);
141 
142 	return (m_reply);
143 }
144 
145 static struct mbuf *
146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
147     struct sctp_tcb *stcb, int send_hb, int response_required)
148 {
149 	struct sctp_nets *net;
150 	struct mbuf *m_reply = NULL;
151 	union sctp_sockstore store;
152 	struct sctp_paramhdr *ph;
153 	uint16_t param_type, aparam_length;
154 #if defined(INET) || defined(INET6)
155 	uint16_t param_length;
156 #endif
157 	struct sockaddr *sa;
158 	int zero_address = 0;
159 	int bad_address = 0;
160 #ifdef INET
161 	struct sockaddr_in *sin;
162 	struct sctp_ipv4addr_param *v4addr;
163 #endif
164 #ifdef INET6
165 	struct sockaddr_in6 *sin6;
166 	struct sctp_ipv6addr_param *v6addr;
167 #endif
168 
169 	aparam_length = ntohs(aph->ph.param_length);
170 	ph = (struct sctp_paramhdr *)(aph + 1);
171 	param_type = ntohs(ph->param_type);
172 #if defined(INET) || defined(INET6)
173 	param_length = ntohs(ph->param_length);
174 #endif
175 	sa = &store.sa;
176 	switch (param_type) {
177 #ifdef INET
178 	case SCTP_IPV4_ADDRESS:
179 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
180 			/* invalid param size */
181 			return (NULL);
182 		}
183 		v4addr = (struct sctp_ipv4addr_param *)ph;
184 		sin = &store.sin;
185 		memset(sin, 0, sizeof(*sin));
186 		sin->sin_family = AF_INET;
187 		sin->sin_len = sizeof(struct sockaddr_in);
188 		sin->sin_port = stcb->rport;
189 		sin->sin_addr.s_addr = v4addr->addr;
190 		if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
191 		    IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
192 			bad_address = 1;
193 		}
194 		if (sin->sin_addr.s_addr == INADDR_ANY)
195 			zero_address = 1;
196 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
197 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
198 		break;
199 #endif
200 #ifdef INET6
201 	case SCTP_IPV6_ADDRESS:
202 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
203 			/* invalid param size */
204 			return (NULL);
205 		}
206 		v6addr = (struct sctp_ipv6addr_param *)ph;
207 		sin6 = &store.sin6;
208 		memset(sin6, 0, sizeof(*sin6));
209 		sin6->sin6_family = AF_INET6;
210 		sin6->sin6_len = sizeof(struct sockaddr_in6);
211 		sin6->sin6_port = stcb->rport;
212 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
213 		    sizeof(struct in6_addr));
214 		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
215 			bad_address = 1;
216 		}
217 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
218 			zero_address = 1;
219 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
220 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
221 		break;
222 #endif
223 	default:
224 		m_reply = sctp_asconf_error_response(aph->correlation_id,
225 		    SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
226 		    aparam_length);
227 		return (m_reply);
228 	}			/* end switch */
229 
230 	/* if 0.0.0.0/::0, add the source address instead */
231 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
232 		sa = src;
233 		SCTPDBG(SCTP_DEBUG_ASCONF1,
234 		    "process_asconf_add_ip: using source addr ");
235 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
236 	}
237 	/* add the address */
238 	if (bad_address) {
239 		m_reply = sctp_asconf_error_response(aph->correlation_id,
240 		    SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
241 		    aparam_length);
242 	} else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
243 		    SCTP_DONOT_SETSCOPE,
244 	    SCTP_ADDR_DYNAMIC_ADDED) != 0) {
245 		SCTPDBG(SCTP_DEBUG_ASCONF1,
246 		    "process_asconf_add_ip: error adding address\n");
247 		m_reply = sctp_asconf_error_response(aph->correlation_id,
248 		    SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
249 		    aparam_length);
250 	} else {
251 		/* notify upper layer */
252 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
253 		if (response_required) {
254 			m_reply =
255 			    sctp_asconf_success_response(aph->correlation_id);
256 		}
257 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
258 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
259 		    stcb, net);
260 		if (send_hb) {
261 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
262 		}
263 	}
264 	return (m_reply);
265 }
266 
267 static int
268 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
269 {
270 	struct sctp_nets *src_net, *net;
271 
272 	/* make sure the source address exists as a destination net */
273 	src_net = sctp_findnet(stcb, src);
274 	if (src_net == NULL) {
275 		/* not found */
276 		return (-1);
277 	}
278 	/* delete all destination addresses except the source */
279 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
280 		if (net != src_net) {
281 			/* delete this address */
282 			sctp_remove_net(stcb, net);
283 			SCTPDBG(SCTP_DEBUG_ASCONF1,
284 			    "asconf_del_remote_addrs_except: deleting ");
285 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
286 			    (struct sockaddr *)&net->ro._l_addr);
287 			/* notify upper layer */
288 			sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
289 			    (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
290 		}
291 	}
292 	return (0);
293 }
294 
295 static struct mbuf *
296 sctp_process_asconf_delete_ip(struct sockaddr *src,
297     struct sctp_asconf_paramhdr *aph,
298     struct sctp_tcb *stcb, int response_required)
299 {
300 	struct mbuf *m_reply = NULL;
301 	union sctp_sockstore store;
302 	struct sctp_paramhdr *ph;
303 	uint16_t param_type, aparam_length;
304 #if defined(INET) || defined(INET6)
305 	uint16_t param_length;
306 #endif
307 	struct sockaddr *sa;
308 	int zero_address = 0;
309 	int result;
310 #ifdef INET
311 	struct sockaddr_in *sin;
312 	struct sctp_ipv4addr_param *v4addr;
313 #endif
314 #ifdef INET6
315 	struct sockaddr_in6 *sin6;
316 	struct sctp_ipv6addr_param *v6addr;
317 #endif
318 
319 	aparam_length = ntohs(aph->ph.param_length);
320 	ph = (struct sctp_paramhdr *)(aph + 1);
321 	param_type = ntohs(ph->param_type);
322 #if defined(INET) || defined(INET6)
323 	param_length = ntohs(ph->param_length);
324 #endif
325 	sa = &store.sa;
326 	switch (param_type) {
327 #ifdef INET
328 	case SCTP_IPV4_ADDRESS:
329 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
330 			/* invalid param size */
331 			return (NULL);
332 		}
333 		v4addr = (struct sctp_ipv4addr_param *)ph;
334 		sin = &store.sin;
335 		memset(sin, 0, sizeof(*sin));
336 		sin->sin_family = AF_INET;
337 		sin->sin_len = sizeof(struct sockaddr_in);
338 		sin->sin_port = stcb->rport;
339 		sin->sin_addr.s_addr = v4addr->addr;
340 		if (sin->sin_addr.s_addr == INADDR_ANY)
341 			zero_address = 1;
342 		SCTPDBG(SCTP_DEBUG_ASCONF1,
343 		    "process_asconf_delete_ip: deleting ");
344 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
345 		break;
346 #endif
347 #ifdef INET6
348 	case SCTP_IPV6_ADDRESS:
349 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
350 			/* invalid param size */
351 			return (NULL);
352 		}
353 		v6addr = (struct sctp_ipv6addr_param *)ph;
354 		sin6 = &store.sin6;
355 		memset(sin6, 0, sizeof(*sin6));
356 		sin6->sin6_family = AF_INET6;
357 		sin6->sin6_len = sizeof(struct sockaddr_in6);
358 		sin6->sin6_port = stcb->rport;
359 		memcpy(&sin6->sin6_addr, v6addr->addr,
360 		    sizeof(struct in6_addr));
361 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
362 			zero_address = 1;
363 		SCTPDBG(SCTP_DEBUG_ASCONF1,
364 		    "process_asconf_delete_ip: deleting ");
365 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
366 		break;
367 #endif
368 	default:
369 		m_reply = sctp_asconf_error_response(aph->correlation_id,
370 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
371 		    aparam_length);
372 		return (m_reply);
373 	}
374 
375 	/* make sure the source address is not being deleted */
376 	if (sctp_cmpaddr(sa, src)) {
377 		/* trying to delete the source address! */
378 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
379 		m_reply = sctp_asconf_error_response(aph->correlation_id,
380 		    SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
381 		    aparam_length);
382 		return (m_reply);
383 	}
384 	/* if deleting 0.0.0.0/::0, delete all addresses except src addr */
385 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
386 		result = sctp_asconf_del_remote_addrs_except(stcb, src);
387 
388 		if (result) {
389 			/* src address did not exist? */
390 			SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
391 			/* what error to reply with?? */
392 			m_reply =
393 			    sctp_asconf_error_response(aph->correlation_id,
394 			    SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
395 			    aparam_length);
396 		} else if (response_required) {
397 			m_reply =
398 			    sctp_asconf_success_response(aph->correlation_id);
399 		}
400 		return (m_reply);
401 	}
402 	/* delete the address */
403 	result = sctp_del_remote_addr(stcb, sa);
404 	/*
405 	 * note if result == -2, the address doesn't exist in the asoc but
406 	 * since it's being deleted anyways, we just ack the delete -- but
407 	 * this probably means something has already gone awry
408 	 */
409 	if (result == -1) {
410 		/* only one address in the asoc */
411 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
412 		m_reply = sctp_asconf_error_response(aph->correlation_id,
413 		    SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
414 		    aparam_length);
415 	} else {
416 		if (response_required) {
417 			m_reply = sctp_asconf_success_response(aph->correlation_id);
418 		}
419 		/* notify upper layer */
420 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
421 	}
422 	return (m_reply);
423 }
424 
425 static struct mbuf *
426 sctp_process_asconf_set_primary(struct sockaddr *src,
427     struct sctp_asconf_paramhdr *aph,
428     struct sctp_tcb *stcb, int response_required)
429 {
430 	struct mbuf *m_reply = NULL;
431 	union sctp_sockstore store;
432 	struct sctp_paramhdr *ph;
433 	uint16_t param_type, aparam_length;
434 #if defined(INET) || defined(INET6)
435 	uint16_t param_length;
436 #endif
437 	struct sockaddr *sa;
438 	int zero_address = 0;
439 #ifdef INET
440 	struct sockaddr_in *sin;
441 	struct sctp_ipv4addr_param *v4addr;
442 #endif
443 #ifdef INET6
444 	struct sockaddr_in6 *sin6;
445 	struct sctp_ipv6addr_param *v6addr;
446 #endif
447 
448 	aparam_length = ntohs(aph->ph.param_length);
449 	ph = (struct sctp_paramhdr *)(aph + 1);
450 	param_type = ntohs(ph->param_type);
451 #if defined(INET) || defined(INET6)
452 	param_length = ntohs(ph->param_length);
453 #endif
454 	sa = &store.sa;
455 	switch (param_type) {
456 #ifdef INET
457 	case SCTP_IPV4_ADDRESS:
458 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
459 			/* invalid param size */
460 			return (NULL);
461 		}
462 		v4addr = (struct sctp_ipv4addr_param *)ph;
463 		sin = &store.sin;
464 		memset(sin, 0, sizeof(*sin));
465 		sin->sin_family = AF_INET;
466 		sin->sin_len = sizeof(struct sockaddr_in);
467 		sin->sin_addr.s_addr = v4addr->addr;
468 		if (sin->sin_addr.s_addr == INADDR_ANY)
469 			zero_address = 1;
470 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
471 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
472 		break;
473 #endif
474 #ifdef INET6
475 	case SCTP_IPV6_ADDRESS:
476 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
477 			/* invalid param size */
478 			return (NULL);
479 		}
480 		v6addr = (struct sctp_ipv6addr_param *)ph;
481 		sin6 = &store.sin6;
482 		memset(sin6, 0, sizeof(*sin6));
483 		sin6->sin6_family = AF_INET6;
484 		sin6->sin6_len = sizeof(struct sockaddr_in6);
485 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
486 		    sizeof(struct in6_addr));
487 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
488 			zero_address = 1;
489 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
490 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
491 		break;
492 #endif
493 	default:
494 		m_reply = sctp_asconf_error_response(aph->correlation_id,
495 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
496 		    aparam_length);
497 		return (m_reply);
498 	}
499 
500 	/* if 0.0.0.0/::0, use the source address instead */
501 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
502 		sa = src;
503 		SCTPDBG(SCTP_DEBUG_ASCONF1,
504 		    "process_asconf_set_primary: using source addr ");
505 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
506 	}
507 	/* set the primary address */
508 	if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
509 		SCTPDBG(SCTP_DEBUG_ASCONF1,
510 		    "process_asconf_set_primary: primary address set\n");
511 		/* notify upper layer */
512 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
513 		if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
514 		    (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
515 		    (stcb->asoc.alternate)) {
516 			sctp_free_remote_addr(stcb->asoc.alternate);
517 			stcb->asoc.alternate = NULL;
518 		}
519 		if (response_required) {
520 			m_reply = sctp_asconf_success_response(aph->correlation_id);
521 		}
522 		/*
523 		 * Mobility adaptation. Ideally, when the reception of SET
524 		 * PRIMARY with DELETE IP ADDRESS of the previous primary
525 		 * destination, unacknowledged DATA are retransmitted
526 		 * immediately to the new primary destination for seamless
527 		 * handover. If the destination is UNCONFIRMED and marked to
528 		 * REQ_PRIM, The retransmission occur when reception of the
529 		 * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
530 		 * sctp_input.c) Also, when change of the primary
531 		 * destination, it is better that all subsequent new DATA
532 		 * containing already queued DATA are transmitted to the new
533 		 * primary destination. (by micchie)
534 		 */
535 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
536 		    SCTP_MOBILITY_BASE) ||
537 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
538 		    SCTP_MOBILITY_FASTHANDOFF)) &&
539 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
540 		    SCTP_MOBILITY_PRIM_DELETED) &&
541 		    (stcb->asoc.primary_destination->dest_state &
542 		    SCTP_ADDR_UNCONFIRMED) == 0) {
543 
544 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
545 			    stcb->sctp_ep, stcb, NULL,
546 			    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
547 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
548 			    SCTP_MOBILITY_FASTHANDOFF)) {
549 				sctp_assoc_immediate_retrans(stcb,
550 				    stcb->asoc.primary_destination);
551 			}
552 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
553 			    SCTP_MOBILITY_BASE)) {
554 				sctp_move_chunks_from_net(stcb,
555 				    stcb->asoc.deleted_primary);
556 			}
557 			sctp_delete_prim_timer(stcb->sctp_ep, stcb,
558 			    stcb->asoc.deleted_primary);
559 		}
560 	} else {
561 		/* couldn't set the requested primary address! */
562 		SCTPDBG(SCTP_DEBUG_ASCONF1,
563 		    "process_asconf_set_primary: set primary failed!\n");
564 		/* must have been an invalid address, so report */
565 		m_reply = sctp_asconf_error_response(aph->correlation_id,
566 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
567 		    aparam_length);
568 	}
569 
570 	return (m_reply);
571 }
572 
573 /*
574  * handles an ASCONF chunk.
