xref: /freebsd/sys/netinet/sctp_asconf.c (revision da7d7b9c861cf98e912c0bd1e549752d2dae4fb6)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * a) Redistributions of source code must retain the above copyright notice,
10  *    this list of conditions and the following disclaimer.
11  *
12  * b) Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in
14  *    the documentation and/or other materials provided with the distribution.
15  *
16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <netinet/sctp_var.h>
38 #include <netinet/sctp_sysctl.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctputil.h>
42 #include <netinet/sctp_output.h>
43 #include <netinet/sctp_asconf.h>
44 #include <netinet/sctp_timer.h>
45 
46 /*
47  * debug flags:
48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
49  * SCTP_DEBUG_ASCONF2: detailed info
50  */
51 
52 
53 /*
54  * RFC 5061
55  *
56  * An ASCONF parameter queue exists per asoc which holds the pending address
57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
58  *
59  * A restricted_addrs list exists per assoc to hold local addresses that are
60  * not (yet) usable by the assoc as a source address.  These addresses are
61  * either pending an ASCONF operation (and exist on the ASCONF parameter
62  * queue), or they are permanently restricted (the peer has returned an
63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
64  *
65  * Deleted addresses are always immediately removed from the lists as they will
66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
67  * only if allowed.
68  */
69 
70 /*
71  * ASCONF parameter processing.
72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
75  */
76 static struct mbuf *
77 sctp_asconf_success_response(uint32_t id)
78 {
79 	struct mbuf *m_reply = NULL;
80 	struct sctp_asconf_paramhdr *aph;
81 
82 	m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
83 	    0, M_NOWAIT, 1, MT_DATA);
84 	if (m_reply == NULL) {
85 		SCTPDBG(SCTP_DEBUG_ASCONF1,
86 		    "asconf_success_response: couldn't get mbuf!\n");
87 		return (NULL);
88 	}
89 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
90 	aph->correlation_id = id;
91 	aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
92 	aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
93 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
94 	aph->ph.param_length = htons(aph->ph.param_length);
95 
96 	return (m_reply);
97 }
98 
99 static struct mbuf *
100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
101     uint16_t tlv_length)
102 {
103 	struct mbuf *m_reply = NULL;
104 	struct sctp_asconf_paramhdr *aph;
105 	struct sctp_error_cause *error;
106 	uint8_t *tlv;
107 
108 	m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
109 	    tlv_length +
110 	    sizeof(struct sctp_error_cause)),
111 	    0, M_NOWAIT, 1, MT_DATA);
112 	if (m_reply == NULL) {
113 		SCTPDBG(SCTP_DEBUG_ASCONF1,
114 		    "asconf_error_response: couldn't get mbuf!\n");
115 		return (NULL);
116 	}
117 	aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
118 	error = (struct sctp_error_cause *)(aph + 1);
119 
120 	aph->correlation_id = id;
121 	aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
122 	error->code = htons(cause);
123 	error->length = tlv_length + sizeof(struct sctp_error_cause);
124 	aph->ph.param_length = error->length +
125 	    sizeof(struct sctp_asconf_paramhdr);
126 
127 	if (aph->ph.param_length > MLEN) {
128 		SCTPDBG(SCTP_DEBUG_ASCONF1,
129 		    "asconf_error_response: tlv_length (%xh) too big\n",
130 		    tlv_length);
131 		sctp_m_freem(m_reply);	/* discard */
132 		return (NULL);
133 	}
134 	if (error_tlv != NULL) {
135 		tlv = (uint8_t *) (error + 1);
136 		memcpy(tlv, error_tlv, tlv_length);
137 	}
138 	SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
139 	error->length = htons(error->length);
140 	aph->ph.param_length = htons(aph->ph.param_length);
141 
142 	return (m_reply);
143 }
144 
145 static struct mbuf *
146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
147     struct sctp_tcb *stcb, int send_hb, int response_required)
148 {
149 	struct sctp_nets *net;
150 	struct mbuf *m_reply = NULL;
151 	union sctp_sockstore store;
152 	struct sctp_paramhdr *ph;
153 	uint16_t param_type, aparam_length;
154 
155 #if defined(INET) || defined(INET6)
156 	uint16_t param_length;
157 
158 #endif
159 	struct sockaddr *sa;
160 	int zero_address = 0;
161 	int bad_address = 0;
162 
163 #ifdef INET
164 	struct sockaddr_in *sin;
165 	struct sctp_ipv4addr_param *v4addr;
166 
167 #endif
168 #ifdef INET6
169 	struct sockaddr_in6 *sin6;
170 	struct sctp_ipv6addr_param *v6addr;
171 
172 #endif
173 
174 	aparam_length = ntohs(aph->ph.param_length);
175 	ph = (struct sctp_paramhdr *)(aph + 1);
176 	param_type = ntohs(ph->param_type);
177 #if defined(INET) || defined(INET6)
178 	param_length = ntohs(ph->param_length);
179 #endif
180 	sa = &store.sa;
181 	switch (param_type) {
182 #ifdef INET
183 	case SCTP_IPV4_ADDRESS:
184 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
185 			/* invalid param size */
186 			return (NULL);
187 		}
188 		v4addr = (struct sctp_ipv4addr_param *)ph;
189 		sin = &store.sin;
190 		bzero(sin, sizeof(*sin));
191 		sin->sin_family = AF_INET;
192 		sin->sin_len = sizeof(struct sockaddr_in);
193 		sin->sin_port = stcb->rport;
194 		sin->sin_addr.s_addr = v4addr->addr;
195 		if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
196 		    IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
197 			bad_address = 1;
198 		}
199 		if (sin->sin_addr.s_addr == INADDR_ANY)
200 			zero_address = 1;
201 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
202 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
203 		break;
204 #endif
205 #ifdef INET6
206 	case SCTP_IPV6_ADDRESS:
207 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
208 			/* invalid param size */
209 			return (NULL);
210 		}
211 		v6addr = (struct sctp_ipv6addr_param *)ph;
212 		sin6 = &store.sin6;
213 		bzero(sin6, sizeof(*sin6));
214 		sin6->sin6_family = AF_INET6;
215 		sin6->sin6_len = sizeof(struct sockaddr_in6);
216 		sin6->sin6_port = stcb->rport;
217 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
218 		    sizeof(struct in6_addr));
219 		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
220 			bad_address = 1;
221 		}
222 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
223 			zero_address = 1;
224 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
225 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
226 		break;
227 #endif
228 	default:
229 		m_reply = sctp_asconf_error_response(aph->correlation_id,
230 		    SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
231 		    aparam_length);
232 		return (m_reply);
233 	}			/* end switch */
234 
235 	/* if 0.0.0.0/::0, add the source address instead */
236 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
237 		sa = src;
238 		SCTPDBG(SCTP_DEBUG_ASCONF1,
239 		    "process_asconf_add_ip: using source addr ");
240 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
241 	}
242 	/* add the address */
243 	if (bad_address) {
244 		m_reply = sctp_asconf_error_response(aph->correlation_id,
245 		    SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
246 		    aparam_length);
247 	} else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
248 	    SCTP_ADDR_DYNAMIC_ADDED) != 0) {
249 		SCTPDBG(SCTP_DEBUG_ASCONF1,
250 		    "process_asconf_add_ip: error adding address\n");
251 		m_reply = sctp_asconf_error_response(aph->correlation_id,
252 		    SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
253 		    aparam_length);
254 	} else {
255 		/* notify upper layer */
256 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
257 		if (response_required) {
258 			m_reply =
259 			    sctp_asconf_success_response(aph->correlation_id);
260 		}
261 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
262 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
263 		    stcb, net);
264 		if (send_hb) {
265 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
266 		}
267 	}
268 	return (m_reply);
269 }
270 
271 static int
272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
273 {
274 	struct sctp_nets *src_net, *net;
275 
276 	/* make sure the source address exists as a destination net */
277 	src_net = sctp_findnet(stcb, src);
278 	if (src_net == NULL) {
279 		/* not found */
280 		return (-1);
281 	}
282 	/* delete all destination addresses except the source */
283 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
284 		if (net != src_net) {
285 			/* delete this address */
286 			sctp_remove_net(stcb, net);
287 			SCTPDBG(SCTP_DEBUG_ASCONF1,
288 			    "asconf_del_remote_addrs_except: deleting ");
289 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
290 			    (struct sockaddr *)&net->ro._l_addr);
291 			/* notify upper layer */
292 			sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
293 			    (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
294 		}
295 	}
296 	return (0);
297 }
298 
299 static struct mbuf *
300 sctp_process_asconf_delete_ip(struct sockaddr *src,
301     struct sctp_asconf_paramhdr *aph,
302     struct sctp_tcb *stcb, int response_required)
303 {
304 	struct mbuf *m_reply = NULL;
305 	union sctp_sockstore store;
306 	struct sctp_paramhdr *ph;
307 	uint16_t param_type, aparam_length;
308 
309 #if defined(INET) || defined(INET6)
310 	uint16_t param_length;
311 
312 #endif
313 	struct sockaddr *sa;
314 	int zero_address = 0;
315 	int result;
316 
317 #ifdef INET
318 	struct sockaddr_in *sin;