575  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
576  */
577 void
578 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
579     struct sockaddr *src,
580     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
581     int first)
582 {
583 	struct sctp_association *asoc;
584 	uint32_t serial_num;
585 	struct mbuf *n, *m_ack, *m_result, *m_tail;
586 	struct sctp_asconf_ack_chunk *ack_cp;
587 	struct sctp_asconf_paramhdr *aph;
588 	struct sctp_ipv6addr_param *p_addr;
589 	unsigned int asconf_limit, cnt;
590 	int error = 0;		/* did an error occur? */
591 
592 	/* asconf param buffer */
593 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
594 	struct sctp_asconf_ack *ack, *ack_next;
595 
596 	/* verify minimum length */
597 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
598 		SCTPDBG(SCTP_DEBUG_ASCONF1,
599 		    "handle_asconf: chunk too small = %xh\n",
600 		    ntohs(cp->ch.chunk_length));
601 		return;
602 	}
603 	asoc = &stcb->asoc;
604 	serial_num = ntohl(cp->serial_number);
605 
606 	if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
607 		/* got a duplicate ASCONF */
608 		SCTPDBG(SCTP_DEBUG_ASCONF1,
609 		    "handle_asconf: got duplicate serial number = %xh\n",
610 		    serial_num);
611 		return;
612 	} else if (serial_num != (asoc->asconf_seq_in + 1)) {
613 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
614 		    serial_num, asoc->asconf_seq_in + 1);
615 		return;
616 	}
617 	/* it's the expected "next" sequence number, so process it */
618 	asoc->asconf_seq_in = serial_num;	/* update sequence */
619 	/* get length of all the param's in the ASCONF */
620 	asconf_limit = offset + ntohs(cp->ch.chunk_length);
621 	SCTPDBG(SCTP_DEBUG_ASCONF1,
622 	    "handle_asconf: asconf_limit=%u, sequence=%xh\n",
623 	    asconf_limit, serial_num);
624 
625 	if (first) {
626 		/* delete old cache */
627 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
628 
629 		TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
630 			if (ack->serial_number == serial_num)
631 				break;
632 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
633 			    ack->serial_number, serial_num);
634 			TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
635 			if (ack->data != NULL) {
636 				sctp_m_freem(ack->data);
637 			}
638 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
639 		}
640 	}
641 	m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
642 	    M_NOWAIT, 1, MT_DATA);
643 	if (m_ack == NULL) {
644 		SCTPDBG(SCTP_DEBUG_ASCONF1,
645 		    "handle_asconf: couldn't get mbuf!\n");
646 		return;
647 	}
648 	m_tail = m_ack;		/* current reply chain's tail */
649 
650 	/* fill in ASCONF-ACK header */
651 	ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
652 	ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
653 	ack_cp->ch.chunk_flags = 0;
654 	ack_cp->serial_number = htonl(serial_num);
655 	/* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
656 	SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
657 	ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
658 
659 	/* skip the lookup address parameter */
660 	offset += sizeof(struct sctp_asconf_chunk);
661 	p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
662 	if (p_addr == NULL) {
663 		SCTPDBG(SCTP_DEBUG_ASCONF1,
664 		    "handle_asconf: couldn't get lookup addr!\n");
665 		/* respond with a missing/invalid mandatory parameter error */
666 		return;
667 	}
668 	/* param_length is already validated in process_control... */
669 	offset += ntohs(p_addr->ph.param_length);	/* skip lookup addr */
670 	/* get pointer to first asconf param in ASCONF */
671 	aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
672 	if (aph == NULL) {
673 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
674 		goto send_reply;
675 	}
676 	/* process through all parameters */
677 	cnt = 0;
678 	while (aph != NULL) {
679 		unsigned int param_length, param_type;
680 
681 		param_type = ntohs(aph->ph.param_type);
682 		param_length = ntohs(aph->ph.param_length);
683 		if (offset + param_length > asconf_limit) {
684 			/* parameter goes beyond end of chunk! */
685 			sctp_m_freem(m_ack);
686 			return;
687 		}
688 		m_result = NULL;
689 
690 		if (param_length > sizeof(aparam_buf)) {
691 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
692 			sctp_m_freem(m_ack);
693 			return;
694 		}
695 		if (param_length <= sizeof(struct sctp_paramhdr)) {
696 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
697 			sctp_m_freem(m_ack);
698 		}
699 		/* get the entire parameter */
700 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
701 		if (aph == NULL) {
702 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
703 			sctp_m_freem(m_ack);
704 			return;
705 		}
706 		switch (param_type) {
707 		case SCTP_ADD_IP_ADDRESS:
708 			m_result = sctp_process_asconf_add_ip(src, aph, stcb,
709 			    (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
710 			cnt++;
711 			break;
712 		case SCTP_DEL_IP_ADDRESS:
713 			m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
714 			    error);
715 			break;
716 		case SCTP_ERROR_CAUSE_IND:
717 			/* not valid in an ASCONF chunk */
718 			break;
719 		case SCTP_SET_PRIM_ADDR:
720 			m_result = sctp_process_asconf_set_primary(src, aph,
721 			    stcb, error);
722 			break;
723 		case SCTP_NAT_VTAGS:
724 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
725 			break;
726 		case SCTP_SUCCESS_REPORT:
727 			/* not valid in an ASCONF chunk */
728 			break;
729 		case SCTP_ULP_ADAPTATION:
730 			/* FIX */
731 			break;
732 		default:
733 			if ((param_type & 0x8000) == 0) {
734 				/* Been told to STOP at this param */
735 				asconf_limit = offset;
736 				/*
737 				 * FIX FIX - We need to call
738 				 * sctp_arethere_unrecognized_parameters()
739 				 * to get a operr and send it for any
740 				 * param's with the 0x4000 bit set OR do it
741 				 * here ourselves... note we still must STOP
742 				 * if the 0x8000 bit is clear.
743 				 */
744 			}
745 			/* unknown/invalid param type */
746 			break;
747 		}		/* switch */
748 
749 		/* add any (error) result to the reply mbuf chain */
750 		if (m_result != NULL) {
751 			SCTP_BUF_NEXT(m_tail) = m_result;
752 			m_tail = m_result;
753 			/* update lengths, make sure it's aligned too */
754 			SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
755 			ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
756 			/* set flag to force success reports */
757 			error = 1;
758 		}
759 		offset += SCTP_SIZE32(param_length);
760 		/* update remaining ASCONF message length to process */
761 		if (offset >= asconf_limit) {
762 			/* no more data in the mbuf chain */
763 			break;
764 		}
765 		/* get pointer to next asconf param */
766 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
767 		    sizeof(struct sctp_asconf_paramhdr),
768 		    (uint8_t *)&aparam_buf);
769 		if (aph == NULL) {
770 			/* can't get an asconf paramhdr */
771 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
772 			/* FIX ME - add error here... */
773 		}
774 	}
775 
776 send_reply:
777 	ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
778 	/* save the ASCONF-ACK reply */
779 	ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
780 	    struct sctp_asconf_ack);
781 	if (ack == NULL) {
782 		sctp_m_freem(m_ack);
783 		return;
784 	}
785 	ack->serial_number = serial_num;
786 	ack->last_sent_to = NULL;
787 	ack->data = m_ack;
788 	ack->len = 0;
789 	for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
790 		ack->len += SCTP_BUF_LEN(n);
791 	}
792 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
793 
794 	/* see if last_control_chunk_from is set properly (use IP src addr) */
795 	if (stcb->asoc.last_control_chunk_from == NULL) {
796 		/*
797 		 * this could happen if the source address was just newly
798 		 * added
799 		 */
800 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
801 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
802 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
803 		/* look up the from address */
804 		stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
805 #ifdef SCTP_DEBUG
806 		if (stcb->asoc.last_control_chunk_from == NULL) {
807 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
808 		}
809 #endif
810 	}
811 }
812 
813 /*
814  * does the address match? returns 0 if not, 1 if so
815  */
816 static uint32_t
817 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
818 {
819 	switch (sa->sa_family) {
820 #ifdef INET6
821 	case AF_INET6:
822 		{
823 			/* XXX scopeid */
824 			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
825 
826 			if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
827 			    (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
828 			    sizeof(struct in6_addr)) == 0)) {
829 				return (1);
830 			}
831 			break;
832 		}
833 #endif
834 #ifdef INET
835 	case AF_INET:
836 		{
837 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
838 
839 			if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
840 			    (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
841 			    sizeof(struct in_addr)) == 0)) {
842 				return (1);
843 			}
844 			break;
845 		}
846 #endif
847 	default:
848 		break;
849 	}
850 	return (0);
851 }
852 
853 /*
854  * does the address match? returns 0 if not, 1 if so
855  */
856 static uint32_t
857 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
858 {
859 #if defined(INET) || defined(INET6)
860 	uint16_t param_type, param_length;
861 
862 	param_type = ntohs(ph->param_type);
863 	param_length = ntohs(ph->param_length);
864 #endif
865 	switch (sa->sa_family) {
866 #ifdef INET6
867 	case AF_INET6:
868 		{
869 			/* XXX scopeid */
870 			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
871 			struct sctp_ipv6addr_param *v6addr;
872 
873 			v6addr = (struct sctp_ipv6addr_param *)ph;
874 			if ((param_type == SCTP_IPV6_ADDRESS) &&
875 			    (param_length == sizeof(struct sctp_ipv6addr_param)) &&
876 			    (memcmp(&v6addr->addr, &sin6->sin6_addr,
877 			    sizeof(struct in6_addr)) == 0)) {
878 				return (1);
879 			}
880 			break;
881 		}
882 #endif
883 #ifdef INET
884 	case AF_INET:
885 		{
886 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
887 			struct sctp_ipv4addr_param *v4addr;
888 
889 			v4addr = (struct sctp_ipv4addr_param *)ph;
890 			if ((param_type == SCTP_IPV4_ADDRESS) &&
891 			    (param_length == sizeof(struct sctp_ipv4addr_param)) &&
892 			    (memcmp(&v4addr->addr, &sin->sin_addr,
893 			    sizeof(struct in_addr)) == 0)) {
894 				return (1);
895 			}
896 			break;
897 		}
898 #endif
899 	default:
900 		break;
901 	}
902 	return (0);
903 }
904 
905 /*
906  * Cleanup for non-responded/OP ERR'd ASCONF
907  */
908 void
909 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
910 {
911 	/*
912 	 * clear out any existing asconfs going out
913 	 */
914 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
915 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
916 	stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
917 	/* remove the old ASCONF on our outbound queue */
918 	sctp_toss_old_asconf(stcb);
919 }
920 
921 /*
922  * cleanup any cached source addresses that may be topologically
923  * incorrect after a new address has been added to this interface.
924  */
925 static void
926 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
927 {
928 	struct sctp_nets *net;
929 
930 	/*
931 	 * Ideally, we want to only clear cached routes and source addresses
932 	 * that are topologically incorrect.  But since there is no easy way
933 	 * to know whether the newly added address on the ifn would cause a
934 	 * routing change (i.e. a new egress interface would be chosen)
935 	 * without doing a new routing lookup and source address selection,
936 	 * we will (for now) just flush any cached route using a different
937 	 * ifn (and cached source addrs) and let output re-choose them
938 	 * during the next send on that net.
939 	 */
940 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
941 		/*
942 		 * clear any cached route (and cached source address) if the
943 		 * route's interface is NOT the same as the address change.
944 		 * If it's the same interface, just clear the cached source
945 		 * address.
946 		 */
947 		if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
948 		    ((ifn == NULL) ||
949 		    (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
950 			/* clear any cached route */
951 			RTFREE(net->ro.ro_rt);
952 			net->ro.ro_rt = NULL;
953 		}
954 		/* clear any cached source address */
955 		if (net->src_addr_selected) {
956 			sctp_free_ifa(net->ro._s_addr);
957 			net->ro._s_addr = NULL;
958 			net->src_addr_selected = 0;
959 		}
960 	}
961 }
962 
963 
964 void
965 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
966 {
967 	int error;
968 
969 	if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
970 		return;
971 	}
972 	if (stcb->asoc.deleted_primary == NULL) {
973 		return;
974 	}
975 	if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
976 		SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
977 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
978 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
979 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
980 		sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
981 		    stcb->asoc.deleted_primary,
982 		    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
983 		stcb->asoc.num_send_timers_up--;
984 		if (stcb->asoc.num_send_timers_up < 0) {
985 			stcb->asoc.num_send_timers_up = 0;
986 		}
987 		SCTP_TCB_LOCK_ASSERT(stcb);
988 		error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
989 		    stcb->asoc.deleted_primary);
990 		if (error) {
991 			SCTP_INP_DECR_REF(stcb->sctp_ep);
992 			return;
993 		}
994 		SCTP_TCB_LOCK_ASSERT(stcb);
995 #ifdef SCTP_AUDITING_ENABLED
996 		sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
997 #endif
998 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
999 		if ((stcb->asoc.num_send_timers_up == 0) &&
1000 		    (stcb->asoc.sent_queue_cnt > 0)) {
1001 			struct sctp_tmit_chunk *chk;
1002 
1003 			chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1004 			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1005 			    stcb, chk->whoTo);
1006 		}
1007 	}
1008 	return;
1009 }
1010 
1011 static int
1012     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1013 
1014 void
1015 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1016 {
1017 	struct sctp_tmit_chunk *chk;
1018 
1019 	SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1020 	sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1021 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1022 	stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1023 	net->error_count = 0;
1024 	TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1025 		if (chk->whoTo == net) {
1026 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
1027 				chk->sent = SCTP_DATAGRAM_RESEND;
1028 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1029 				sctp_flight_size_decrease(chk);
1030 				sctp_total_flight_decrease(stcb, chk);
1031 				net->marked_retrans++;
1032 				stcb->asoc.marked_retrans++;
1033 			}
1034 		}
1035 	}
1036 	if (net->marked_retrans) {
1037 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1038 	}
1039 }
1040 
1041 static void
1042 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1043 {
1044 	struct sctp_nets *net;
1045 	int addrnum, changed;
1046 
1047 	/*
1048 	 * If number of local valid addresses is 1, the valid address is
1049 	 * probably newly added address. Several valid addresses in this
1050 	 * association.  A source address may not be changed.  Additionally,
1051 	 * they can be configured on a same interface as "alias" addresses.
1052 	 * (by micchie)
1053 	 */
1054 	addrnum = sctp_local_addr_count(stcb);
1055 	SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1056 	    addrnum);
1057 	if (addrnum == 1) {
1058 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1059 			/* clear any cached route and source address */
1060 			if (net->ro.ro_rt) {
1061 				RTFREE(net->ro.ro_rt);
1062 				net->ro.ro_rt = NULL;
1063 			}
1064 			if (net->src_addr_selected) {
1065 				sctp_free_ifa(net->ro._s_addr);
1066 				net->ro._s_addr = NULL;
1067 				net->src_addr_selected = 0;
1068 			}
1069 			/* Retransmit unacknowledged DATA chunks immediately */
1070 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1071 			    SCTP_MOBILITY_FASTHANDOFF)) {
1072 				sctp_net_immediate_retrans(stcb, net);
1073 			}
1074 			/* also, SET PRIMARY is maybe already sent */
1075 		}
1076 		return;
1077 	}
1078 	/* Multiple local addresses exsist in the association.  */
1079 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1080 		/* clear any cached route and source address */
1081 		if (net->ro.ro_rt) {
1082 			RTFREE(net->ro.ro_rt);
1083 			net->ro.ro_rt = NULL;
1084 		}
1085 		if (net->src_addr_selected) {
1086 			sctp_free_ifa(net->ro._s_addr);
1087 			net->ro._s_addr = NULL;
1088 			net->src_addr_selected = 0;
1089 		}
1090 		/*
1091 		 * Check if the nexthop is corresponding to the new address.
1092 		 * If the new address is corresponding to the current
1093 		 * nexthop, the path will be changed. If the new address is
1094 		 * NOT corresponding to the current nexthop, the path will
1095 		 * not be changed.
1096 		 */
1097 		SCTP_RTALLOC((sctp_route_t *)&net->ro,
1098 		    stcb->sctp_ep->def_vrf_id,
1099 		    stcb->sctp_ep->fibnum);
1100 		if (net->ro.ro_rt == NULL)
1101 			continue;
1102 
1103 		changed = 0;
1104 		switch (net->ro._l_addr.sa.sa_family) {
1105 #ifdef INET
1106 		case AF_INET:
1107 			if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1108 				changed = 1;
1109 			}
1110 			break;
1111 #endif
1112 #ifdef INET6
1113 		case AF_INET6:
1114 			if (sctp_v6src_match_nexthop(
1115 			    &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1116 				changed = 1;
1117 			}
1118 			break;
1119 #endif
1120 		default:
1121 			break;
1122 		}
1123 		/*
1124 		 * if the newly added address does not relate routing
1125 		 * information, we skip.
1126 		 */
1127 		if (changed == 0)
1128 			continue;
1129 		/* Retransmit unacknowledged DATA chunks immediately */
1130 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1131 		    SCTP_MOBILITY_FASTHANDOFF)) {
1132 			sctp_net_immediate_retrans(stcb, net);
1133 		}
1134 		/* Send SET PRIMARY for this new address */
1135 		if (net == stcb->asoc.primary_destination) {
1136 			(void)sctp_asconf_queue_mgmt(stcb, newifa,
1137 			    SCTP_SET_PRIM_ADDR);
1138 		}
1139 	}
1140 }
1141 
1142 /*
1143  * process an ADD/DELETE IP ack from peer.
1144  * addr: corresponding sctp_ifa to the address being added/deleted.
1145  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1146  * flag: 1=success, 0=failure.
1147  */
1148 static void
1149 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1150 {
1151 	/*
1152 	 * do the necessary asoc list work- if we get a failure indication,
1153 	 * leave the address on the assoc's restricted list.  If we get a
1154 	 * success indication, remove the address from the restricted list.
1155 	 */
1156 	/*
1157 	 * Note: this will only occur for ADD_IP_ADDRESS, since
1158 	 * DEL_IP_ADDRESS is never actually added to the list...
1159 	 */
1160 	if (flag) {
1161 		/* success case, so remove from the restricted list */
1162 		sctp_del_local_addr_restricted(stcb, addr);
1163 
1164 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1165 		    SCTP_MOBILITY_BASE) ||
1166 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
1167 		    SCTP_MOBILITY_FASTHANDOFF)) {
1168 			sctp_path_check_and_react(stcb, addr);
1169 			return;
1170 		}
1171 		/* clear any cached/topologically incorrect source addresses */
1172 		sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1173 	}
1174 	/* else, leave it on the list */
1175 }
1176 
1177 /*
1178  * add an asconf add/delete/set primary IP address parameter to the queue.
1179  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1180  * returns 0 if queued, -1 if not queued/removed.
1181  * NOTE: if adding, but a delete for the same address is already scheduled
1182  * (and not yet sent out), simply remove it from queue.  Same for deleting
1183  * an address already scheduled for add.  If a duplicate operation is found,
1184  * ignore the new one.
1185  */
1186 static int
1187 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1188     uint16_t type)
1189 {
1190 	struct sctp_asconf_addr *aa, *aa_next;
1191 
1192 	/* make sure the request isn't already in the queue */
1193 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1194 		/* address match? */
1195 		if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1196 			continue;
1197 		/*
1198 		 * is the request already in queue but not sent? pass the
1199 		 * request already sent in order to resolve the following
1200 		 * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1201 		 * can't remove the ADD request already sent 3. arrival of
1202 		 * ADD
1203 		 */
1204 		if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1205 			return (-1);
1206 		}
1207 		/* is the negative request already in queue, and not sent */
1208 		if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1209 		    (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1210 			/* add requested, delete already queued */
1211 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1212 			/* remove the ifa from the restricted list */
1213 			sctp_del_local_addr_restricted(stcb, ifa);
1214 			/* free the asconf param */
1215 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1216 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1217 			return (-1);
1218 		}
1219 		if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1220 		    (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1221 			/* delete requested, add already queued */
1222 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1223 			/* remove the aa->ifa from the restricted list */
1224 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1225 			/* free the asconf param */
1226 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1227 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1228 			return (-1);
1229 		}
1230 	}			/* for each aa */
1231 
1232 	/* adding new request to the queue */
1233 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1234 	    SCTP_M_ASC_ADDR);
1235 	if (aa == NULL) {
1236 		/* didn't get memory */
1237 		SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1238 		return (-1);
1239 	}
1240 	aa->special_del = 0;
1241 	/* fill in asconf address parameter fields */
1242 	/* top level elements are "networked" during send */
1243 	aa->ap.aph.ph.param_type = type;
1244 	aa->ifa = ifa;
1245 	atomic_add_int(&ifa->refcount, 1);
1246 	/* correlation_id filled in during send routine later... */
1247 	switch (ifa->address.sa.sa_family) {
1248 #ifdef INET6
1249 	case AF_INET6:
1250 		{
1251 			struct sockaddr_in6 *sin6;
1252 
1253 			sin6 = &ifa->address.sin6;
1254 			aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1255 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1256 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1257 			    sizeof(struct sctp_ipv6addr_param);
1258 			memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1259 			    sizeof(struct in6_addr));
1260 			break;
1261 		}
1262 #endif
1263 #ifdef INET
1264 	case AF_INET:
1265 		{
1266 			struct sockaddr_in *sin;
1267 
1268 			sin = &ifa->address.sin;
1269 			aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1270 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1271 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1272 			    sizeof(struct sctp_ipv4addr_param);
1273 			memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1274 			    sizeof(struct in_addr));
1275 			break;
1276 		}
1277 #endif
1278 	default:
1279 		/* invalid family! */
1280 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1281 		sctp_free_ifa(ifa);
1282 		return (-1);
1283 	}
1284 	aa->sent = 0;		/* clear sent flag */
1285 
1286 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1287 #ifdef SCTP_DEBUG
1288 	if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1289 		if (type == SCTP_ADD_IP_ADDRESS) {
1290 			SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1291 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1292 		} else if (type == SCTP_DEL_IP_ADDRESS) {
1293 			SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1294 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1295 		} else {
1296 			SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1297 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1298 		}
1299 	}
1300 #endif
1301 
1302 	return (0);
1303 }
1304 
1305 
1306 /*
1307  * add an asconf operation for the given ifa and type.
1308  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1309  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1310  * advisable.
1311  */
1312 static int
1313 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1314     uint16_t type)
1315 {
1316 	uint32_t status;
1317 	int pending_delete_queued = 0;
1318 	int last;
1319 
1320 	/* see if peer supports ASCONF */
1321 	if (stcb->asoc.asconf_supported == 0) {
1322 		return (-1);
1323 	}
1324 	/*
1325 	 * if this is deleting the last address from the assoc, mark it as
1326 	 * pending.
1327 	 */
1328 	if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1329 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1330 			last = (sctp_local_addr_count(stcb) == 0);
1331 		} else {
1332 			last = (sctp_local_addr_count(stcb) == 1);
1333 		}
1334 		if (last) {
1335 			/* set the pending delete info only */
1336 			stcb->asoc.asconf_del_pending = 1;
1337 			stcb->asoc.asconf_addr_del_pending = ifa;
1338 			atomic_add_int(&ifa->refcount, 1);
1339 			SCTPDBG(SCTP_DEBUG_ASCONF2,
1340 			    "asconf_queue_add: mark delete last address pending\n");
1341 			return (-1);
1342 		}
1343 	}
1344 	/* queue an asconf parameter */
1345 	status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1346 
1347 	/*
1348 	 * if this is an add, and there is a delete also pending (i.e. the
1349 	 * last local address is being changed), queue the pending delete
1350 	 * too.
1351 	 */
1352 	if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1353 		/* queue in the pending delete */
1354 		if (sctp_asconf_queue_mgmt(stcb,
1355 		    stcb->asoc.asconf_addr_del_pending,
1356 		    SCTP_DEL_IP_ADDRESS) == 0) {
1357 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1358 			pending_delete_queued = 1;
1359 			/* clear out the pending delete info */
1360 			stcb->asoc.asconf_del_pending = 0;
1361 			sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1362 			stcb->asoc.asconf_addr_del_pending = NULL;
1363 		}
1364 	}
1365 	if (pending_delete_queued) {
1366 		struct sctp_nets *net;
1367 
1368 		/*
1369 		 * since we know that the only/last address is now being
1370 		 * changed in this case, reset the cwnd/rto on all nets to
1371 		 * start as a new address and path.  Also clear the error
1372 		 * counts to give the assoc the best chance to complete the
1373 		 * address change.