319 	struct sctp_ipv4addr_param *v4addr;
320 
321 #endif
322 #ifdef INET6
323 	struct sockaddr_in6 *sin6;
324 	struct sctp_ipv6addr_param *v6addr;
325 
326 #endif
327 
328 	aparam_length = ntohs(aph->ph.param_length);
329 	ph = (struct sctp_paramhdr *)(aph + 1);
330 	param_type = ntohs(ph->param_type);
331 #if defined(INET) || defined(INET6)
332 	param_length = ntohs(ph->param_length);
333 #endif
334 	sa = &store.sa;
335 	switch (param_type) {
336 #ifdef INET
337 	case SCTP_IPV4_ADDRESS:
338 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
339 			/* invalid param size */
340 			return (NULL);
341 		}
342 		v4addr = (struct sctp_ipv4addr_param *)ph;
343 		sin = &store.sin;
344 		bzero(sin, sizeof(*sin));
345 		sin->sin_family = AF_INET;
346 		sin->sin_len = sizeof(struct sockaddr_in);
347 		sin->sin_port = stcb->rport;
348 		sin->sin_addr.s_addr = v4addr->addr;
349 		if (sin->sin_addr.s_addr == INADDR_ANY)
350 			zero_address = 1;
351 		SCTPDBG(SCTP_DEBUG_ASCONF1,
352 		    "process_asconf_delete_ip: deleting ");
353 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
354 		break;
355 #endif
356 #ifdef INET6
357 	case SCTP_IPV6_ADDRESS:
358 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
359 			/* invalid param size */
360 			return (NULL);
361 		}
362 		v6addr = (struct sctp_ipv6addr_param *)ph;
363 		sin6 = &store.sin6;
364 		bzero(sin6, sizeof(*sin6));
365 		sin6->sin6_family = AF_INET6;
366 		sin6->sin6_len = sizeof(struct sockaddr_in6);
367 		sin6->sin6_port = stcb->rport;
368 		memcpy(&sin6->sin6_addr, v6addr->addr,
369 		    sizeof(struct in6_addr));
370 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
371 			zero_address = 1;
372 		SCTPDBG(SCTP_DEBUG_ASCONF1,
373 		    "process_asconf_delete_ip: deleting ");
374 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
375 		break;
376 #endif
377 	default:
378 		m_reply = sctp_asconf_error_response(aph->correlation_id,
379 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
380 		    aparam_length);
381 		return (m_reply);
382 	}
383 
384 	/* make sure the source address is not being deleted */
385 	if (sctp_cmpaddr(sa, src)) {
386 		/* trying to delete the source address! */
387 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
388 		m_reply = sctp_asconf_error_response(aph->correlation_id,
389 		    SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
390 		    aparam_length);
391 		return (m_reply);
392 	}
393 	/* if deleting 0.0.0.0/::0, delete all addresses except src addr */
394 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
395 		result = sctp_asconf_del_remote_addrs_except(stcb, src);
396 
397 		if (result) {
398 			/* src address did not exist? */
399 			SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
400 			/* what error to reply with?? */
401 			m_reply =
402 			    sctp_asconf_error_response(aph->correlation_id,
403 			    SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
404 			    aparam_length);
405 		} else if (response_required) {
406 			m_reply =
407 			    sctp_asconf_success_response(aph->correlation_id);
408 		}
409 		return (m_reply);
410 	}
411 	/* delete the address */
412 	result = sctp_del_remote_addr(stcb, sa);
413 	/*
414 	 * note if result == -2, the address doesn't exist in the asoc but
415 	 * since it's being deleted anyways, we just ack the delete -- but
416 	 * this probably means something has already gone awry
417 	 */
418 	if (result == -1) {
419 		/* only one address in the asoc */
420 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
421 		m_reply = sctp_asconf_error_response(aph->correlation_id,
422 		    SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
423 		    aparam_length);
424 	} else {
425 		if (response_required) {
426 			m_reply = sctp_asconf_success_response(aph->correlation_id);
427 		}
428 		/* notify upper layer */
429 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
430 	}
431 	return (m_reply);
432 }
433 
434 static struct mbuf *
435 sctp_process_asconf_set_primary(struct sockaddr *src,
436     struct sctp_asconf_paramhdr *aph,
437     struct sctp_tcb *stcb, int response_required)
438 {
439 	struct mbuf *m_reply = NULL;
440 	union sctp_sockstore store;
441 	struct sctp_paramhdr *ph;
442 	uint16_t param_type, aparam_length;
443 
444 #if defined(INET) || defined(INET6)
445 	uint16_t param_length;
446 
447 #endif
448 	struct sockaddr *sa;
449 	int zero_address = 0;
450 
451 #ifdef INET
452 	struct sockaddr_in *sin;
453 	struct sctp_ipv4addr_param *v4addr;
454 
455 #endif
456 #ifdef INET6
457 	struct sockaddr_in6 *sin6;
458 	struct sctp_ipv6addr_param *v6addr;
459 
460 #endif
461 
462 	aparam_length = ntohs(aph->ph.param_length);
463 	ph = (struct sctp_paramhdr *)(aph + 1);
464 	param_type = ntohs(ph->param_type);
465 #if defined(INET) || defined(INET6)
466 	param_length = ntohs(ph->param_length);
467 #endif
468 	sa = &store.sa;
469 	switch (param_type) {
470 #ifdef INET
471 	case SCTP_IPV4_ADDRESS:
472 		if (param_length != sizeof(struct sctp_ipv4addr_param)) {
473 			/* invalid param size */
474 			return (NULL);
475 		}
476 		v4addr = (struct sctp_ipv4addr_param *)ph;
477 		sin = &store.sin;
478 		bzero(sin, sizeof(*sin));
479 		sin->sin_family = AF_INET;
480 		sin->sin_len = sizeof(struct sockaddr_in);
481 		sin->sin_addr.s_addr = v4addr->addr;
482 		if (sin->sin_addr.s_addr == INADDR_ANY)
483 			zero_address = 1;
484 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
485 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
486 		break;
487 #endif
488 #ifdef INET6
489 	case SCTP_IPV6_ADDRESS:
490 		if (param_length != sizeof(struct sctp_ipv6addr_param)) {
491 			/* invalid param size */
492 			return (NULL);
493 		}
494 		v6addr = (struct sctp_ipv6addr_param *)ph;
495 		sin6 = &store.sin6;
496 		bzero(sin6, sizeof(*sin6));
497 		sin6->sin6_family = AF_INET6;
498 		sin6->sin6_len = sizeof(struct sockaddr_in6);
499 		memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
500 		    sizeof(struct in6_addr));
501 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
502 			zero_address = 1;
503 		SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
504 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
505 		break;
506 #endif
507 	default:
508 		m_reply = sctp_asconf_error_response(aph->correlation_id,
509 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
510 		    aparam_length);
511 		return (m_reply);
512 	}
513 
514 	/* if 0.0.0.0/::0, use the source address instead */
515 	if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
516 		sa = src;
517 		SCTPDBG(SCTP_DEBUG_ASCONF1,
518 		    "process_asconf_set_primary: using source addr ");
519 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
520 	}
521 	/* set the primary address */
522 	if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
523 		SCTPDBG(SCTP_DEBUG_ASCONF1,
524 		    "process_asconf_set_primary: primary address set\n");
525 		/* notify upper layer */
526 		sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
527 		if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
528 		    (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
529 		    (stcb->asoc.alternate)) {
530 			sctp_free_remote_addr(stcb->asoc.alternate);
531 			stcb->asoc.alternate = NULL;
532 		}
533 		if (response_required) {
534 			m_reply = sctp_asconf_success_response(aph->correlation_id);
535 		}
536 		/*
537 		 * Mobility adaptation. Ideally, when the reception of SET
538 		 * PRIMARY with DELETE IP ADDRESS of the previous primary
539 		 * destination, unacknowledged DATA are retransmitted
540 		 * immediately to the new primary destination for seamless
541 		 * handover. If the destination is UNCONFIRMED and marked to
542 		 * REQ_PRIM, The retransmission occur when reception of the
543 		 * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
544 		 * sctp_input.c) Also, when change of the primary
545 		 * destination, it is better that all subsequent new DATA
546 		 * containing already queued DATA are transmitted to the new
547 		 * primary destination. (by micchie)
548 		 */
549 		if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
550 		    SCTP_MOBILITY_BASE) ||
551 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
552 		    SCTP_MOBILITY_FASTHANDOFF)) &&
553 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
554 		    SCTP_MOBILITY_PRIM_DELETED) &&
555 		    (stcb->asoc.primary_destination->dest_state &
556 		    SCTP_ADDR_UNCONFIRMED) == 0) {
557 
558 			sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
559 			    stcb->sctp_ep, stcb, NULL,
560 			    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
561 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
562 			    SCTP_MOBILITY_FASTHANDOFF)) {
563 				sctp_assoc_immediate_retrans(stcb,
564 				    stcb->asoc.primary_destination);
565 			}
566 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
567 			    SCTP_MOBILITY_BASE)) {
568 				sctp_move_chunks_from_net(stcb,
569 				    stcb->asoc.deleted_primary);
570 			}
571 			sctp_delete_prim_timer(stcb->sctp_ep, stcb,
572 			    stcb->asoc.deleted_primary);
573 		}
574 	} else {
575 		/* couldn't set the requested primary address! */
576 		SCTPDBG(SCTP_DEBUG_ASCONF1,
577 		    "process_asconf_set_primary: set primary failed!\n");
578 		/* must have been an invalid address, so report */
579 		m_reply = sctp_asconf_error_response(aph->correlation_id,
580 		    SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
581 		    aparam_length);
582 	}
583 
584 	return (m_reply);
585 }
586 
587 /*
588  * handles an ASCONF chunk.