1374 		 */
1375 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1376 			stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1377 			    net);
1378 			net->RTO = 0;
1379 			net->error_count = 0;
1380 		}
1381 		stcb->asoc.overall_error_count = 0;
1382 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1383 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1384 			    stcb->asoc.overall_error_count,
1385 			    0,
1386 			    SCTP_FROM_SCTP_ASCONF,
1387 			    __LINE__);
1388 		}
1389 		/* queue in an advisory set primary too */
1390 		(void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1391 		/* let caller know we should send this out immediately */
1392 		status = 1;
1393 	}
1394 	return (status);
1395 }
1396 
1397 /*-
1398  * add an asconf delete IP address parameter to the queue by sockaddr and
1399  * possibly with no sctp_ifa available.  This is only called by the routine
1400  * that checks the addresses in an INIT-ACK against the current address list.
1401  * returns 0 if completed, non-zero if not completed.
1402  * NOTE: if an add is already scheduled (and not yet sent out), simply
1403  * remove it from queue.  If a duplicate operation is found, ignore the
1404  * new one.
1405  */
1406 static int
1407 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1408 {
1409 	struct sctp_ifa *ifa;
1410 	struct sctp_asconf_addr *aa, *aa_next;
1411 
1412 	if (stcb == NULL) {
1413 		return (-1);
1414 	}
1415 	/* see if peer supports ASCONF */
1416 	if (stcb->asoc.asconf_supported == 0) {
1417 		return (-1);
1418 	}
1419 	/* make sure the request isn't already in the queue */
1420 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1421 		/* address match? */
1422 		if (sctp_asconf_addr_match(aa, sa) == 0)
1423 			continue;
1424 		/* is the request already in queue (sent or not) */
1425 		if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1426 			return (-1);
1427 		}
1428 		/* is the negative request already in queue, and not sent */
1429 		if (aa->sent == 1)
1430 			continue;
1431 		if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1432 			/* add already queued, so remove existing entry */
1433 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1434 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1435 			/* free the entry */
1436 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1437 			return (-1);
1438 		}
1439 	}			/* for each aa */
1440 
1441 	/* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1442 	ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1443 
1444 	/* adding new request to the queue */
1445 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1446 	    SCTP_M_ASC_ADDR);
1447 	if (aa == NULL) {
1448 		/* didn't get memory */
1449 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1450 		    "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1451 		return (-1);
1452 	}
1453 	aa->special_del = 0;
1454 	/* fill in asconf address parameter fields */
1455 	/* top level elements are "networked" during send */
1456 	aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1457 	aa->ifa = ifa;
1458 	if (ifa)
1459 		atomic_add_int(&ifa->refcount, 1);
1460 	/* correlation_id filled in during send routine later... */
1461 	switch (sa->sa_family) {
1462 #ifdef INET6
1463 	case AF_INET6:
1464 		{
1465 			/* IPv6 address */
1466 			struct sockaddr_in6 *sin6;
1467 
1468 			sin6 = (struct sockaddr_in6 *)sa;
1469 			aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1470 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1471 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1472 			memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1473 			    sizeof(struct in6_addr));
1474 			break;
1475 		}
1476 #endif
1477 #ifdef INET
1478 	case AF_INET:
1479 		{
1480 			/* IPv4 address */
1481 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1482 
1483 			aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1484 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1485 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1486 			memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1487 			    sizeof(struct in_addr));
1488 			break;
1489 		}
1490 #endif
1491 	default:
1492 		/* invalid family! */
1493 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1494 		if (ifa)
1495 			sctp_free_ifa(ifa);
1496 		return (-1);
1497 	}
1498 	aa->sent = 0;		/* clear sent flag */
1499 
1500 	/* delete goes to the back of the queue */
1501 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1502 
1503 	/* sa_ignore MEMLEAK {memory is put on the tailq} */
1504 	return (0);
1505 }
1506 
1507 /*
1508  * find a specific asconf param on our "sent" queue
1509  */
1510 static struct sctp_asconf_addr *
1511 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1512 {
1513 	struct sctp_asconf_addr *aa;
1514 
1515 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1516 		if (aa->ap.aph.correlation_id == correlation_id &&
1517 		    aa->sent == 1) {
1518 			/* found it */
1519 			return (aa);
1520 		}
1521 	}
1522 	/* didn't find it */
1523 	return (NULL);
1524 }
1525 
1526 /*
1527  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1528  * notifications based on the error response
1529  */
1530 static void
1531 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1532     struct sctp_asconf_paramhdr *aph)
1533 {
1534 	struct sctp_error_cause *eh;
1535 	struct sctp_paramhdr *ph;
1536 	uint16_t param_type;
1537 	uint16_t error_code;
1538 
1539 	eh = (struct sctp_error_cause *)(aph + 1);
1540 	ph = (struct sctp_paramhdr *)(eh + 1);
1541 	/* validate lengths */
1542 	if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1543 	    htons(aph->ph.param_length)) {
1544 		/* invalid error cause length */
1545 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1546 		    "asconf_process_error: cause element too long\n");
1547 		return;
1548 	}
1549 	if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1550 	    htons(eh->length)) {
1551 		/* invalid included TLV length */
1552 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1553 		    "asconf_process_error: included TLV too long\n");
1554 		return;
1555 	}
1556 	/* which error code ? */
1557 	error_code = ntohs(eh->code);
1558 	param_type = ntohs(aph->ph.param_type);
1559 	/* FIX: this should go back up the REMOTE_ERROR ULP notify */
1560 	switch (error_code) {
1561 	case SCTP_CAUSE_RESOURCE_SHORTAGE:
1562 		/* we allow ourselves to "try again" for this error */
1563 		break;
1564 	default:
1565 		/* peer can't handle it... */
1566 		switch (param_type) {
1567 		case SCTP_ADD_IP_ADDRESS:
1568 		case SCTP_DEL_IP_ADDRESS:
1569 		case SCTP_SET_PRIM_ADDR:
1570 			break;
1571 		default:
1572 			break;
1573 		}
1574 	}
1575 }
1576 
1577 /*
1578  * process an asconf queue param.
1579  * aparam: parameter to process, will be removed from the queue.
1580  * flag: 1=success case, 0=failure case
1581  */
1582 static void
1583 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1584     struct sctp_asconf_addr *aparam, uint32_t flag)
1585 {
1586 	uint16_t param_type;
1587 
1588 	/* process this param */
1589 	param_type = aparam->ap.aph.ph.param_type;
1590 	switch (param_type) {
1591 	case SCTP_ADD_IP_ADDRESS:
1592 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1593 		    "process_param_ack: added IP address\n");
1594 		sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1595 		break;
1596 	case SCTP_DEL_IP_ADDRESS:
1597 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1598 		    "process_param_ack: deleted IP address\n");
1599 		/* nothing really to do... lists already updated */
1600 		break;
1601 	case SCTP_SET_PRIM_ADDR:
1602 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1603 		    "process_param_ack: set primary IP address\n");
1604 		/* nothing to do... peer may start using this addr */
1605 		break;
1606 	default:
1607 		/* should NEVER happen */
1608 		break;
1609 	}
1610 
1611 	/* remove the param and free it */
1612 	TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1613 	if (aparam->ifa)
1614 		sctp_free_ifa(aparam->ifa);
1615 	SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1616 }
1617 
1618 /*
1619  * cleanup from a bad asconf ack parameter
1620  */
1621 static void
1622 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1623 {
1624 	/* assume peer doesn't really know how to do asconfs */
1625 	/* XXX we could free the pending queue here */
1626 
1627 }
1628 
1629 void
1630 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1631     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1632     struct sctp_nets *net, int *abort_no_unlock)
1633 {
1634 	struct sctp_association *asoc;
1635 	uint32_t serial_num;
1636 	uint16_t ack_length;
1637 	struct sctp_asconf_paramhdr *aph;
1638 	struct sctp_asconf_addr *aa, *aa_next;
1639 	uint32_t last_error_id = 0;	/* last error correlation id */
1640 	uint32_t id;
1641 	struct sctp_asconf_addr *ap;
1642 
1643 	/* asconf param buffer */
1644 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1645 
1646 	/* verify minimum length */
1647 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1648 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1649 		    "handle_asconf_ack: chunk too small = %xh\n",
1650 		    ntohs(cp->ch.chunk_length));
1651 		return;
1652 	}
1653 	asoc = &stcb->asoc;
1654 	serial_num = ntohl(cp->serial_number);
1655 
1656 	/*
1657 	 * NOTE: we may want to handle this differently- currently, we will
1658 	 * abort when we get an ack for the expected serial number + 1 (eg.
1659 	 * we didn't send it), process an ack normally if it is the expected
1660 	 * serial number, and re-send the previous ack for *ALL* other
1661 	 * serial numbers
1662 	 */
1663 
1664 	/*
1665 	 * if the serial number is the next expected, but I didn't send it,
1666 	 * abort the asoc, since someone probably just hijacked us...
1667 	 */
1668 	if (serial_num == (asoc->asconf_seq_out + 1)) {
1669 		struct mbuf *op_err;
1670 		char msg[SCTP_DIAG_INFO_LEN];
1671 
1672 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1673 		snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1674 		    serial_num);
1675 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1676 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1677 		*abort_no_unlock = 1;
1678 		return;
1679 	}
1680 	if (serial_num != asoc->asconf_seq_out_acked + 1) {
1681 		/* got a duplicate/unexpected ASCONF-ACK */
1682 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1683 		    serial_num, asoc->asconf_seq_out_acked + 1);
1684 		return;
1685 	}
1686 	if (serial_num == asoc->asconf_seq_out - 1) {
1687 		/* stop our timer */
1688 		sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1689 		    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1690 	}
1691 	/* process the ASCONF-ACK contents */
1692 	ack_length = ntohs(cp->ch.chunk_length) -
1693 	    sizeof(struct sctp_asconf_ack_chunk);
1694 	offset += sizeof(struct sctp_asconf_ack_chunk);
1695 	/* process through all parameters */
1696 	while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1697 		unsigned int param_length, param_type;
1698 
1699 		/* get pointer to next asconf parameter */
1700 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1701 		    sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1702 		if (aph == NULL) {
1703 			/* can't get an asconf paramhdr */
1704 			sctp_asconf_ack_clear(stcb);
1705 			return;
1706 		}
1707 		param_type = ntohs(aph->ph.param_type);
1708 		param_length = ntohs(aph->ph.param_length);
1709 		if (param_length > ack_length) {
1710 			sctp_asconf_ack_clear(stcb);
1711 			return;
1712 		}
1713 		if (param_length < sizeof(struct sctp_paramhdr)) {
1714 			sctp_asconf_ack_clear(stcb);
1715 			return;
1716 		}
1717 		/* get the complete parameter... */
1718 		if (param_length > sizeof(aparam_buf)) {
1719 			SCTPDBG(SCTP_DEBUG_ASCONF1,
1720 			    "param length (%u) larger than buffer size!\n", param_length);
1721 			sctp_asconf_ack_clear(stcb);
1722 			return;
1723 		}
1724 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1725 		if (aph == NULL) {
1726 			sctp_asconf_ack_clear(stcb);
1727 			return;
1728 		}
1729 		/* correlation_id is transparent to peer, no ntohl needed */
1730 		id = aph->correlation_id;
1731 
1732 		switch (param_type) {
1733 		case SCTP_ERROR_CAUSE_IND:
1734 			last_error_id = id;
1735 			/* find the corresponding asconf param in our queue */
1736 			ap = sctp_asconf_find_param(stcb, id);
1737 			if (ap == NULL) {
1738 				/* hmm... can't find this in our queue! */
1739 				break;
1740 			}
1741 			/* process the parameter, failed flag */
1742 			sctp_asconf_process_param_ack(stcb, ap, 0);
1743 			/* process the error response */
1744 			sctp_asconf_process_error(stcb, aph);
1745 			break;
1746 		case SCTP_SUCCESS_REPORT:
1747 			/* find the corresponding asconf param in our queue */
1748 			ap = sctp_asconf_find_param(stcb, id);
1749 			if (ap == NULL) {
1750 				/* hmm... can't find this in our queue! */
1751 				break;
1752 			}
1753 			/* process the parameter, success flag */
1754 			sctp_asconf_process_param_ack(stcb, ap, 1);
1755 			break;
1756 		default:
1757 			break;
1758 		}		/* switch */
1759 
1760 		/* update remaining ASCONF-ACK message length to process */
1761 		ack_length -= SCTP_SIZE32(param_length);
1762 		if (ack_length <= 0) {
1763 			/* no more data in the mbuf chain */
1764 			break;
1765 		}
1766 		offset += SCTP_SIZE32(param_length);
1767 	}			/* while */
1768 
1769 	/*
1770 	 * if there are any "sent" params still on the queue, these are
1771 	 * implicitly "success", or "failed" (if we got an error back) ...
1772 	 * so process these appropriately
1773 	 *
1774 	 * we assume that the correlation_id's are monotonically increasing
1775 	 * beginning from 1 and that we don't have *that* many outstanding
1776 	 * at any given time
1777 	 */
1778 	if (last_error_id == 0)
1779 		last_error_id--;/* set to "max" value */
1780 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1781 		if (aa->sent == 1) {
1782 			/*
1783 			 * implicitly successful or failed if correlation_id
1784 			 * < last_error_id, then success else, failure
1785 			 */
1786 			if (aa->ap.aph.correlation_id < last_error_id)
1787 				sctp_asconf_process_param_ack(stcb, aa, 1);
1788 			else
1789 				sctp_asconf_process_param_ack(stcb, aa, 0);
1790 		} else {
1791 			/*
1792 			 * since we always process in order (FIFO queue) if
1793 			 * we reach one that hasn't been sent, the rest
1794 			 * should not have been sent either. so, we're
1795 			 * done...
1796 			 */
1797 			break;
1798 		}
1799 	}
1800 
1801 	/* update the next sequence number to use */
1802 	asoc->asconf_seq_out_acked++;
1803 	/* remove the old ASCONF on our outbound queue */
1804 	sctp_toss_old_asconf(stcb);
1805 	if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1806 #ifdef SCTP_TIMER_BASED_ASCONF
1807 		/* we have more params, so restart our timer */
1808 		sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1809 		    stcb, net);
1810 #else
1811 		/* we have more params, so send out more */
1812 		sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1813 #endif
1814 	}
1815 }
1816 
1817 #ifdef INET6
1818 static uint32_t
1819 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1820 {
1821 	struct sockaddr_in6 *sin6, *net6;
1822 	struct sctp_nets *net;
1823 
1824 	if (sa->sa_family != AF_INET6) {
1825 		/* wrong family */
1826 		return (0);
1827 	}
1828 	sin6 = (struct sockaddr_in6 *)sa;
1829 	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1830 		/* not link local address */
1831 		return (0);
1832 	}
1833 	/* hunt through our destination nets list for this scope_id */
1834 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1835 		if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1836 		    AF_INET6)
1837 			continue;
1838 		net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1839 		if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1840 			continue;
1841 		if (sctp_is_same_scope(sin6, net6)) {
1842 			/* found one */
1843 			return (1);
1844 		}
1845 	}
1846 	/* didn't find one */
1847 	return (0);
1848 }
1849 #endif
1850 
1851 /*
1852  * address management functions
1853  */
1854 static void
1855 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1856     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1857 {
1858 	int status;
1859 
1860 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1861 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1862 		/* subset bound, no ASCONF allowed case, so ignore */
1863 		return;
1864 	}
1865 	/*
1866 	 * note: we know this is not the subset bound, no ASCONF case eg.
1867 	 * this is boundall or subset bound w/ASCONF allowed
1868 	 */
1869 
1870 	/* first, make sure that the address is IPv4 or IPv6 and not jailed */
1871 	switch (ifa->address.sa.sa_family) {
1872 #ifdef INET6
1873 	case AF_INET6:
1874 		if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1875 		    &ifa->address.sin6.sin6_addr) != 0) {
1876 			return;
1877 		}
1878 		break;
1879 #endif
1880 #ifdef INET
1881 	case AF_INET:
1882 		if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1883 		    &ifa->address.sin.sin_addr) != 0) {
1884 			return;
1885 		}
1886 		break;
1887 #endif
1888 	default:
1889 		return;
1890 	}
1891 #ifdef INET6
1892 	/* make sure we're "allowed" to add this type of addr */
1893 	if (ifa->address.sa.sa_family == AF_INET6) {
1894 		/* invalid if we're not a v6 endpoint */
1895 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1896 			return;
1897 		/* is the v6 addr really valid ? */
1898 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1899 			return;
1900 		}
1901 	}
1902 #endif
1903 	/* put this address on the "pending/do not use yet" list */
1904 	sctp_add_local_addr_restricted(stcb, ifa);
1905 	/*
1906 	 * check address scope if address is out of scope, don't queue
1907 	 * anything... note: this would leave the address on both inp and
1908 	 * asoc lists
1909 	 */
1910 	switch (ifa->address.sa.sa_family) {
1911 #ifdef INET6
1912 	case AF_INET6:
1913 		{
1914 			struct sockaddr_in6 *sin6;
1915 
1916 			sin6 = &ifa->address.sin6;
1917 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1918 				/* we skip unspecifed addresses */
1919 				return;
1920 			}
1921 			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1922 				if (stcb->asoc.scope.local_scope == 0) {
1923 					return;
1924 				}
1925 				/* is it the right link local scope? */
1926 				if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1927 					return;
1928 				}
1929 			}
1930 			if (stcb->asoc.scope.site_scope == 0 &&
1931 			    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1932 				return;
1933 			}
1934 			break;
1935 		}
1936 #endif
1937 #ifdef INET
1938 	case AF_INET:
1939 		{
1940 			struct sockaddr_in *sin;
1941 			struct in6pcb *inp6;
1942 
1943 			inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1944 			/* invalid if we are a v6 only endpoint */
1945 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1946 			    SCTP_IPV6_V6ONLY(inp6))
1947 				return;
1948 
1949 			sin = &ifa->address.sin;
1950 			if (sin->sin_addr.s_addr == 0) {
1951 				/* we skip unspecifed addresses */
1952 				return;
1953 			}
1954 			if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1955 			    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1956 				return;
1957 			}
1958 			break;
1959 		}
1960 #endif
1961 	default:
1962 		/* else, not AF_INET or AF_INET6, so skip */
1963 		return;
1964 	}
1965 
1966 	/* queue an asconf for this address add/delete */
1967 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1968 		/* does the peer do asconf? */
1969 		if (stcb->asoc.asconf_supported) {
1970 			/* queue an asconf for this addr */
1971 			status = sctp_asconf_queue_add(stcb, ifa, type);
1972 
1973 			/*
1974 			 * if queued ok, and in the open state, send out the
1975 			 * ASCONF.  If in the non-open state, these will be
1976 			 * sent when the state goes open.
1977 			 */
1978 			if (status == 0 &&
1979 			    ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
1980 			    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1981 #ifdef SCTP_TIMER_BASED_ASCONF
1982 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1983 				    stcb, stcb->asoc.primary_destination);
1984 #else
1985 				sctp_send_asconf(stcb, NULL, addr_locked);
1986 #endif
1987 			}
1988 		}
1989 	}
1990 }
1991 
1992 
1993 int
1994 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1995 {
1996 	struct sctp_asconf_iterator *asc;
1997 	struct sctp_ifa *ifa;
1998 	struct sctp_laddr *l;
1999 	int cnt_invalid = 0;
2000 
2001 	asc = (struct sctp_asconf_iterator *)ptr;
2002 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2003 		ifa = l->ifa;
2004 		switch (ifa->address.sa.sa_family) {
2005 #ifdef INET6
2006 		case AF_INET6:
2007 			/* invalid if we're not a v6 endpoint */
2008 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2009 				cnt_invalid++;
2010 				if (asc->cnt == cnt_invalid)
2011 					return (1);
2012 			}
2013 			break;
2014 #endif
2015 #ifdef INET
2016 		case AF_INET:
2017 			{
2018 				/* invalid if we are a v6 only endpoint */
2019 				struct in6pcb *inp6;
2020 
2021 				inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2022 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2023 				    SCTP_IPV6_V6ONLY(inp6)) {
2024 					cnt_invalid++;
2025 					if (asc->cnt == cnt_invalid)
2026 						return (1);
2027 				}
2028 				break;
2029 			}
2030 #endif
2031 		default:
2032 			/* invalid address family */
2033 			cnt_invalid++;
2034 			if (asc->cnt == cnt_invalid)
2035 				return (1);
2036 		}
2037 	}
2038 	return (0);
2039 }
2040 
2041 static int
2042 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2043 {
2044 	struct sctp_ifa *ifa;
2045 	struct sctp_asconf_iterator *asc;
2046 	struct sctp_laddr *laddr, *nladdr, *l;
2047 
2048 	/* Only for specific case not bound all */
2049 	asc = (struct sctp_asconf_iterator *)ptr;
2050 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2051 		ifa = l->ifa;
2052 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2053 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
2054 			    sctp_nxt_addr) {
2055 				if (laddr->ifa == ifa) {
2056 					laddr->action = 0;
2057 					break;
2058 				}
2059 			}
2060 		} else if (l->action == SCTP_DEL_IP_ADDRESS) {
2061 			LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2062 				/* remove only after all guys are done */
2063 				if (laddr->ifa == ifa) {
2064 					sctp_del_local_addr_ep(inp, ifa);
2065 				}
2066 			}
2067 		}
2068 	}
2069 	return (0);
2070 }
2071 
2072 void
2073 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2074     void *ptr, uint32_t val SCTP_UNUSED)
2075 {
2076 	struct sctp_asconf_iterator *asc;
2077 	struct sctp_ifa *ifa;
2078 	struct sctp_laddr *l;
2079 	int cnt_invalid = 0;
2080 	int type, status;
2081 	int num_queued = 0;
2082 
2083 	asc = (struct sctp_asconf_iterator *)ptr;
2084 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2085 		ifa = l->ifa;
2086 		type = l->action;
2087 
2088 		/* address's vrf_id must be the vrf_id of the assoc */
2089 		if (ifa->vrf_id != stcb->asoc.vrf_id) {
2090 			continue;
2091 		}
2092 		/* Same checks again for assoc */
2093 		switch (ifa->address.sa.sa_family) {
2094 #ifdef INET6
2095 		case AF_INET6:
2096 			{
2097 				/* invalid if we're not a v6 endpoint */
2098 				struct sockaddr_in6 *sin6;
2099 
2100 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2101 					cnt_invalid++;
2102 					if (asc->cnt == cnt_invalid)
2103 						return;
2104 					else
2105 						continue;
2106 				}
2107 				sin6 = &ifa->address.sin6;
2108 				if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2109 					/* we skip unspecifed addresses */
2110 					continue;
2111 				}
2112 				if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2113 				    &sin6->sin6_addr) != 0) {
2114 					continue;
2115 				}
2116 				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2117 					if (stcb->asoc.scope.local_scope == 0) {
2118 						continue;
2119 					}
2120 					/* is it the right link local scope? */
2121 					if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2122 						continue;
2123 					}
2124 				}
2125 				break;
2126 			}
2127 #endif
2128 #ifdef INET
2129 		case AF_INET:
2130 			{
2131 				/* invalid if we are a v6 only endpoint */
2132 				struct in6pcb *inp6;
2133 				struct sockaddr_in *sin;
2134 
2135 				inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2136 				/* invalid if we are a v6 only endpoint */
2137 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2138 				    SCTP_IPV6_V6ONLY(inp6))
2139 					continue;
2140 
2141 				sin = &ifa->address.sin;
2142 				if (sin->sin_addr.s_addr == 0) {
2143 					/* we skip unspecifed addresses */
2144 					continue;
2145 				}
2146 				if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2147 				    &sin->sin_addr) != 0) {
2148 					continue;
2149 				}
2150 				if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2151 				    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2152 					continue;
2153 				}
2154 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2155 				    SCTP_IPV6_V6ONLY(inp6)) {
2156 					cnt_invalid++;
2157 					if (asc->cnt == cnt_invalid)
2158 						return;
2159 					else
2160 						continue;
2161 				}
2162 				break;
2163 			}
2164 #endif
2165 		default:
2166 			/* invalid address family */
2167 			cnt_invalid++;
2168 			if (asc->cnt == cnt_invalid)
2169 				return;
2170 			else
2171 				continue;
2172 			break;
2173 		}
2174 
2175 		if (type == SCTP_ADD_IP_ADDRESS) {
2176 			/* prevent this address from being used as a source */
2177 			sctp_add_local_addr_restricted(stcb, ifa);
2178 		} else if (type == SCTP_DEL_IP_ADDRESS) {
2179 			struct sctp_nets *net;
2180 
2181 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2182 				sctp_rtentry_t *rt;
2183 
2184 				/* delete this address if cached */
2185 				if (net->ro._s_addr == ifa) {
2186 					sctp_free_ifa(net->ro._s_addr);
2187 					net->ro._s_addr = NULL;
2188 					net->src_addr_selected = 0;
2189 					rt = net->ro.ro_rt;
2190 					if (rt) {
2191 						RTFREE(rt);
2192 						net->ro.ro_rt = NULL;
2193 					}
2194 					/*
2195 					 * Now we deleted our src address,
2196 					 * should we not also now reset the
2197 					 * cwnd/rto to start as if its a new
2198 					 * address?
2199 					 */
2200 					stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2201 					net->RTO = 0;
2202 
2203 				}
2204 			}
2205 		} else if (type == SCTP_SET_PRIM_ADDR) {
2206 			if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2207 				/* must validate the ifa is in the ep */
2208 				if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2209 					continue;
2210 				}
2211 			} else {
2212 				/* Need to check scopes for this guy */
2213 				if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2214 					continue;
2215 				}
2216 			}
2217 		}
2218 		/* queue an asconf for this address add/delete */
2219 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2220 		    stcb->asoc.asconf_supported == 1) {
2221 			/* queue an asconf for this addr */
2222 			status = sctp_asconf_queue_add(stcb, ifa, type);
2223 			/*
2224 			 * if queued ok, and in the open state, update the
2225 			 * count of queued params.  If in the non-open
2226 			 * state, these get sent when the assoc goes open.