589  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
590  */
591 void
592 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
593     struct sockaddr *src,
594     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
595     int first)
596 {
597 	struct sctp_association *asoc;
598 	uint32_t serial_num;
599 	struct mbuf *n, *m_ack, *m_result, *m_tail;
600 	struct sctp_asconf_ack_chunk *ack_cp;
601 	struct sctp_asconf_paramhdr *aph;
602 	struct sctp_ipv6addr_param *p_addr;
603 	unsigned int asconf_limit, cnt;
604 	int error = 0;		/* did an error occur? */
605 
606 	/* asconf param buffer */
607 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
608 	struct sctp_asconf_ack *ack, *ack_next;
609 
610 	/* verify minimum length */
611 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
612 		SCTPDBG(SCTP_DEBUG_ASCONF1,
613 		    "handle_asconf: chunk too small = %xh\n",
614 		    ntohs(cp->ch.chunk_length));
615 		return;
616 	}
617 	asoc = &stcb->asoc;
618 	serial_num = ntohl(cp->serial_number);
619 
620 	if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
621 		/* got a duplicate ASCONF */
622 		SCTPDBG(SCTP_DEBUG_ASCONF1,
623 		    "handle_asconf: got duplicate serial number = %xh\n",
624 		    serial_num);
625 		return;
626 	} else if (serial_num != (asoc->asconf_seq_in + 1)) {
627 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
628 		    serial_num, asoc->asconf_seq_in + 1);
629 		return;
630 	}
631 	/* it's the expected "next" sequence number, so process it */
632 	asoc->asconf_seq_in = serial_num;	/* update sequence */
633 	/* get length of all the param's in the ASCONF */
634 	asconf_limit = offset + ntohs(cp->ch.chunk_length);
635 	SCTPDBG(SCTP_DEBUG_ASCONF1,
636 	    "handle_asconf: asconf_limit=%u, sequence=%xh\n",
637 	    asconf_limit, serial_num);
638 
639 	if (first) {
640 		/* delete old cache */
641 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
642 
643 		TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
644 			if (ack->serial_number == serial_num)
645 				break;
646 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
647 			    ack->serial_number, serial_num);
648 			TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
649 			if (ack->data != NULL) {
650 				sctp_m_freem(ack->data);
651 			}
652 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
653 		}
654 	}
655 	m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
656 	    M_NOWAIT, 1, MT_DATA);
657 	if (m_ack == NULL) {
658 		SCTPDBG(SCTP_DEBUG_ASCONF1,
659 		    "handle_asconf: couldn't get mbuf!\n");
660 		return;
661 	}
662 	m_tail = m_ack;		/* current reply chain's tail */
663 
664 	/* fill in ASCONF-ACK header */
665 	ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
666 	ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
667 	ack_cp->ch.chunk_flags = 0;
668 	ack_cp->serial_number = htonl(serial_num);
669 	/* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
670 	SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
671 	ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
672 
673 	/* skip the lookup address parameter */
674 	offset += sizeof(struct sctp_asconf_chunk);
675 	p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
676 	if (p_addr == NULL) {
677 		SCTPDBG(SCTP_DEBUG_ASCONF1,
678 		    "handle_asconf: couldn't get lookup addr!\n");
679 		/* respond with a missing/invalid mandatory parameter error */
680 		return;
681 	}
682 	/* param_length is already validated in process_control... */
683 	offset += ntohs(p_addr->ph.param_length);	/* skip lookup addr */
684 	/* get pointer to first asconf param in ASCONF */
685 	aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
686 	if (aph == NULL) {
687 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
688 		goto send_reply;
689 	}
690 	/* process through all parameters */
691 	cnt = 0;
692 	while (aph != NULL) {
693 		unsigned int param_length, param_type;
694 
695 		param_type = ntohs(aph->ph.param_type);
696 		param_length = ntohs(aph->ph.param_length);
697 		if (offset + param_length > asconf_limit) {
698 			/* parameter goes beyond end of chunk! */
699 			sctp_m_freem(m_ack);
700 			return;
701 		}
702 		m_result = NULL;
703 
704 		if (param_length > sizeof(aparam_buf)) {
705 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
706 			sctp_m_freem(m_ack);
707 			return;
708 		}
709 		if (param_length <= sizeof(struct sctp_paramhdr)) {
710 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
711 			sctp_m_freem(m_ack);
712 		}
713 		/* get the entire parameter */
714 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
715 		if (aph == NULL) {
716 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
717 			sctp_m_freem(m_ack);
718 			return;
719 		}
720 		switch (param_type) {
721 		case SCTP_ADD_IP_ADDRESS:
722 			m_result = sctp_process_asconf_add_ip(src, aph, stcb,
723 			    (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
724 			cnt++;
725 			break;
726 		case SCTP_DEL_IP_ADDRESS:
727 			m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
728 			    error);
729 			break;
730 		case SCTP_ERROR_CAUSE_IND:
731 			/* not valid in an ASCONF chunk */
732 			break;
733 		case SCTP_SET_PRIM_ADDR:
734 			m_result = sctp_process_asconf_set_primary(src, aph,
735 			    stcb, error);
736 			break;
737 		case SCTP_NAT_VTAGS:
738 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
739 			break;
740 		case SCTP_SUCCESS_REPORT:
741 			/* not valid in an ASCONF chunk */
742 			break;
743 		case SCTP_ULP_ADAPTATION:
744 			/* FIX */
745 			break;
746 		default:
747 			if ((param_type & 0x8000) == 0) {
748 				/* Been told to STOP at this param */
749 				asconf_limit = offset;
750 				/*
751 				 * FIX FIX - We need to call
752 				 * sctp_arethere_unrecognized_parameters()
753 				 * to get a operr and send it for any
754 				 * param's with the 0x4000 bit set OR do it
755 				 * here ourselves... note we still must STOP
756 				 * if the 0x8000 bit is clear.
757 				 */
758 			}
759 			/* unknown/invalid param type */
760 			break;
761 		}		/* switch */
762 
763 		/* add any (error) result to the reply mbuf chain */
764 		if (m_result != NULL) {
765 			SCTP_BUF_NEXT(m_tail) = m_result;
766 			m_tail = m_result;
767 			/* update lengths, make sure it's aligned too */
768 			SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
769 			ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
770 			/* set flag to force success reports */
771 			error = 1;
772 		}
773 		offset += SCTP_SIZE32(param_length);
774 		/* update remaining ASCONF message length to process */
775 		if (offset >= asconf_limit) {
776 			/* no more data in the mbuf chain */
777 			break;
778 		}
779 		/* get pointer to next asconf param */
780 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
781 		    sizeof(struct sctp_asconf_paramhdr),
782 		    (uint8_t *) & aparam_buf);
783 		if (aph == NULL) {
784 			/* can't get an asconf paramhdr */
785 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
786 			/* FIX ME - add error here... */
787 		}
788 	}
789 
790 send_reply:
791 	ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
792 	/* save the ASCONF-ACK reply */
793 	ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
794 	    struct sctp_asconf_ack);
795 	if (ack == NULL) {
796 		sctp_m_freem(m_ack);
797 		return;
798 	}
799 	ack->serial_number = serial_num;
800 	ack->last_sent_to = NULL;
801 	ack->data = m_ack;
802 	ack->len = 0;
803 	for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
804 		ack->len += SCTP_BUF_LEN(n);
805 	}
806 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
807 
808 	/* see if last_control_chunk_from is set properly (use IP src addr) */
809 	if (stcb->asoc.last_control_chunk_from == NULL) {
810 		/*
811 		 * this could happen if the source address was just newly
812 		 * added
813 		 */
814 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
815 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
816 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
817 		/* look up the from address */
818 		stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
819 #ifdef SCTP_DEBUG
820 		if (stcb->asoc.last_control_chunk_from == NULL) {
821 			SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
822 		}
823 #endif
824 	}
825 }
826 
827 /*
828  * does the address match? returns 0 if not, 1 if so
829  */
830 static uint32_t
831 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
832 {
833 	switch (sa->sa_family) {
834 #ifdef INET6
835 	case AF_INET6:
836 		{
837 			/* XXX scopeid */
838 			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
839 
840 			if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
841 			    (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
842 			    sizeof(struct in6_addr)) == 0)) {
843 				return (1);
844 			}
845 			break;
846 		}
847 #endif
848 #ifdef INET
849 	case AF_INET:
850 		{
851 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
852 
853 			if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
854 			    (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
855 			    sizeof(struct in_addr)) == 0)) {
856 				return (1);
857 			}
858 			break;
859 		}
860 #endif
861 	default:
862 		break;
863 	}
864 	return (0);
865 }
866 
867 /*
868  * does the address match? returns 0 if not, 1 if so
869  */
870 static uint32_t
871 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
872 {
873 #if defined(INET) || defined(INET6)
874 	uint16_t param_type, param_length;
875 
876 	param_type = ntohs(ph->param_type);
877 	param_length = ntohs(ph->param_length);
878 #endif
879 	switch (sa->sa_family) {
880 #ifdef INET6
881 	case AF_INET6:
882 		{
883 			/* XXX scopeid */
884 			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
885 			struct sctp_ipv6addr_param *v6addr;
886 
887 			v6addr = (struct sctp_ipv6addr_param *)ph;
888 			if ((param_type == SCTP_IPV6_ADDRESS) &&
889 			    (param_length == sizeof(struct sctp_ipv6addr_param)) &&
890 			    (memcmp(&v6addr->addr, &sin6->sin6_addr,
891 			    sizeof(struct in6_addr)) == 0)) {
892 				return (1);
893 			}
894 			break;
895 		}
896 #endif
897 #ifdef INET
898 	case AF_INET:
899 		{
900 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
901 			struct sctp_ipv4addr_param *v4addr;
902 
903 			v4addr = (struct sctp_ipv4addr_param *)ph;
904 			if ((param_type == SCTP_IPV4_ADDRESS) &&
905 			    (param_length == sizeof(struct sctp_ipv4addr_param)) &&
906 			    (memcmp(&v4addr->addr, &sin->sin_addr,
907 			    sizeof(struct in_addr)) == 0)) {
908 				return (1);
909 			}
910 			break;
911 		}
912 #endif
913 	default:
914 		break;
915 	}
916 	return (0);
917 }
918 
919 /*
920  * Cleanup for non-responded/OP ERR'd ASCONF
921  */
922 void
923 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
924 {
925 	/*
926 	 * clear out any existing asconfs going out
927 	 */
928 	sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
929 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
930 	stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
931 	/* remove the old ASCONF on our outbound queue */
932 	sctp_toss_old_asconf(stcb);
933 }
934 
935 /*
936  * cleanup any cached source addresses that may be topologically
937  * incorrect after a new address has been added to this interface.
938  */
939 static void
940 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
941 {
942 	struct sctp_nets *net;
943 
944 	/*
945 	 * Ideally, we want to only clear cached routes and source addresses
946 	 * that are topologically incorrect.  But since there is no easy way
947 	 * to know whether the newly added address on the ifn would cause a
948 	 * routing change (i.e. a new egress interface would be chosen)
949 	 * without doing a new routing lookup and source address selection,
950 	 * we will (for now) just flush any cached route using a different
951 	 * ifn (and cached source addrs) and let output re-choose them
952 	 * during the next send on that net.
953 	 */
954 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
955 		/*
956 		 * clear any cached route (and cached source address) if the
957 		 * route's interface is NOT the same as the address change.
958 		 * If it's the same interface, just clear the cached source
959 		 * address.