2227 			 */
2228 			if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2229 			    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2230 				if (status >= 0) {
2231 					num_queued++;
2232 				}
2233 			}
2234 		}
2235 	}
2236 	/*
2237 	 * If we have queued params in the open state, send out an ASCONF.
2238 	 */
2239 	if (num_queued > 0) {
2240 		sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2241 	}
2242 }
2243 
2244 void
2245 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2246 {
2247 	struct sctp_asconf_iterator *asc;
2248 	struct sctp_ifa *ifa;
2249 	struct sctp_laddr *l, *nl;
2250 
2251 	asc = (struct sctp_asconf_iterator *)ptr;
2252 	LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2253 		ifa = l->ifa;
2254 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2255 			/* Clear the defer use flag */
2256 			ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2257 		}
2258 		sctp_free_ifa(ifa);
2259 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2260 		SCTP_DECR_LADDR_COUNT();
2261 	}
2262 	SCTP_FREE(asc, SCTP_M_ASC_IT);
2263 }
2264 
2265 /*
2266  * sa is the sockaddr to ask the peer to set primary to.
2267  * returns: 0 = completed, -1 = error
2268  */
2269 int32_t
2270 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2271 {
2272 	uint32_t vrf_id;
2273 	struct sctp_ifa *ifa;
2274 
2275 	/* find the ifa for the desired set primary */
2276 	vrf_id = stcb->asoc.vrf_id;
2277 	ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2278 	if (ifa == NULL) {
2279 		/* Invalid address */
2280 		return (-1);
2281 	}
2282 	/* queue an ASCONF:SET_PRIM_ADDR to be sent */
2283 	if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2284 		/* set primary queuing succeeded */
2285 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2286 		    "set_primary_ip_address_sa: queued on tcb=%p, ",
2287 		    (void *)stcb);
2288 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2289 		if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2290 		    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2291 #ifdef SCTP_TIMER_BASED_ASCONF
2292 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2293 			    stcb->sctp_ep, stcb,
2294 			    stcb->asoc.primary_destination);
2295 #else
2296 			sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2297 #endif
2298 		}
2299 	} else {
2300 		SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2301 		    (void *)stcb);
2302 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2303 		return (-1);
2304 	}
2305 	return (0);
2306 }
2307 
2308 int
2309 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2310 {
2311 	struct sctp_tmit_chunk *chk, *nchk;
2312 	unsigned int offset, asconf_limit;
2313 	struct sctp_asconf_chunk *acp;
2314 	struct sctp_asconf_paramhdr *aph;
2315 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2316 	struct sctp_paramhdr *ph;
2317 	int add_cnt, del_cnt;
2318 	uint16_t last_param_type;
2319 
2320 	add_cnt = del_cnt = 0;
2321 	last_param_type = 0;
2322 	TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2323 		if (chk->data == NULL) {
2324 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2325 			continue;
2326 		}
2327 		offset = 0;
2328 		acp = mtod(chk->data, struct sctp_asconf_chunk *);
2329 		offset += sizeof(struct sctp_asconf_chunk);
2330 		asconf_limit = ntohs(acp->ch.chunk_length);
2331 		ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2332 		if (ph == NULL) {
2333 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2334 			continue;
2335 		}
2336 		offset += ntohs(ph->param_length);
2337 
2338 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2339 		if (aph == NULL) {
2340 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2341 			continue;
2342 		}
2343 		while (aph != NULL) {
2344 			unsigned int param_length, param_type;
2345 
2346 			param_type = ntohs(aph->ph.param_type);
2347 			param_length = ntohs(aph->ph.param_length);
2348 			if (offset + param_length > asconf_limit) {
2349 				/* parameter goes beyond end of chunk! */
2350 				break;
2351 			}
2352 			if (param_length > sizeof(aparam_buf)) {
2353 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2354 				break;
2355 			}
2356 			if (param_length <= sizeof(struct sctp_paramhdr)) {
2357 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2358 				break;
2359 			}
2360 			aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2361 			if (aph == NULL) {
2362 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2363 				break;
2364 			}
2365 			ph = (struct sctp_paramhdr *)(aph + 1);
2366 			if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2367 				switch (param_type) {
2368 				case SCTP_ADD_IP_ADDRESS:
2369 					add_cnt++;
2370 					break;
2371 				case SCTP_DEL_IP_ADDRESS:
2372 					del_cnt++;
2373 					break;
2374 				default:
2375 					break;
2376 				}
2377 				last_param_type = param_type;
2378 			}
2379 			offset += SCTP_SIZE32(param_length);
2380 			if (offset >= asconf_limit) {
2381 				/* no more data in the mbuf chain */
2382 				break;
2383 			}
2384 			/* get pointer to next asconf param */
2385 			aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2386 		}
2387 	}
2388 
2389 	/*
2390 	 * we want to find the sequences which consist of ADD -> DEL -> ADD
2391 	 * or DEL -> ADD
2392 	 */
2393 	if (add_cnt > del_cnt ||
2394 	    (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2395 		return (1);
2396 	}
2397 	return (0);
2398 }
2399 
2400 static struct sockaddr *
2401 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2402 {
2403 	struct sctp_vrf *vrf = NULL;
2404 	struct sctp_ifn *sctp_ifn;
2405 	struct sctp_ifa *sctp_ifa;
2406 
2407 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2408 		SCTP_IPI_ADDR_RLOCK();
2409 	vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2410 	if (vrf == NULL) {
2411 		if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2412 			SCTP_IPI_ADDR_RUNLOCK();
2413 		return (NULL);
2414 	}
2415 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2416 		if (stcb->asoc.scope.loopback_scope == 0 &&
2417 		    SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2418 			/* Skip if loopback_scope not set */
2419 			continue;
2420 		}
2421 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2422 			switch (sctp_ifa->address.sa.sa_family) {
2423 #ifdef INET
2424 			case AF_INET:
2425 				if (stcb->asoc.scope.ipv4_addr_legal) {
2426 					struct sockaddr_in *sin;
2427 
2428 					sin = &sctp_ifa->address.sin;
2429 					if (sin->sin_addr.s_addr == 0) {
2430 						/* skip unspecifed addresses */
2431 						continue;
2432 					}
2433 					if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2434 					    &sin->sin_addr) != 0) {
2435 						continue;
2436 					}
2437 					if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2438 					    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2439 						continue;
2440 
2441 					if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2442 					    (!sctp_is_addr_pending(stcb, sctp_ifa)))
2443 						continue;
2444 					/*
2445 					 * found a valid local v4 address to
2446 					 * use
2447 					 */
2448 					if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2449 						SCTP_IPI_ADDR_RUNLOCK();
2450 					return (&sctp_ifa->address.sa);
2451 				}
2452 				break;
2453 #endif
2454 #ifdef INET6
2455 			case AF_INET6:
2456 				if (stcb->asoc.scope.ipv6_addr_legal) {
2457 					struct sockaddr_in6 *sin6;
2458 
2459 					if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2460 						continue;
2461 					}
2462 					sin6 = &sctp_ifa->address.sin6;
2463 					if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2464 						/*
2465 						 * we skip unspecifed
2466 						 * addresses
2467 						 */
2468 						continue;
2469 					}
2470 					if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2471 					    &sin6->sin6_addr) != 0) {
2472 						continue;
2473 					}
2474 					if (stcb->asoc.scope.local_scope == 0 &&
2475 					    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2476 						continue;
2477 					if (stcb->asoc.scope.site_scope == 0 &&
2478 					    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2479 						continue;
2480 
2481 					if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2482 					    (!sctp_is_addr_pending(stcb, sctp_ifa)))
2483 						continue;
2484 					/*
2485 					 * found a valid local v6 address to
2486 					 * use
2487 					 */
2488 					if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2489 						SCTP_IPI_ADDR_RUNLOCK();
2490 					return (&sctp_ifa->address.sa);
2491 				}
2492 				break;
2493 #endif
2494 			default:
2495 				break;
2496 			}
2497 		}
2498 	}
2499 	/* no valid addresses found */
2500 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2501 		SCTP_IPI_ADDR_RUNLOCK();
2502 	return (NULL);
2503 }
2504 
2505 static struct sockaddr *
2506 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2507 {
2508 	struct sctp_laddr *laddr;
2509 
2510 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2511 		if (laddr->ifa == NULL) {
2512 			continue;
2513 		}
2514 		/* is the address restricted ? */
2515 		if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2516 		    (!sctp_is_addr_pending(stcb, laddr->ifa)))
2517 			continue;
2518 
2519 		/* found a valid local address to use */
2520 		return (&laddr->ifa->address.sa);
2521 	}
2522 	/* no valid addresses found */
2523 	return (NULL);
2524 }
2525 
2526 /*
2527  * builds an ASCONF chunk from queued ASCONF params.
2528  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2529  */
2530 struct mbuf *
2531 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2532 {
2533 	struct mbuf *m_asconf, *m_asconf_chk;
2534 	struct sctp_asconf_addr *aa;
2535 	struct sctp_asconf_chunk *acp;
2536 	struct sctp_asconf_paramhdr *aph;
2537 	struct sctp_asconf_addr_param *aap;
2538 	uint32_t p_length;
2539 	uint32_t correlation_id = 1;	/* 0 is reserved... */
2540 	caddr_t ptr, lookup_ptr;
2541 	uint8_t lookup_used = 0;
2542 
2543 	/* are there any asconf params to send? */
2544 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2545 		if (aa->sent == 0)
2546 			break;
2547 	}
2548 	if (aa == NULL)
2549 		return (NULL);
2550 
2551 	/*
2552 	 * get a chunk header mbuf and a cluster for the asconf params since
2553 	 * it's simpler to fill in the asconf chunk header lookup address on
2554 	 * the fly
2555 	 */
2556 	m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2557 	if (m_asconf_chk == NULL) {
2558 		/* no mbuf's */
2559 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2560 		    "compose_asconf: couldn't get chunk mbuf!\n");
2561 		return (NULL);
2562 	}
2563 	m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2564 	if (m_asconf == NULL) {
2565 		/* no mbuf's */
2566 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2567 		    "compose_asconf: couldn't get mbuf!\n");
2568 		sctp_m_freem(m_asconf_chk);
2569 		return (NULL);
2570 	}
2571 	SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2572 	SCTP_BUF_LEN(m_asconf) = 0;
2573 	acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2574 	memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2575 	/* save pointers to lookup address and asconf params */
2576 	lookup_ptr = (caddr_t)(acp + 1);	/* after the header */
2577 	ptr = mtod(m_asconf, caddr_t);	/* beginning of cluster */
2578 
2579 	/* fill in chunk header info */
2580 	acp->ch.chunk_type = SCTP_ASCONF;
2581 	acp->ch.chunk_flags = 0;
2582 	acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2583 	stcb->asoc.asconf_seq_out++;
2584 
2585 	/* add parameters... up to smallest MTU allowed */
2586 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2587 		if (aa->sent)
2588 			continue;
2589 		/* get the parameter length */
2590 		p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2591 		/* will it fit in current chunk? */
2592 		if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2593 		    (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2594 			/* won't fit, so we're done with this chunk */
2595 			break;
2596 		}
2597 		/* assign (and store) a correlation id */
2598 		aa->ap.aph.correlation_id = correlation_id++;
2599 
2600 		/*
2601 		 * fill in address if we're doing a delete this is a simple
2602 		 * way for us to fill in the correlation address, which
2603 		 * should only be used by the peer if we're deleting our
2604 		 * source address and adding a new address (e.g. renumbering
2605 		 * case)
2606 		 */
2607 		if (lookup_used == 0 &&
2608 		    (aa->special_del == 0) &&
2609 		    aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2610 			struct sctp_ipv6addr_param *lookup;
2611 			uint16_t p_size, addr_size;
2612 
2613 			lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2614 			lookup->ph.param_type =
2615 			    htons(aa->ap.addrp.ph.param_type);
2616 			if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2617 				/* copy IPv6 address */
2618 				p_size = sizeof(struct sctp_ipv6addr_param);
2619 				addr_size = sizeof(struct in6_addr);
2620 			} else {
2621 				/* copy IPv4 address */
2622 				p_size = sizeof(struct sctp_ipv4addr_param);
2623 				addr_size = sizeof(struct in_addr);
2624 			}
2625 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2626 			memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2627 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2628 			lookup_used = 1;
2629 		}
2630 		/* copy into current space */
2631 		memcpy(ptr, &aa->ap, p_length);
2632 
2633 		/* network elements and update lengths */
2634 		aph = (struct sctp_asconf_paramhdr *)ptr;
2635 		aap = (struct sctp_asconf_addr_param *)ptr;
2636 		/* correlation_id is transparent to peer, no htonl needed */
2637 		aph->ph.param_type = htons(aph->ph.param_type);