960 		 */
961 		if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
962 		    ((ifn == NULL) ||
963 		    (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
964 			/* clear any cached route */
965 			RTFREE(net->ro.ro_rt);
966 			net->ro.ro_rt = NULL;
967 		}
968 		/* clear any cached source address */
969 		if (net->src_addr_selected) {
970 			sctp_free_ifa(net->ro._s_addr);
971 			net->ro._s_addr = NULL;
972 			net->src_addr_selected = 0;
973 		}
974 	}
975 }
976 
977 
978 void
979 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
980 {
981 	int error;
982 
983 	if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
984 		return;
985 	}
986 	if (stcb->asoc.deleted_primary == NULL) {
987 		return;
988 	}
989 	if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
990 		SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
991 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
992 		SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
993 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
994 		sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
995 		    stcb->asoc.deleted_primary,
996 		    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
997 		stcb->asoc.num_send_timers_up--;
998 		if (stcb->asoc.num_send_timers_up < 0) {
999 			stcb->asoc.num_send_timers_up = 0;
1000 		}
1001 		SCTP_TCB_LOCK_ASSERT(stcb);
1002 		error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1003 		    stcb->asoc.deleted_primary);
1004 		if (error) {
1005 			SCTP_INP_DECR_REF(stcb->sctp_ep);
1006 			return;
1007 		}
1008 		SCTP_TCB_LOCK_ASSERT(stcb);
1009 #ifdef SCTP_AUDITING_ENABLED
1010 		sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1011 #endif
1012 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1013 		if ((stcb->asoc.num_send_timers_up == 0) &&
1014 		    (stcb->asoc.sent_queue_cnt > 0)) {
1015 			struct sctp_tmit_chunk *chk;
1016 
1017 			chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1018 			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1019 			    stcb, chk->whoTo);
1020 		}
1021 	}
1022 	return;
1023 }
1024 
1025 static int
1026     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1027 
1028 void
1029 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1030 {
1031 	struct sctp_tmit_chunk *chk;
1032 
1033 	SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1034 	sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1035 	    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1036 	stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1037 	net->error_count = 0;
1038 	TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1039 		if (chk->whoTo == net) {
1040 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
1041 				chk->sent = SCTP_DATAGRAM_RESEND;
1042 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1043 				sctp_flight_size_decrease(chk);
1044 				sctp_total_flight_decrease(stcb, chk);
1045 				net->marked_retrans++;
1046 				stcb->asoc.marked_retrans++;
1047 			}
1048 		}
1049 	}
1050 	if (net->marked_retrans) {
1051 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1052 	}
1053 }
1054 
1055 static void
1056 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1057 {
1058 	struct sctp_nets *net;
1059 	int addrnum, changed;
1060 
1061 	/*
1062 	 * If number of local valid addresses is 1, the valid address is
1063 	 * probably newly added address. Several valid addresses in this
1064 	 * association.  A source address may not be changed.  Additionally,
1065 	 * they can be configured on a same interface as "alias" addresses.
1066 	 * (by micchie)
1067 	 */
1068 	addrnum = sctp_local_addr_count(stcb);
1069 	SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1070 	    addrnum);
1071 	if (addrnum == 1) {
1072 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1073 			/* clear any cached route and source address */
1074 			if (net->ro.ro_rt) {
1075 				RTFREE(net->ro.ro_rt);
1076 				net->ro.ro_rt = NULL;
1077 			}
1078 			if (net->src_addr_selected) {
1079 				sctp_free_ifa(net->ro._s_addr);
1080 				net->ro._s_addr = NULL;
1081 				net->src_addr_selected = 0;
1082 			}
1083 			/* Retransmit unacknowledged DATA chunks immediately */
1084 			if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1085 			    SCTP_MOBILITY_FASTHANDOFF)) {
1086 				sctp_net_immediate_retrans(stcb, net);
1087 			}
1088 			/* also, SET PRIMARY is maybe already sent */
1089 		}
1090 		return;
1091 	}
1092 	/* Multiple local addresses exsist in the association.  */
1093 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1094 		/* clear any cached route and source address */
1095 		if (net->ro.ro_rt) {
1096 			RTFREE(net->ro.ro_rt);
1097 			net->ro.ro_rt = NULL;
1098 		}
1099 		if (net->src_addr_selected) {
1100 			sctp_free_ifa(net->ro._s_addr);
1101 			net->ro._s_addr = NULL;
1102 			net->src_addr_selected = 0;
1103 		}
1104 		/*
1105 		 * Check if the nexthop is corresponding to the new address.
1106 		 * If the new address is corresponding to the current
1107 		 * nexthop, the path will be changed. If the new address is
1108 		 * NOT corresponding to the current nexthop, the path will
1109 		 * not be changed.
1110 		 */
1111 		SCTP_RTALLOC((sctp_route_t *) & net->ro,
1112 		    stcb->sctp_ep->def_vrf_id,
1113 		    stcb->sctp_ep->fibnum);
1114 		if (net->ro.ro_rt == NULL)
1115 			continue;
1116 
1117 		changed = 0;
1118 		switch (net->ro._l_addr.sa.sa_family) {
1119 #ifdef INET
1120 		case AF_INET:
1121 			if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1122 				changed = 1;
1123 			}
1124 			break;
1125 #endif
1126 #ifdef INET6
1127 		case AF_INET6:
1128 			if (sctp_v6src_match_nexthop(
1129 			    &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1130 				changed = 1;
1131 			}
1132 			break;
1133 #endif
1134 		default:
1135 			break;
1136 		}
1137 		/*
1138 		 * if the newly added address does not relate routing
1139 		 * information, we skip.
1140 		 */
1141 		if (changed == 0)
1142 			continue;
1143 		/* Retransmit unacknowledged DATA chunks immediately */
1144 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1145 		    SCTP_MOBILITY_FASTHANDOFF)) {
1146 			sctp_net_immediate_retrans(stcb, net);
1147 		}
1148 		/* Send SET PRIMARY for this new address */
1149 		if (net == stcb->asoc.primary_destination) {
1150 			(void)sctp_asconf_queue_mgmt(stcb, newifa,
1151 			    SCTP_SET_PRIM_ADDR);
1152 		}
1153 	}
1154 }
1155 
1156 /*
1157  * process an ADD/DELETE IP ack from peer.
1158  * addr: corresponding sctp_ifa to the address being added/deleted.
1159  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1160  * flag: 1=success, 0=failure.
1161  */
1162 static void
1163 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1164 {
1165 	/*
1166 	 * do the necessary asoc list work- if we get a failure indication,
1167 	 * leave the address on the assoc's restricted list.  If we get a
1168 	 * success indication, remove the address from the restricted list.
1169 	 */
1170 	/*
1171 	 * Note: this will only occur for ADD_IP_ADDRESS, since
1172 	 * DEL_IP_ADDRESS is never actually added to the list...
1173 	 */
1174 	if (flag) {
1175 		/* success case, so remove from the restricted list */
1176 		sctp_del_local_addr_restricted(stcb, addr);
1177 
1178 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1179 		    SCTP_MOBILITY_BASE) ||
1180 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
1181 		    SCTP_MOBILITY_FASTHANDOFF)) {
1182 			sctp_path_check_and_react(stcb, addr);
1183 			return;
1184 		}
1185 		/* clear any cached/topologically incorrect source addresses */
1186 		sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1187 	}
1188 	/* else, leave it on the list */
1189 }
1190 
1191 /*
1192  * add an asconf add/delete/set primary IP address parameter to the queue.
1193  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1194  * returns 0 if queued, -1 if not queued/removed.
1195  * NOTE: if adding, but a delete for the same address is already scheduled
1196  * (and not yet sent out), simply remove it from queue.  Same for deleting
1197  * an address already scheduled for add.  If a duplicate operation is found,
1198  * ignore the new one.
1199  */
1200 static int
1201 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1202     uint16_t type)
1203 {
1204 	struct sctp_asconf_addr *aa, *aa_next;
1205 
1206 	/* make sure the request isn't already in the queue */
1207 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1208 		/* address match? */
1209 		if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1210 			continue;
1211 		/*
1212 		 * is the request already in queue but not sent? pass the
1213 		 * request already sent in order to resolve the following
1214 		 * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1215 		 * can't remove the ADD request already sent 3. arrival of
1216 		 * ADD
1217 		 */
1218 		if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1219 			return (-1);
1220 		}
1221 		/* is the negative request already in queue, and not sent */
1222 		if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1223 		    (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1224 			/* add requested, delete already queued */
1225 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1226 			/* remove the ifa from the restricted list */
1227 			sctp_del_local_addr_restricted(stcb, ifa);
1228 			/* free the asconf param */
1229 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1230 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1231 			return (-1);
1232 		}
1233 		if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1234 		    (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1235 			/* delete requested, add already queued */
1236 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1237 			/* remove the aa->ifa from the restricted list */
1238 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1239 			/* free the asconf param */
1240 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1241 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1242 			return (-1);
1243 		}
1244 	}			/* for each aa */
1245 
1246 	/* adding new request to the queue */
1247 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1248 	    SCTP_M_ASC_ADDR);
1249 	if (aa == NULL) {
1250 		/* didn't get memory */
1251 		SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1252 		return (-1);
1253 	}
1254 	aa->special_del = 0;
1255 	/* fill in asconf address parameter fields */
1256 	/* top level elements are "networked" during send */
1257 	aa->ap.aph.ph.param_type = type;
1258 	aa->ifa = ifa;
1259 	atomic_add_int(&ifa->refcount, 1);
1260 	/* correlation_id filled in during send routine later... */
1261 	switch (ifa->address.sa.sa_family) {
1262 #ifdef INET6
1263 	case AF_INET6:
1264 		{
1265 			struct sockaddr_in6 *sin6;
1266 
1267 			sin6 = &ifa->address.sin6;
1268 			aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1269 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1270 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1271 			    sizeof(struct sctp_ipv6addr_param);
1272 			memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1273 			    sizeof(struct in6_addr));
1274 			break;
1275 		}
1276 #endif
1277 #ifdef INET
1278 	case AF_INET:
1279 		{
1280 			struct sockaddr_in *sin;
1281 
1282 			sin = &ifa->address.sin;
1283 			aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1284 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1285 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1286 			    sizeof(struct sctp_ipv4addr_param);
1287 			memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1288 			    sizeof(struct in_addr));
1289 			break;
1290 		}
1291 #endif
1292 	default:
1293 		/* invalid family! */
1294 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1295 		sctp_free_ifa(ifa);
1296 		return (-1);
1297 	}
1298 	aa->sent = 0;		/* clear sent flag */
1299 
1300 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1301 #ifdef SCTP_DEBUG
1302 	if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1303 		if (type == SCTP_ADD_IP_ADDRESS) {
1304 			SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1305 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1306 		} else if (type == SCTP_DEL_IP_ADDRESS) {
1307 			SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1308 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1309 		} else {
1310 			SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1311 			SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1312 		}
1313 	}
1314 #endif
1315 
1316 	return (0);
1317 }
1318 
1319 
1320 /*
1321  * add an asconf operation for the given ifa and type.
1322  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1323  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1324  * advisable.
1325  */
1326 static int
1327 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1328     uint16_t type)
1329 {
1330 	uint32_t status;
1331 	int pending_delete_queued = 0;
1332 	int last;
1333 
1334 	/* see if peer supports ASCONF */
1335 	if (stcb->asoc.asconf_supported == 0) {
1336 		return (-1);
1337 	}
1338 	/*
1339 	 * if this is deleting the last address from the assoc, mark it as
1340 	 * pending.
1341 	 */
1342 	if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1343 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1344 			last = (sctp_local_addr_count(stcb) == 0);
1345 		} else {
1346 			last = (sctp_local_addr_count(stcb) == 1);
1347 		}
1348 		if (last) {
1349 			/* set the pending delete info only */
1350 			stcb->asoc.asconf_del_pending = 1;
1351 			stcb->asoc.asconf_addr_del_pending = ifa;
1352 			atomic_add_int(&ifa->refcount, 1);
1353 			SCTPDBG(SCTP_DEBUG_ASCONF2,
1354 			    "asconf_queue_add: mark delete last address pending\n");
1355 			return (-1);
1356 		}
1357 	}
1358 	/* queue an asconf parameter */
1359 	status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1360 
1361 	/*
1362 	 * if this is an add, and there is a delete also pending (i.e. the
1363 	 * last local address is being changed), queue the pending delete
1364 	 * too.
1365 	 */
1366 	if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1367 		/* queue in the pending delete */
1368 		if (sctp_asconf_queue_mgmt(stcb,
1369 		    stcb->asoc.asconf_addr_del_pending,
1370 		    SCTP_DEL_IP_ADDRESS) == 0) {
1371 			SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1372 			pending_delete_queued = 1;
1373 			/* clear out the pending delete info */
1374 			stcb->asoc.asconf_del_pending = 0;
1375 			sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1376 			stcb->asoc.asconf_addr_del_pending = NULL;
1377 		}
1378 	}
1379 	if (pending_delete_queued) {
1380 		struct sctp_nets *net;
1381 
1382 		/*
1383 		 * since we know that the only/last address is now being
1384 		 * changed in this case, reset the cwnd/rto on all nets to
1385 		 * start as a new address and path.  Also clear the error
1386 		 * counts to give the assoc the best chance to complete the
1387 		 * address change.
1388 		 */
1389 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1390 			stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1391 			    net);
1392 			net->RTO = 0;
1393 			net->error_count = 0;
1394 		}
1395 		stcb->asoc.overall_error_count = 0;
1396 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1397 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1398 			    stcb->asoc.overall_error_count,
1399 			    0,
1400 			    SCTP_FROM_SCTP_ASCONF,
1401 			    __LINE__);
1402 		}
1403 		/* queue in an advisory set primary too */
1404 		(void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1405 		/* let caller know we should send this out immediately */
1406 		status = 1;
1407 	}
1408 	return (status);
1409 }
1410 
1411 /*-
1412  * add an asconf delete IP address parameter to the queue by sockaddr and
1413  * possibly with no sctp_ifa available.  This is only called by the routine
1414  * that checks the addresses in an INIT-ACK against the current address list.
1415  * returns 0 if completed, non-zero if not completed.
1416  * NOTE: if an add is already scheduled (and not yet sent out), simply
1417  * remove it from queue.  If a duplicate operation is found, ignore the
1418  * new one.
1419  */
1420 static int
1421 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1422 {
1423 	struct sctp_ifa *ifa;
1424 	struct sctp_asconf_addr *aa, *aa_next;
1425 
1426 	if (stcb == NULL) {
1427 		return (-1);
1428 	}
1429 	/* see if peer supports ASCONF */
1430 	if (stcb->asoc.asconf_supported == 0) {
1431 		return (-1);
1432 	}
1433 	/* make sure the request isn't already in the queue */
1434 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1435 		/* address match? */
1436 		if (sctp_asconf_addr_match(aa, sa) == 0)
1437 			continue;
1438 		/* is the request already in queue (sent or not) */
1439 		if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1440 			return (-1);
1441 		}
1442 		/* is the negative request already in queue, and not sent */
1443 		if (aa->sent == 1)
1444 			continue;
1445 		if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1446 			/* add already queued, so remove existing entry */
1447 			TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1448 			sctp_del_local_addr_restricted(stcb, aa->ifa);
1449 			/* free the entry */
1450 			SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1451 			return (-1);
1452 		}
1453 	}			/* for each aa */
1454 
1455 	/* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1456 	ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1457 
1458 	/* adding new request to the queue */
1459 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1460 	    SCTP_M_ASC_ADDR);
1461 	if (aa == NULL) {
1462 		/* didn't get memory */
1463 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1464 		    "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1465 		return (-1);
1466 	}
1467 	aa->special_del = 0;
1468 	/* fill in asconf address parameter fields */
1469 	/* top level elements are "networked" during send */
1470 	aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1471 	aa->ifa = ifa;
1472 	if (ifa)
1473 		atomic_add_int(&ifa->refcount, 1);
1474 	/* correlation_id filled in during send routine later... */
1475 	switch (sa->sa_family) {
1476 #ifdef INET6
1477 	case AF_INET6:
1478 		{
1479 			/* IPv6 address */
1480 			struct sockaddr_in6 *sin6;
1481 
1482 			sin6 = (struct sockaddr_in6 *)sa;
1483 			aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1484 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1485 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1486 			memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1487 			    sizeof(struct in6_addr));
1488 			break;
1489 		}
1490 #endif
1491 #ifdef INET
1492 	case AF_INET:
1493 		{
1494 			/* IPv4 address */
1495 			struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1496 
1497 			aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1498 			aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1499 			aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1500 			memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1501 			    sizeof(struct in_addr));
1502 			break;
1503 		}
1504 #endif
1505 	default:
1506 		/* invalid family! */
1507 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1508 		if (ifa)
1509 			sctp_free_ifa(ifa);
1510 		return (-1);
1511 	}
1512 	aa->sent = 0;		/* clear sent flag */
1513 
1514 	/* delete goes to the back of the queue */
1515 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1516 
1517 	/* sa_ignore MEMLEAK {memory is put on the tailq} */
1518 	return (0);
1519 }
1520 
1521 /*
1522  * find a specific asconf param on our "sent" queue
1523  */
1524 static struct sctp_asconf_addr *
1525 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1526 {
1527 	struct sctp_asconf_addr *aa;
1528 
1529 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1530 		if (aa->ap.aph.correlation_id == correlation_id &&
1531 		    aa->sent == 1) {
1532 			/* found it */
1533 			return (aa);
1534 		}
1535 	}
1536 	/* didn't find it */
1537 	return (NULL);
1538 }
1539 
1540 /*
1541  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1542  * notifications based on the error response
1543  */
1544 static void
1545 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1546     struct sctp_asconf_paramhdr *aph)
1547 {
1548 	struct sctp_error_cause *eh;
1549 	struct sctp_paramhdr *ph;
1550 	uint16_t param_type;
1551 	uint16_t error_code;
1552 
1553 	eh = (struct sctp_error_cause *)(aph + 1);
1554 	ph = (struct sctp_paramhdr *)(eh + 1);
1555 	/* validate lengths */
1556 	if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1557 	    htons(aph->ph.param_length)) {
1558 		/* invalid error cause length */
1559 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1560 		    "asconf_process_error: cause element too long\n");
1561 		return;
1562 	}
1563 	if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1564 	    htons(eh->length)) {
1565 		/* invalid included TLV length */
1566 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1567 		    "asconf_process_error: included TLV too long\n");
1568 		return;
1569 	}
1570 	/* which error code ? */
1571 	error_code = ntohs(eh->code);
1572 	param_type = ntohs(aph->ph.param_type);
1573 	/* FIX: this should go back up the REMOTE_ERROR ULP notify */
1574 	switch (error_code) {
1575 	case SCTP_CAUSE_RESOURCE_SHORTAGE:
1576 		/* we allow ourselves to "try again" for this error */
1577 		break;
1578 	default:
1579 		/* peer can't handle it... */
1580 		switch (param_type) {
1581 		case SCTP_ADD_IP_ADDRESS:
1582 		case SCTP_DEL_IP_ADDRESS:
1583 		case SCTP_SET_PRIM_ADDR:
1584 			break;
1585 		default:
1586 			break;
1587 		}
1588 	}
1589 }
1590 
1591 /*
1592  * process an asconf queue param.
1593  * aparam: parameter to process, will be removed from the queue.