2638 		aph->ph.param_length = htons(aph->ph.param_length);
2639 		aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2640 		aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2641 
2642 		SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2643 		ptr += SCTP_SIZE32(p_length);
2644 
2645 		/*
2646 		 * these params are removed off the pending list upon
2647 		 * getting an ASCONF-ACK back from the peer, just set flag
2648 		 */
2649 		aa->sent = 1;
2650 	}
2651 	/* check to see if the lookup addr has been populated yet */
2652 	if (lookup_used == 0) {
2653 		/* NOTE: if the address param is optional, can skip this... */
2654 		/* add any valid (existing) address... */
2655 		struct sctp_ipv6addr_param *lookup;
2656 		uint16_t p_size, addr_size;
2657 		struct sockaddr *found_addr;
2658 		caddr_t addr_ptr;
2659 
2660 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2661 			found_addr = sctp_find_valid_localaddr(stcb,
2662 			    addr_locked);
2663 		else
2664 			found_addr = sctp_find_valid_localaddr_ep(stcb);
2665 
2666 		lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2667 		if (found_addr != NULL) {
2668 			switch (found_addr->sa_family) {
2669 #ifdef INET6
2670 			case AF_INET6:
2671 				/* copy IPv6 address */
2672 				lookup->ph.param_type =
2673 				    htons(SCTP_IPV6_ADDRESS);
2674 				p_size = sizeof(struct sctp_ipv6addr_param);
2675 				addr_size = sizeof(struct in6_addr);
2676 				addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2677 				    found_addr)->sin6_addr;
2678 				break;
2679 #endif
2680 #ifdef INET
2681 			case AF_INET:
2682 				/* copy IPv4 address */
2683 				lookup->ph.param_type =
2684 				    htons(SCTP_IPV4_ADDRESS);
2685 				p_size = sizeof(struct sctp_ipv4addr_param);
2686 				addr_size = sizeof(struct in_addr);
2687 				addr_ptr = (caddr_t)&((struct sockaddr_in *)
2688 				    found_addr)->sin_addr;
2689 				break;
2690 #endif
2691 			default:
2692 				p_size = 0;
2693 				addr_size = 0;
2694 				addr_ptr = NULL;
2695 				break;
2696 			}
2697 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2698 			memcpy(lookup->addr, addr_ptr, addr_size);
2699 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2700 		} else {
2701 			/* uh oh... don't have any address?? */
2702 			SCTPDBG(SCTP_DEBUG_ASCONF1,
2703 			    "compose_asconf: no lookup addr!\n");
2704 			/* XXX for now, we send a IPv4 address of 0.0.0.0 */
2705 			lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2706 			lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2707 			memset(lookup->addr, 0, sizeof(struct in_addr));
2708 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2709 		}
2710 	}
2711 	/* chain it all together */
2712 	SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2713 	*retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2714 	acp->ch.chunk_length = htons(*retlen);
2715 
2716 	return (m_asconf_chk);
2717 }
2718 
2719 /*
2720  * section to handle address changes before an association is up eg. changes
2721  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2722  */
2723 
2724 /*
2725  * processes the (local) addresses in the INIT-ACK chunk
2726  */
2727 static void
2728 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2729     unsigned int offset, unsigned int length)
2730 {
2731 	struct sctp_paramhdr tmp_param, *ph;
2732 	uint16_t plen, ptype;
2733 	struct sctp_ifa *sctp_ifa;
2734 	union sctp_sockstore store;
2735 #ifdef INET6
2736 	struct sctp_ipv6addr_param addr6_store;
2737 #endif
2738 #ifdef INET
2739 	struct sctp_ipv4addr_param addr4_store;
2740 #endif
2741 
2742 	SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2743 	if (stcb == NULL)	/* Un-needed check for SA */
2744 		return;
2745 
2746 	/* convert to upper bound */
2747 	length += offset;
2748 
2749 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2750 		return;
2751 	}
2752 	/* go through the addresses in the init-ack */
2753 	ph = (struct sctp_paramhdr *)
2754 	    sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2755 	    (uint8_t *)&tmp_param);
2756 	while (ph != NULL) {
2757 		ptype = ntohs(ph->param_type);
2758 		plen = ntohs(ph->param_length);
2759 		switch (ptype) {
2760 #ifdef INET6
2761 		case SCTP_IPV6_ADDRESS:
2762 			{
2763 				struct sctp_ipv6addr_param *a6p;
2764 
2765 				/* get the entire IPv6 address param */
2766 				a6p = (struct sctp_ipv6addr_param *)
2767 				    sctp_m_getptr(m, offset,
2768 				    sizeof(struct sctp_ipv6addr_param),
2769 				    (uint8_t *)&addr6_store);
2770 				if (plen != sizeof(struct sctp_ipv6addr_param) ||
2771 				    a6p == NULL) {
2772 					return;
2773 				}
2774 				memset(&store, 0, sizeof(union sctp_sockstore));
2775 				store.sin6.sin6_family = AF_INET6;
2776 				store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2777 				store.sin6.sin6_port = stcb->rport;
2778 				memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2779 				break;
2780 			}
2781 #endif
2782 #ifdef INET
2783 		case SCTP_IPV4_ADDRESS:
2784 			{
2785 				struct sctp_ipv4addr_param *a4p;
2786 
2787 				/* get the entire IPv4 address param */
2788 				a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2789 				    sizeof(struct sctp_ipv4addr_param),
2790 				    (uint8_t *)&addr4_store);
2791 				if (plen != sizeof(struct sctp_ipv4addr_param) ||
2792 				    a4p == NULL) {
2793 					return;
2794 				}
2795 				memset(&store, 0, sizeof(union sctp_sockstore));
2796 				store.sin.sin_family = AF_INET;
2797 				store.sin.sin_len = sizeof(struct sockaddr_in);
2798 				store.sin.sin_port = stcb->rport;
2799 				store.sin.sin_addr.s_addr = a4p->addr;
2800 				break;
2801 			}
2802 #endif
2803 		default:
2804 			goto next_addr;
2805 		}
2806 
2807 		/* see if this address really (still) exists */
2808 		sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2809 		    SCTP_ADDR_NOT_LOCKED);
2810 		if (sctp_ifa == NULL) {
2811 			/* address doesn't exist anymore */
2812 			int status;
2813 
2814 			/* are ASCONFs allowed ? */
2815 			if ((sctp_is_feature_on(stcb->sctp_ep,
2816 			    SCTP_PCB_FLAGS_DO_ASCONF)) &&
2817 			    stcb->asoc.asconf_supported) {
2818 				/* queue an ASCONF DEL_IP_ADDRESS */
2819 				status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2820 				/*
2821 				 * if queued ok, and in correct state, send
2822 				 * out the ASCONF.
2823 				 */
2824 				if (status == 0 &&
2825 				    SCTP_GET_STATE(&stcb->asoc) ==
2826 				    SCTP_STATE_OPEN) {
2827 #ifdef SCTP_TIMER_BASED_ASCONF
2828 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2829 					    stcb->sctp_ep, stcb,
2830 					    stcb->asoc.primary_destination);
2831 #else
2832 					sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2833 #endif
2834 				}
2835 			}
2836 		}
2837 next_addr:
2838 		/*
2839 		 * Sanity check:  Make sure the length isn't 0, otherwise
2840 		 * we'll be stuck in this loop for a long time...
2841 		 */
2842 		if (SCTP_SIZE32(plen) == 0) {
2843 			SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2844 			    plen, ptype);
2845 			return;
2846 		}
2847 		/* get next parameter */
2848 		offset += SCTP_SIZE32(plen);
2849 		if ((offset + sizeof(struct sctp_paramhdr)) > length)
2850 			return;
2851 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2852 		    sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2853 	}			/* while */
2854 }
2855 
2856 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2857 /*
2858  * checks to see if a specific address is in the initack address list returns
2859  * 1 if found, 0 if not
2860  */
2861 static uint32_t
2862 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2863 {
2864 	struct sctp_paramhdr tmp_param, *ph;
2865 	uint16_t plen, ptype;
2866 #ifdef INET
2867 	struct sockaddr_in *sin;
2868 	struct sctp_ipv4addr_param *a4p;
2869 	struct sctp_ipv6addr_param addr4_store;
2870 #endif
2871 #ifdef INET6
2872 	struct sockaddr_in6 *sin6;
2873 	struct sctp_ipv6addr_param *a6p;
2874 	struct sctp_ipv6addr_param addr6_store;
2875 	struct sockaddr_in6 sin6_tmp;
2876 #endif
2877 
2878 	switch (sa->sa_family) {
2879 #ifdef INET
2880 	case AF_INET:
2881 		break;
2882 #endif
2883 #ifdef INET6
2884 	case AF_INET6:
2885 		break;
2886 #endif
2887 	default:
2888 		return (0);
2889 	}
2890 
2891 	SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2892 	SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2893 	/* convert to upper bound */
2894 	length += offset;
2895 
2896 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2897 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2898 		    "find_initack_addr: invalid offset?\n");
2899 		return (0);
2900 	}
2901 	/* go through the addresses in the init-ack */
2902 	ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2903 	    sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2904 	while (ph != NULL) {
2905 		ptype = ntohs(ph->param_type);
2906 		plen = ntohs(ph->param_length);
2907 		switch (ptype) {
2908 #ifdef INET6
2909 		case SCTP_IPV6_ADDRESS:
2910 			if (sa->sa_family == AF_INET6) {
2911 				/* get the entire IPv6 address param */
2912 				if (plen != sizeof(struct sctp_ipv6addr_param)) {
2913 					break;
2914 				}
2915 				/* get the entire IPv6 address param */
2916 				a6p = (struct sctp_ipv6addr_param *)
2917 				    sctp_m_getptr(m, offset,
2918 				    sizeof(struct sctp_ipv6addr_param),
2919 				    (uint8_t *)&addr6_store);
2920 				if (a6p == NULL) {
2921 					return (0);
2922 				}
2923 				sin6 = (struct sockaddr_in6 *)sa;
2924 				if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2925 					/* create a copy and clear scope */
2926 					memcpy(&sin6_tmp, sin6,
2927 					    sizeof(struct sockaddr_in6));
2928 					sin6 = &sin6_tmp;
2929 					in6_clearscope(&sin6->sin6_addr);
2930 				}
2931 				if (memcmp(&sin6->sin6_addr, a6p->addr,
2932 				    sizeof(struct in6_addr)) == 0) {
2933 					/* found it */
2934 					return (1);
2935 				}
2936 			}
2937 			break;
2938 #endif				/* INET6 */
2939 #ifdef INET
2940 		case SCTP_IPV4_ADDRESS:
2941 			if (sa->sa_family == AF_INET) {
2942 				if (plen != sizeof(struct sctp_ipv4addr_param)) {
2943 					break;
2944 				}
2945 				/* get the entire IPv4 address param */
2946 				a4p = (struct sctp_ipv4addr_param *)
2947 				    sctp_m_getptr(m, offset,
2948 				    sizeof(struct sctp_ipv4addr_param),
2949 				    (uint8_t *)&addr4_store);
2950 				if (a4p == NULL) {
2951 					return (0);
2952 				}
2953 				sin = (struct sockaddr_in *)sa;
2954 				if (sin->sin_addr.s_addr == a4p->addr) {
2955 					/* found it */
2956 					return (1);
2957 				}
2958 			}
2959 			break;
2960 #endif
2961 		default:
2962 			break;
2963 		}
2964 		/* get next parameter */
2965 		offset += SCTP_SIZE32(plen);
2966 		if (offset + sizeof(struct sctp_paramhdr) > length) {
2967 			return (0);
2968 		}
2969 		ph = (struct sctp_paramhdr *)
2970 		    sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2971 		    (uint8_t *)&tmp_param);
2972 	}			/* while */
2973 	/* not found! */
2974 	return (0);
2975 }
2976 
2977 /*
2978  * makes sure that the current endpoint local addr list is consistent with
2979  * the new association (eg. subset bound, asconf allowed) adds addresses as
2980  * necessary
2981  */
2982 static void
2983 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
2984     int length, struct sockaddr *init_addr)
2985 {
2986 	struct sctp_laddr *laddr;
2987 
2988 	/* go through the endpoint list */
2989 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2990 		/* be paranoid and validate the laddr */
2991 		if (laddr->ifa == NULL) {
2992 			SCTPDBG(SCTP_DEBUG_ASCONF1,
2993 			    "check_addr_list_ep: laddr->ifa is NULL");
2994 			continue;
2995 		}
2996 		if (laddr->ifa == NULL) {
2997 			SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
2998 			continue;
2999 		}
3000 		/* do i have it implicitly? */
3001 		if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3002 			continue;
3003 		}
3004 		/* check to see if in the init-ack */
3005 		if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3006 			/* try to add it */
3007 			sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3008 			    SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3009 		}
3010 	}
3011 }
3012 
3013 /*
3014  * makes sure that the current kernel address list is consistent with the new
3015  * association (with all addrs bound) adds addresses as necessary
3016  */
3017 static void
3018 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3019     int length, struct sockaddr *init_addr,
3020     uint16_t local_scope, uint16_t site_scope,
3021     uint16_t ipv4_scope, uint16_t loopback_scope)
3022 {
3023 	struct sctp_vrf *vrf = NULL;
3024 	struct sctp_ifn *sctp_ifn;
3025 	struct sctp_ifa *sctp_ifa;
3026 	uint32_t vrf_id;
3027 #ifdef INET
3028 	struct sockaddr_in *sin;
3029 #endif
3030 #ifdef INET6
3031 	struct sockaddr_in6 *sin6;
3032 #endif
3033 
3034 	if (stcb) {
3035 		vrf_id = stcb->asoc.vrf_id;
3036 	} else {
3037 		return;
3038 	}
3039 	SCTP_IPI_ADDR_RLOCK();
3040 	vrf = sctp_find_vrf(vrf_id);
3041 	if (vrf == NULL) {
3042 		SCTP_IPI_ADDR_RUNLOCK();
3043 		return;
3044 	}
3045 	/* go through all our known interfaces */
3046 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3047 		if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3048 			/* skip loopback interface */
3049 			continue;
3050 		}
3051 		/* go through each interface address */
3052 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3053 			/* do i have it implicitly? */
3054 			if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3055 				continue;
3056 			}
3057 			switch (sctp_ifa->address.sa.sa_family) {
3058 #ifdef INET
3059 			case AF_INET:
3060 				sin = &sctp_ifa->address.sin;