1594  * flag: 1=success case, 0=failure case
1595  */
1596 static void
1597 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1598     struct sctp_asconf_addr *aparam, uint32_t flag)
1599 {
1600 	uint16_t param_type;
1601 
1602 	/* process this param */
1603 	param_type = aparam->ap.aph.ph.param_type;
1604 	switch (param_type) {
1605 	case SCTP_ADD_IP_ADDRESS:
1606 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1607 		    "process_param_ack: added IP address\n");
1608 		sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1609 		break;
1610 	case SCTP_DEL_IP_ADDRESS:
1611 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1612 		    "process_param_ack: deleted IP address\n");
1613 		/* nothing really to do... lists already updated */
1614 		break;
1615 	case SCTP_SET_PRIM_ADDR:
1616 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1617 		    "process_param_ack: set primary IP address\n");
1618 		/* nothing to do... peer may start using this addr */
1619 		break;
1620 	default:
1621 		/* should NEVER happen */
1622 		break;
1623 	}
1624 
1625 	/* remove the param and free it */
1626 	TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1627 	if (aparam->ifa)
1628 		sctp_free_ifa(aparam->ifa);
1629 	SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1630 }
1631 
1632 /*
1633  * cleanup from a bad asconf ack parameter
1634  */
1635 static void
1636 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1637 {
1638 	/* assume peer doesn't really know how to do asconfs */
1639 	/* XXX we could free the pending queue here */
1640 
1641 }
1642 
1643 void
1644 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1645     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1646     struct sctp_nets *net, int *abort_no_unlock)
1647 {
1648 	struct sctp_association *asoc;
1649 	uint32_t serial_num;
1650 	uint16_t ack_length;
1651 	struct sctp_asconf_paramhdr *aph;
1652 	struct sctp_asconf_addr *aa, *aa_next;
1653 	uint32_t last_error_id = 0;	/* last error correlation id */
1654 	uint32_t id;
1655 	struct sctp_asconf_addr *ap;
1656 
1657 	/* asconf param buffer */
1658 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1659 
1660 	/* verify minimum length */
1661 	if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1662 		SCTPDBG(SCTP_DEBUG_ASCONF1,
1663 		    "handle_asconf_ack: chunk too small = %xh\n",
1664 		    ntohs(cp->ch.chunk_length));
1665 		return;
1666 	}
1667 	asoc = &stcb->asoc;
1668 	serial_num = ntohl(cp->serial_number);
1669 
1670 	/*
1671 	 * NOTE: we may want to handle this differently- currently, we will
1672 	 * abort when we get an ack for the expected serial number + 1 (eg.
1673 	 * we didn't send it), process an ack normally if it is the expected
1674 	 * serial number, and re-send the previous ack for *ALL* other
1675 	 * serial numbers
1676 	 */
1677 
1678 	/*
1679 	 * if the serial number is the next expected, but I didn't send it,
1680 	 * abort the asoc, since someone probably just hijacked us...
1681 	 */
1682 	if (serial_num == (asoc->asconf_seq_out + 1)) {
1683 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1684 		sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1685 		*abort_no_unlock = 1;
1686 		return;
1687 	}
1688 	if (serial_num != asoc->asconf_seq_out_acked + 1) {
1689 		/* got a duplicate/unexpected ASCONF-ACK */
1690 		SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1691 		    serial_num, asoc->asconf_seq_out_acked + 1);
1692 		return;
1693 	}
1694 	if (serial_num == asoc->asconf_seq_out - 1) {
1695 		/* stop our timer */
1696 		sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1697 		    SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1698 	}
1699 	/* process the ASCONF-ACK contents */
1700 	ack_length = ntohs(cp->ch.chunk_length) -
1701 	    sizeof(struct sctp_asconf_ack_chunk);
1702 	offset += sizeof(struct sctp_asconf_ack_chunk);
1703 	/* process through all parameters */
1704 	while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1705 		unsigned int param_length, param_type;
1706 
1707 		/* get pointer to next asconf parameter */
1708 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1709 		    sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1710 		if (aph == NULL) {
1711 			/* can't get an asconf paramhdr */
1712 			sctp_asconf_ack_clear(stcb);
1713 			return;
1714 		}
1715 		param_type = ntohs(aph->ph.param_type);
1716 		param_length = ntohs(aph->ph.param_length);
1717 		if (param_length > ack_length) {
1718 			sctp_asconf_ack_clear(stcb);
1719 			return;
1720 		}
1721 		if (param_length < sizeof(struct sctp_paramhdr)) {
1722 			sctp_asconf_ack_clear(stcb);
1723 			return;
1724 		}
1725 		/* get the complete parameter... */
1726 		if (param_length > sizeof(aparam_buf)) {
1727 			SCTPDBG(SCTP_DEBUG_ASCONF1,
1728 			    "param length (%u) larger than buffer size!\n", param_length);
1729 			sctp_asconf_ack_clear(stcb);
1730 			return;
1731 		}
1732 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1733 		if (aph == NULL) {
1734 			sctp_asconf_ack_clear(stcb);
1735 			return;
1736 		}
1737 		/* correlation_id is transparent to peer, no ntohl needed */
1738 		id = aph->correlation_id;
1739 
1740 		switch (param_type) {
1741 		case SCTP_ERROR_CAUSE_IND:
1742 			last_error_id = id;
1743 			/* find the corresponding asconf param in our queue */
1744 			ap = sctp_asconf_find_param(stcb, id);
1745 			if (ap == NULL) {
1746 				/* hmm... can't find this in our queue! */
1747 				break;
1748 			}
1749 			/* process the parameter, failed flag */
1750 			sctp_asconf_process_param_ack(stcb, ap, 0);
1751 			/* process the error response */
1752 			sctp_asconf_process_error(stcb, aph);
1753 			break;
1754 		case SCTP_SUCCESS_REPORT:
1755 			/* find the corresponding asconf param in our queue */
1756 			ap = sctp_asconf_find_param(stcb, id);
1757 			if (ap == NULL) {
1758 				/* hmm... can't find this in our queue! */
1759 				break;
1760 			}
1761 			/* process the parameter, success flag */
1762 			sctp_asconf_process_param_ack(stcb, ap, 1);
1763 			break;
1764 		default:
1765 			break;
1766 		}		/* switch */
1767 
1768 		/* update remaining ASCONF-ACK message length to process */
1769 		ack_length -= SCTP_SIZE32(param_length);
1770 		if (ack_length <= 0) {
1771 			/* no more data in the mbuf chain */
1772 			break;
1773 		}
1774 		offset += SCTP_SIZE32(param_length);
1775 	}			/* while */
1776 
1777 	/*
1778 	 * if there are any "sent" params still on the queue, these are
1779 	 * implicitly "success", or "failed" (if we got an error back) ...
1780 	 * so process these appropriately
1781 	 *
1782 	 * we assume that the correlation_id's are monotonically increasing
1783 	 * beginning from 1 and that we don't have *that* many outstanding
1784 	 * at any given time
1785 	 */
1786 	if (last_error_id == 0)
1787 		last_error_id--;/* set to "max" value */
1788 	TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1789 		if (aa->sent == 1) {
1790 			/*
1791 			 * implicitly successful or failed if correlation_id
1792 			 * < last_error_id, then success else, failure
1793 			 */
1794 			if (aa->ap.aph.correlation_id < last_error_id)
1795 				sctp_asconf_process_param_ack(stcb, aa, 1);
1796 			else
1797 				sctp_asconf_process_param_ack(stcb, aa, 0);
1798 		} else {
1799 			/*
1800 			 * since we always process in order (FIFO queue) if
1801 			 * we reach one that hasn't been sent, the rest
1802 			 * should not have been sent either. so, we're
1803 			 * done...
1804 			 */
1805 			break;
1806 		}
1807 	}
1808 
1809 	/* update the next sequence number to use */
1810 	asoc->asconf_seq_out_acked++;
1811 	/* remove the old ASCONF on our outbound queue */
1812 	sctp_toss_old_asconf(stcb);
1813 	if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1814 #ifdef SCTP_TIMER_BASED_ASCONF
1815 		/* we have more params, so restart our timer */
1816 		sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1817 		    stcb, net);
1818 #else
1819 		/* we have more params, so send out more */
1820 		sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1821 #endif
1822 	}
1823 }
1824 
1825 #ifdef INET6
1826 static uint32_t
1827 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1828 {
1829 	struct sockaddr_in6 *sin6, *net6;
1830 	struct sctp_nets *net;
1831 
1832 	if (sa->sa_family != AF_INET6) {
1833 		/* wrong family */
1834 		return (0);
1835 	}
1836 	sin6 = (struct sockaddr_in6 *)sa;
1837 	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1838 		/* not link local address */
1839 		return (0);
1840 	}
1841 	/* hunt through our destination nets list for this scope_id */
1842 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1843 		if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1844 		    AF_INET6)
1845 			continue;
1846 		net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1847 		if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1848 			continue;
1849 		if (sctp_is_same_scope(sin6, net6)) {
1850 			/* found one */
1851 			return (1);
1852 		}
1853 	}
1854 	/* didn't find one */
1855 	return (0);
1856 }
1857 
1858 #endif
1859 
1860 /*
1861  * address management functions
1862  */
1863 static void
1864 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1865     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1866 {
1867 	int status;
1868 
1869 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1870 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1871 		/* subset bound, no ASCONF allowed case, so ignore */
1872 		return;
1873 	}
1874 	/*
1875 	 * note: we know this is not the subset bound, no ASCONF case eg.
1876 	 * this is boundall or subset bound w/ASCONF allowed
1877 	 */
1878 
1879 	/* first, make sure that the address is IPv4 or IPv6 and not jailed */
1880 	switch (ifa->address.sa.sa_family) {
1881 #ifdef INET6
1882 	case AF_INET6:
1883 		if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1884 		    &ifa->address.sin6.sin6_addr) != 0) {
1885 			return;
1886 		}
1887 		break;
1888 #endif
1889 #ifdef INET
1890 	case AF_INET:
1891 		if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1892 		    &ifa->address.sin.sin_addr) != 0) {
1893 			return;
1894 		}
1895 		break;
1896 #endif
1897 	default:
1898 		return;
1899 	}
1900 #ifdef INET6
1901 	/* make sure we're "allowed" to add this type of addr */
1902 	if (ifa->address.sa.sa_family == AF_INET6) {
1903 		/* invalid if we're not a v6 endpoint */
1904 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1905 			return;
1906 		/* is the v6 addr really valid ? */
1907 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1908 			return;
1909 		}
1910 	}
1911 #endif
1912 	/* put this address on the "pending/do not use yet" list */
1913 	sctp_add_local_addr_restricted(stcb, ifa);
1914 	/*
1915 	 * check address scope if address is out of scope, don't queue
1916 	 * anything... note: this would leave the address on both inp and
1917 	 * asoc lists
1918 	 */
1919 	switch (ifa->address.sa.sa_family) {
1920 #ifdef INET6
1921 	case AF_INET6:
1922 		{
1923 			struct sockaddr_in6 *sin6;
1924 
1925 			sin6 = &ifa->address.sin6;
1926 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1927 				/* we skip unspecifed addresses */
1928 				return;
1929 			}
1930 			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1931 				if (stcb->asoc.scope.local_scope == 0) {
1932 					return;
1933 				}
1934 				/* is it the right link local scope? */
1935 				if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1936 					return;
1937 				}
1938 			}
1939 			if (stcb->asoc.scope.site_scope == 0 &&
1940 			    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1941 				return;
1942 			}
1943 			break;
1944 		}
1945 #endif
1946 #ifdef INET
1947 	case AF_INET:
1948 		{
1949 			struct sockaddr_in *sin;
1950 			struct in6pcb *inp6;
1951 
1952 			inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1953 			/* invalid if we are a v6 only endpoint */
1954 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1955 			    SCTP_IPV6_V6ONLY(inp6))
1956 				return;
1957 
1958 			sin = &ifa->address.sin;
1959 			if (sin->sin_addr.s_addr == 0) {
1960 				/* we skip unspecifed addresses */
1961 				return;
1962 			}
1963 			if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1964 			    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1965 				return;
1966 			}
1967 			break;
1968 		}
1969 #endif
1970 	default:
1971 		/* else, not AF_INET or AF_INET6, so skip */
1972 		return;
1973 	}
1974 
1975 	/* queue an asconf for this address add/delete */
1976 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1977 		/* does the peer do asconf? */
1978 		if (stcb->asoc.asconf_supported) {
1979 			/* queue an asconf for this addr */
1980 			status = sctp_asconf_queue_add(stcb, ifa, type);
1981 
1982 			/*
1983 			 * if queued ok, and in the open state, send out the
1984 			 * ASCONF.  If in the non-open state, these will be
1985 			 * sent when the state goes open.
1986 			 */
1987 			if (status == 0 &&
1988 			    ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
1989 			    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1990 #ifdef SCTP_TIMER_BASED_ASCONF
1991 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1992 				    stcb, stcb->asoc.primary_destination);
1993 #else
1994 				sctp_send_asconf(stcb, NULL, addr_locked);
1995 #endif
1996 			}
1997 		}
1998 	}
1999 }
2000 
2001 
2002 int
2003 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2004 {
2005 	struct sctp_asconf_iterator *asc;
2006 	struct sctp_ifa *ifa;
2007 	struct sctp_laddr *l;
2008 	int cnt_invalid = 0;
2009 
2010 	asc = (struct sctp_asconf_iterator *)ptr;
2011 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2012 		ifa = l->ifa;
2013 		switch (ifa->address.sa.sa_family) {
2014 #ifdef INET6
2015 		case AF_INET6:
2016 			/* invalid if we're not a v6 endpoint */
2017 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2018 				cnt_invalid++;
2019 				if (asc->cnt == cnt_invalid)
2020 					return (1);
2021 			}
2022 			break;
2023 #endif
2024 #ifdef INET
2025 		case AF_INET:
2026 			{
2027 				/* invalid if we are a v6 only endpoint */
2028 				struct in6pcb *inp6;
2029 
2030 				inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2031 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2032 				    SCTP_IPV6_V6ONLY(inp6)) {
2033 					cnt_invalid++;
2034 					if (asc->cnt == cnt_invalid)
2035 						return (1);
2036 				}
2037 				break;
2038 			}
2039 #endif
2040 		default:
2041 			/* invalid address family */
2042 			cnt_invalid++;
2043 			if (asc->cnt == cnt_invalid)
2044 				return (1);
2045 		}
2046 	}
2047 	return (0);
2048 }
2049 
2050 static int
2051 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2052 {
2053 	struct sctp_ifa *ifa;
2054 	struct sctp_asconf_iterator *asc;
2055 	struct sctp_laddr *laddr, *nladdr, *l;
2056 
2057 	/* Only for specific case not bound all */
2058 	asc = (struct sctp_asconf_iterator *)ptr;
2059 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2060 		ifa = l->ifa;
2061 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2062 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
2063 			    sctp_nxt_addr) {
2064 				if (laddr->ifa == ifa) {
2065 					laddr->action = 0;
2066 					break;
2067 				}
2068 			}
2069 		} else if (l->action == SCTP_DEL_IP_ADDRESS) {
2070 			LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2071 				/* remove only after all guys are done */
2072 				if (laddr->ifa == ifa) {
2073 					sctp_del_local_addr_ep(inp, ifa);
2074 				}
2075 			}
2076 		}
2077 	}
2078 	return (0);
2079 }
2080 
2081 void
2082 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2083     void *ptr, uint32_t val SCTP_UNUSED)
2084 {
2085 	struct sctp_asconf_iterator *asc;
2086 	struct sctp_ifa *ifa;
2087 	struct sctp_laddr *l;
2088 	int cnt_invalid = 0;
2089 	int type, status;
2090 	int num_queued = 0;
2091 
2092 	asc = (struct sctp_asconf_iterator *)ptr;
2093 	LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2094 		ifa = l->ifa;
2095 		type = l->action;
2096 
2097 		/* address's vrf_id must be the vrf_id of the assoc */
2098 		if (ifa->vrf_id != stcb->asoc.vrf_id) {
2099 			continue;
2100 		}
2101 		/* Same checks again for assoc */
2102 		switch (ifa->address.sa.sa_family) {
2103 #ifdef INET6
2104 		case AF_INET6:
2105 			{
2106 				/* invalid if we're not a v6 endpoint */
2107 				struct sockaddr_in6 *sin6;
2108 
2109 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2110 					cnt_invalid++;
2111 					if (asc->cnt == cnt_invalid)
2112 						return;
2113 					else
2114 						continue;
2115 				}
2116 				sin6 = &ifa->address.sin6;
2117 				if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2118 					/* we skip unspecifed addresses */
2119 					continue;
2120 				}
2121 				if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2122 				    &sin6->sin6_addr) != 0) {
2123 					continue;
2124 				}
2125 				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2126 					if (stcb->asoc.scope.local_scope == 0) {
2127 						continue;
2128 					}
2129 					/* is it the right link local scope? */
2130 					if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2131 						continue;
2132 					}
2133 				}
2134 				break;
2135 			}
2136 #endif
2137 #ifdef INET
2138 		case AF_INET:
2139 			{
2140 				/* invalid if we are a v6 only endpoint */
2141 				struct in6pcb *inp6;
2142 				struct sockaddr_in *sin;
2143 
2144 				inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2145 				/* invalid if we are a v6 only endpoint */
2146 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2147 				    SCTP_IPV6_V6ONLY(inp6))
2148 					continue;
2149 
2150 				sin = &ifa->address.sin;
2151 				if (sin->sin_addr.s_addr == 0) {
2152 					/* we skip unspecifed addresses */
2153 					continue;
2154 				}
2155 				if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2156 				    &sin->sin_addr) != 0) {
2157 					continue;
2158 				}
2159 				if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2160 				    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2161 					continue;
2162 				}
2163 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2164 				    SCTP_IPV6_V6ONLY(inp6)) {
2165 					cnt_invalid++;
2166 					if (asc->cnt == cnt_invalid)
2167 						return;
2168 					else
2169 						continue;
2170 				}
2171 				break;
2172 			}
2173 #endif
2174 		default:
2175 			/* invalid address family */
2176 			cnt_invalid++;
2177 			if (asc->cnt == cnt_invalid)
2178 				return;
2179 			else
2180 				continue;
2181 			break;
2182 		}
2183 
2184 		if (type == SCTP_ADD_IP_ADDRESS) {
2185 			/* prevent this address from being used as a source */
2186 			sctp_add_local_addr_restricted(stcb, ifa);
2187 		} else if (type == SCTP_DEL_IP_ADDRESS) {
2188 			struct sctp_nets *net;
2189 
2190 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2191 				sctp_rtentry_t *rt;
2192 
2193 				/* delete this address if cached */
2194 				if (net->ro._s_addr == ifa) {
2195 					sctp_free_ifa(net->ro._s_addr);
2196 					net->ro._s_addr = NULL;
2197 					net->src_addr_selected = 0;
2198 					rt = net->ro.ro_rt;
2199 					if (rt) {
2200 						RTFREE(rt);
2201 						net->ro.ro_rt = NULL;
2202 					}
2203 					/*
2204 					 * Now we deleted our src address,
2205 					 * should we not also now reset the
2206 					 * cwnd/rto to start as if its a new
2207 					 * address?
2208 					 */
2209 					stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2210 					net->RTO = 0;
2211 
2212 				}
2213 			}
2214 		} else if (type == SCTP_SET_PRIM_ADDR) {
2215 			if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2216 				/* must validate the ifa is in the ep */
2217 				if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2218 					continue;
2219 				}
2220 			} else {
2221 				/* Need to check scopes for this guy */
2222 				if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2223 					continue;
2224 				}
2225 			}
2226 		}
2227 		/* queue an asconf for this address add/delete */
2228 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2229 		    stcb->asoc.asconf_supported == 1) {
2230 			/* queue an asconf for this addr */
2231 			status = sctp_asconf_queue_add(stcb, ifa, type);
2232 			/*
2233 			 * if queued ok, and in the open state, update the
2234 			 * count of queued params.  If in the non-open
2235 			 * state, these get sent when the assoc goes open.
2236 			 */
2237 			if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2238 			    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2239 				if (status >= 0) {
2240 					num_queued++;
2241 				}
2242 			}
2243 		}
2244 	}
2245 	/*
2246 	 * If we have queued params in the open state, send out an ASCONF.
2247 	 */
2248 	if (num_queued > 0) {
2249 		sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2250 	}
2251 }
2252 
2253 void
2254 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2255 {
2256 	struct sctp_asconf_iterator *asc;
2257 	struct sctp_ifa *ifa;
2258 	struct sctp_laddr *l, *nl;
2259 
2260 	asc = (struct sctp_asconf_iterator *)ptr;
2261 	LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2262 		ifa = l->ifa;
2263 		if (l->action == SCTP_ADD_IP_ADDRESS) {
2264 			/* Clear the defer use flag */
2265 			ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2266 		}
2267 		sctp_free_ifa(ifa);
2268 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2269 		SCTP_DECR_LADDR_COUNT();
2270 	}
2271 	SCTP_FREE(asc, SCTP_M_ASC_IT);
2272 }
2273 
2274 /*
2275  * sa is the sockaddr to ask the peer to set primary to.