3061 				if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3062 				    &sin->sin_addr) != 0) {
3063 					continue;
3064 				}
3065 				if ((ipv4_scope == 0) &&
3066 				    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3067 					/* private address not in scope */
3068 					continue;
3069 				}
3070 				break;
3071 #endif
3072 #ifdef INET6
3073 			case AF_INET6:
3074 				sin6 = &sctp_ifa->address.sin6;
3075 				if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3076 				    &sin6->sin6_addr) != 0) {
3077 					continue;
3078 				}
3079 				if ((local_scope == 0) &&
3080 				    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3081 					continue;
3082 				}
3083 				if ((site_scope == 0) &&
3084 				    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3085 					continue;
3086 				}
3087 				break;
3088 #endif
3089 			default:
3090 				break;
3091 			}
3092 			/* check to see if in the init-ack */
3093 			if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3094 				/* try to add it */
3095 				sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3096 				    sctp_ifa, SCTP_ADD_IP_ADDRESS,
3097 				    SCTP_ADDR_LOCKED);
3098 			}
3099 		}		/* end foreach ifa */
3100 	}			/* end foreach ifn */
3101 	SCTP_IPI_ADDR_RUNLOCK();
3102 }
3103 
3104 /*
3105  * validates an init-ack chunk (from a cookie-echo) with current addresses
3106  * adds addresses from the init-ack into our local address list, if needed
3107  * queues asconf adds/deletes addresses as needed and makes appropriate list
3108  * changes for source address selection m, offset: points to the start of the
3109  * address list in an init-ack chunk length: total length of the address
3110  * params only init_addr: address where my INIT-ACK was sent from
3111  */
3112 void
3113 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3114     int length, struct sockaddr *init_addr,
3115     uint16_t local_scope, uint16_t site_scope,
3116     uint16_t ipv4_scope, uint16_t loopback_scope)
3117 {
3118 	/* process the local addresses in the initack */
3119 	sctp_process_initack_addresses(stcb, m, offset, length);
3120 
3121 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3122 		/* bound all case */
3123 		sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3124 		    local_scope, site_scope, ipv4_scope, loopback_scope);
3125 	} else {
3126 		/* subset bound case */
3127 		if (sctp_is_feature_on(stcb->sctp_ep,
3128 		    SCTP_PCB_FLAGS_DO_ASCONF)) {
3129 			/* asconf's allowed */
3130 			sctp_check_address_list_ep(stcb, m, offset, length,
3131 			    init_addr);
3132 		}
3133 		/* else, no asconfs allowed, so what we sent is what we get */
3134 	}
3135 }
3136 
3137 /*
3138  * sctp_bindx() support
3139  */
3140 uint32_t
3141 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3142     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3143 {
3144 	struct sctp_ifa *ifa;
3145 	struct sctp_laddr *laddr, *nladdr;
3146 
3147 	if (sa->sa_len == 0) {
3148 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3149 		return (EINVAL);
3150 	}
3151 	if (sctp_ifap) {
3152 		ifa = sctp_ifap;
3153 	} else if (type == SCTP_ADD_IP_ADDRESS) {
3154 		/* For an add the address MUST be on the system */
3155 		ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3156 	} else if (type == SCTP_DEL_IP_ADDRESS) {
3157 		/* For a delete we need to find it in the inp */
3158 		ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3159 	} else {
3160 		ifa = NULL;
3161 	}
3162 	if (ifa != NULL) {
3163 		if (type == SCTP_ADD_IP_ADDRESS) {
3164 			sctp_add_local_addr_ep(inp, ifa, type);
3165 		} else if (type == SCTP_DEL_IP_ADDRESS) {
3166 			if (inp->laddr_count < 2) {
3167 				/* can't delete the last local address */
3168 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3169 				return (EINVAL);
3170 			}
3171 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
3172 			    sctp_nxt_addr) {
3173 				if (ifa == laddr->ifa) {
3174 					/* Mark in the delete */
3175 					laddr->action = type;
3176 				}
3177 			}
3178 		}
3179 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3180 			/*
3181 			 * There is no need to start the iterator if the inp
3182 			 * has no associations.
3183 			 */
3184 			if (type == SCTP_DEL_IP_ADDRESS) {
3185 				LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3186 					if (laddr->ifa == ifa) {
3187 						sctp_del_local_addr_ep(inp, ifa);
3188 					}
3189 				}
3190 			}
3191 		} else {
3192 			struct sctp_asconf_iterator *asc;
3193 			struct sctp_laddr *wi;
3194 			int ret;
3195 
3196 			SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3197 			    sizeof(struct sctp_asconf_iterator),
3198 			    SCTP_M_ASC_IT);
3199 			if (asc == NULL) {
3200 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3201 				return (ENOMEM);
3202 			}
3203 			wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3204 			if (wi == NULL) {
3205 				SCTP_FREE(asc, SCTP_M_ASC_IT);
3206 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3207 				return (ENOMEM);
3208 			}
3209 			LIST_INIT(&asc->list_of_work);
3210 			asc->cnt = 1;
3211 			SCTP_INCR_LADDR_COUNT();
3212 			wi->ifa = ifa;
3213 			wi->action = type;
3214 			atomic_add_int(&ifa->refcount, 1);
3215 			LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3216 			ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3217 			    sctp_asconf_iterator_stcb,
3218 			    sctp_asconf_iterator_ep_end,
3219 			    SCTP_PCB_ANY_FLAGS,
3220 			    SCTP_PCB_ANY_FEATURES,
3221 			    SCTP_ASOC_ANY_STATE,
3222 			    (void *)asc, 0,
3223 			    sctp_asconf_iterator_end, inp, 0);
3224 			if (ret) {
3225 				SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3226 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3227 				sctp_asconf_iterator_end(asc, 0);
3228 				return (EFAULT);
3229 			}
3230 		}
3231 		return (0);
3232 	} else {
3233 		/* invalid address! */
3234 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3235 		return (EADDRNOTAVAIL);
3236 	}
3237 }
3238 
3239 void
3240 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3241     struct sctp_nets *net)
3242 {
3243 	struct sctp_asconf_addr *aa;
3244 	struct sctp_ifa *sctp_ifap;
3245 	struct sctp_asconf_tag_param *vtag;
3246 #ifdef INET
3247 	struct sockaddr_in *to;
3248 #endif
3249 #ifdef INET6
3250 	struct sockaddr_in6 *to6;
3251 #endif
3252 	if (net == NULL) {
3253 		SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3254 		return;
3255 	}
3256 	if (stcb == NULL) {
3257 		SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3258 		return;
3259 	}
3260 	/*
3261 	 * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3262 	 * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3263 	 */
3264 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3265 	    SCTP_M_ASC_ADDR);
3266 	if (aa == NULL) {
3267 		/* didn't get memory */
3268 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3269 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3270 		return;
3271 	}
3272 	aa->special_del = 0;
3273 	/* fill in asconf address parameter fields */
3274 	/* top level elements are "networked" during send */
3275 	aa->ifa = NULL;
3276 	aa->sent = 0;		/* clear sent flag */
3277 	vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3278 	vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3279 	vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3280 	vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3281 	vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3282 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3283 
3284 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3285 	    SCTP_M_ASC_ADDR);
3286 	if (aa == NULL) {
3287 		/* didn't get memory */
3288 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3289 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3290 		return;
3291 	}
3292 	memset(aa, 0, sizeof(struct sctp_asconf_addr));
3293 	/* fill in asconf address parameter fields */
3294 	/* ADD(0.0.0.0) */
3295 	switch (net->ro._l_addr.sa.sa_family) {
3296 #ifdef INET
3297 	case AF_INET:
3298 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3299 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3300 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3301 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3302 		/* No need to add an address, we are using 0.0.0.0 */
3303 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3304 		break;
3305 #endif
3306 #ifdef INET6
3307 	case AF_INET6:
3308 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3309 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3310 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3311 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3312 		/* No need to add an address, we are using 0.0.0.0 */
3313 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3314 		break;
3315 #endif
3316 	default:
3317 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3318 		    "sctp_asconf_send_nat_state_update: unknown address family\n");
3319 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3320 		return;
3321 	}
3322 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3323 	    SCTP_M_ASC_ADDR);
3324 	if (aa == NULL) {
3325 		/* didn't get memory */
3326 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3327 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3328 		return;
3329 	}
3330 	memset(aa, 0, sizeof(struct sctp_asconf_addr));
3331 	/* fill in asconf address parameter fields */
3332 	/* ADD(0.0.0.0) */
3333 	switch (net->ro._l_addr.sa.sa_family) {
3334 #ifdef INET
3335 	case AF_INET:
3336 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3337 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3338 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3339 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3340 		/* No need to add an address, we are using 0.0.0.0 */
3341 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3342 		break;
3343 #endif
3344 #ifdef INET6
3345 	case AF_INET6:
3346 		aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3347 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3348 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3349 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3350 		/* No need to add an address, we are using 0.0.0.0 */
3351 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3352 		break;
3353 #endif
3354 	default:
3355 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3356 		    "sctp_asconf_send_nat_state_update: unknown address family\n");
3357 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3358 		return;
3359 	}
3360 	/* Now we must hunt the addresses and add all global addresses */
3361 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3362 		struct sctp_vrf *vrf = NULL;
3363 		struct sctp_ifn *sctp_ifnp;
3364 		uint32_t vrf_id;
3365 
3366 		vrf_id = stcb->sctp_ep->def_vrf_id;
3367 		vrf = sctp_find_vrf(vrf_id);
3368 		if (vrf == NULL) {
3369 			goto skip_rest;
3370 		}
3371 		SCTP_IPI_ADDR_RLOCK();
3372 		LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3373 			LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3374 				switch (sctp_ifap->address.sa.sa_family) {
3375 #ifdef INET
3376 				case AF_INET:
3377 					to = &sctp_ifap->address.sin;
3378 					if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3379 					    &to->sin_addr) != 0) {
3380 						continue;
3381 					}
3382 					if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3383 						continue;
3384 					}
3385 					if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3386 						continue;
3387 					}
3388 					break;
3389 #endif
3390 #ifdef INET6
3391 				case AF_INET6:
3392 					to6 = &sctp_ifap->address.sin6;
3393 					if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3394 					    &to6->sin6_addr) != 0) {
3395 						continue;
3396 					}
3397 					if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3398 						continue;
3399 					}
3400 					if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3401 						continue;
3402 					}
3403 					break;
3404 #endif
3405 				default:
3406 					continue;
3407 				}
3408 				sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3409 			}
3410 		}
3411 		SCTP_IPI_ADDR_RUNLOCK();
3412 	} else {
3413 		struct sctp_laddr *laddr;
3414 
3415 		LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3416 			if (laddr->ifa == NULL) {
3417 				continue;
3418 			}
3419 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3420 				/*
3421 				 * Address being deleted by the system, dont
3422 				 * list.
3423 				 */
3424 				continue;
3425 			if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3426 				/*
3427 				 * Address being deleted on this ep don't
3428 				 * list.
3429 				 */
3430 				continue;
3431 			}
3432 			sctp_ifap = laddr->ifa;
3433 			switch (sctp_ifap->address.sa.sa_family) {
3434 #ifdef INET
3435 			case AF_INET:
3436 				to = &sctp_ifap->address.sin;
3437 				if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3438 					continue;
3439 				}
3440 				if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3441 					continue;
3442 				}
3443 				break;
3444 #endif
3445 #ifdef INET6
3446 			case AF_INET6:
3447 				to6 = &sctp_ifap->address.sin6;
3448 				if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3449 					continue;
3450 				}
3451 				if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3452 					continue;
3453 				}
3454 				break;
3455 #endif
3456 			default:
3457 				continue;
3458 			}
3459 			sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3460 		}
3461 	}
3462 skip_rest:
3463 	/* Now we must send the asconf into the queue */
3464 	sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3465 }
3466