2276  * returns: 0 = completed, -1 = error
2277  */
2278 int32_t
2279 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2280 {
2281 	uint32_t vrf_id;
2282 	struct sctp_ifa *ifa;
2283 
2284 	/* find the ifa for the desired set primary */
2285 	vrf_id = stcb->asoc.vrf_id;
2286 	ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2287 	if (ifa == NULL) {
2288 		/* Invalid address */
2289 		return (-1);
2290 	}
2291 	/* queue an ASCONF:SET_PRIM_ADDR to be sent */
2292 	if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2293 		/* set primary queuing succeeded */
2294 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2295 		    "set_primary_ip_address_sa: queued on tcb=%p, ",
2296 		    (void *)stcb);
2297 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2298 		if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2299 		    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2300 #ifdef SCTP_TIMER_BASED_ASCONF
2301 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2302 			    stcb->sctp_ep, stcb,
2303 			    stcb->asoc.primary_destination);
2304 #else
2305 			sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2306 #endif
2307 		}
2308 	} else {
2309 		SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2310 		    (void *)stcb);
2311 		SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2312 		return (-1);
2313 	}
2314 	return (0);
2315 }
2316 
2317 void
2318 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2319 {
2320 	struct sctp_inpcb *inp;
2321 
2322 	/* go through all our PCB's */
2323 	LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2324 		struct sctp_tcb *stcb;
2325 
2326 		/* process for all associations for this endpoint */
2327 		LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2328 			/* queue an ASCONF:SET_PRIM_ADDR to be sent */
2329 			if (!sctp_asconf_queue_add(stcb, ifa,
2330 			    SCTP_SET_PRIM_ADDR)) {
2331 				/* set primary queuing succeeded */
2332 				SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2333 				    (void *)stcb);
2334 				SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2335 				if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
2336 				    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2337 #ifdef SCTP_TIMER_BASED_ASCONF
2338 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2339 					    stcb->sctp_ep, stcb,
2340 					    stcb->asoc.primary_destination);
2341 #else
2342 					sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2343 #endif
2344 				}
2345 			}
2346 		}		/* for each stcb */
2347 	}			/* for each inp */
2348 }
2349 
2350 int
2351 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2352 {
2353 	struct sctp_tmit_chunk *chk, *nchk;
2354 	unsigned int offset, asconf_limit;
2355 	struct sctp_asconf_chunk *acp;
2356 	struct sctp_asconf_paramhdr *aph;
2357 	uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2358 	struct sctp_paramhdr *ph;
2359 	int add_cnt, del_cnt;
2360 	uint16_t last_param_type;
2361 
2362 	add_cnt = del_cnt = 0;
2363 	last_param_type = 0;
2364 	TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2365 		if (chk->data == NULL) {
2366 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2367 			continue;
2368 		}
2369 		offset = 0;
2370 		acp = mtod(chk->data, struct sctp_asconf_chunk *);
2371 		offset += sizeof(struct sctp_asconf_chunk);
2372 		asconf_limit = ntohs(acp->ch.chunk_length);
2373 		ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2374 		if (ph == NULL) {
2375 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2376 			continue;
2377 		}
2378 		offset += ntohs(ph->param_length);
2379 
2380 		aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2381 		if (aph == NULL) {
2382 			SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2383 			continue;
2384 		}
2385 		while (aph != NULL) {
2386 			unsigned int param_length, param_type;
2387 
2388 			param_type = ntohs(aph->ph.param_type);
2389 			param_length = ntohs(aph->ph.param_length);
2390 			if (offset + param_length > asconf_limit) {
2391 				/* parameter goes beyond end of chunk! */
2392 				break;
2393 			}
2394 			if (param_length > sizeof(aparam_buf)) {
2395 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2396 				break;
2397 			}
2398 			if (param_length <= sizeof(struct sctp_paramhdr)) {
2399 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2400 				break;
2401 			}
2402 			aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2403 			if (aph == NULL) {
2404 				SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2405 				break;
2406 			}
2407 			ph = (struct sctp_paramhdr *)(aph + 1);
2408 			if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2409 				switch (param_type) {
2410 				case SCTP_ADD_IP_ADDRESS:
2411 					add_cnt++;
2412 					break;
2413 				case SCTP_DEL_IP_ADDRESS:
2414 					del_cnt++;
2415 					break;
2416 				default:
2417 					break;
2418 				}
2419 				last_param_type = param_type;
2420 			}
2421 			offset += SCTP_SIZE32(param_length);
2422 			if (offset >= asconf_limit) {
2423 				/* no more data in the mbuf chain */
2424 				break;
2425 			}
2426 			/* get pointer to next asconf param */
2427 			aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2428 		}
2429 	}
2430 
2431 	/*
2432 	 * we want to find the sequences which consist of ADD -> DEL -> ADD
2433 	 * or DEL -> ADD
2434 	 */
2435 	if (add_cnt > del_cnt ||
2436 	    (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2437 		return (1);
2438 	}
2439 	return (0);
2440 }
2441 
2442 static struct sockaddr *
2443 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2444 {
2445 	struct sctp_vrf *vrf = NULL;
2446 	struct sctp_ifn *sctp_ifn;
2447 	struct sctp_ifa *sctp_ifa;
2448 
2449 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2450 		SCTP_IPI_ADDR_RLOCK();
2451 	vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2452 	if (vrf == NULL) {
2453 		if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2454 			SCTP_IPI_ADDR_RUNLOCK();
2455 		return (NULL);
2456 	}
2457 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2458 		if (stcb->asoc.scope.loopback_scope == 0 &&
2459 		    SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2460 			/* Skip if loopback_scope not set */
2461 			continue;
2462 		}
2463 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2464 			switch (sctp_ifa->address.sa.sa_family) {
2465 #ifdef INET
2466 			case AF_INET:
2467 				if (stcb->asoc.scope.ipv4_addr_legal) {
2468 					struct sockaddr_in *sin;
2469 
2470 					sin = &sctp_ifa->address.sin;
2471 					if (sin->sin_addr.s_addr == 0) {
2472 						/* skip unspecifed addresses */
2473 						continue;
2474 					}
2475 					if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2476 					    &sin->sin_addr) != 0) {
2477 						continue;
2478 					}
2479 					if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2480 					    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2481 						continue;
2482 
2483 					if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2484 					    (!sctp_is_addr_pending(stcb, sctp_ifa)))
2485 						continue;
2486 					/*
2487 					 * found a valid local v4 address to
2488 					 * use
2489 					 */
2490 					if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2491 						SCTP_IPI_ADDR_RUNLOCK();
2492 					return (&sctp_ifa->address.sa);
2493 				}
2494 				break;
2495 #endif
2496 #ifdef INET6
2497 			case AF_INET6:
2498 				if (stcb->asoc.scope.ipv6_addr_legal) {
2499 					struct sockaddr_in6 *sin6;
2500 
2501 					if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2502 						continue;
2503 					}
2504 					sin6 = &sctp_ifa->address.sin6;
2505 					if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2506 						/*
2507 						 * we skip unspecifed
2508 						 * addresses
2509 						 */
2510 						continue;
2511 					}
2512 					if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2513 					    &sin6->sin6_addr) != 0) {
2514 						continue;
2515 					}
2516 					if (stcb->asoc.scope.local_scope == 0 &&
2517 					    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2518 						continue;
2519 					if (stcb->asoc.scope.site_scope == 0 &&
2520 					    IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2521 						continue;
2522 
2523 					if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2524 					    (!sctp_is_addr_pending(stcb, sctp_ifa)))
2525 						continue;
2526 					/*
2527 					 * found a valid local v6 address to
2528 					 * use
2529 					 */
2530 					if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2531 						SCTP_IPI_ADDR_RUNLOCK();
2532 					return (&sctp_ifa->address.sa);
2533 				}
2534 				break;
2535 #endif
2536 			default:
2537 				break;
2538 			}
2539 		}
2540 	}
2541 	/* no valid addresses found */
2542 	if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2543 		SCTP_IPI_ADDR_RUNLOCK();
2544 	return (NULL);
2545 }
2546 
2547 static struct sockaddr *
2548 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2549 {
2550 	struct sctp_laddr *laddr;
2551 
2552 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2553 		if (laddr->ifa == NULL) {
2554 			continue;
2555 		}
2556 		/* is the address restricted ? */
2557 		if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2558 		    (!sctp_is_addr_pending(stcb, laddr->ifa)))
2559 			continue;
2560 
2561 		/* found a valid local address to use */
2562 		return (&laddr->ifa->address.sa);
2563 	}
2564 	/* no valid addresses found */
2565 	return (NULL);
2566 }
2567 
2568 /*
2569  * builds an ASCONF chunk from queued ASCONF params.
2570  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2571  */
2572 struct mbuf *
2573 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2574 {
2575 	struct mbuf *m_asconf, *m_asconf_chk;
2576 	struct sctp_asconf_addr *aa;
2577 	struct sctp_asconf_chunk *acp;
2578 	struct sctp_asconf_paramhdr *aph;
2579 	struct sctp_asconf_addr_param *aap;
2580 	uint32_t p_length;
2581 	uint32_t correlation_id = 1;	/* 0 is reserved... */
2582 	caddr_t ptr, lookup_ptr;
2583 	uint8_t lookup_used = 0;
2584 
2585 	/* are there any asconf params to send? */
2586 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2587 		if (aa->sent == 0)
2588 			break;
2589 	}
2590 	if (aa == NULL)
2591 		return (NULL);
2592 
2593 	/*
2594 	 * get a chunk header mbuf and a cluster for the asconf params since
2595 	 * it's simpler to fill in the asconf chunk header lookup address on
2596 	 * the fly
2597 	 */
2598 	m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2599 	if (m_asconf_chk == NULL) {
2600 		/* no mbuf's */
2601 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2602 		    "compose_asconf: couldn't get chunk mbuf!\n");
2603 		return (NULL);
2604 	}
2605 	m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2606 	if (m_asconf == NULL) {
2607 		/* no mbuf's */
2608 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2609 		    "compose_asconf: couldn't get mbuf!\n");
2610 		sctp_m_freem(m_asconf_chk);
2611 		return (NULL);
2612 	}
2613 	SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2614 	SCTP_BUF_LEN(m_asconf) = 0;
2615 	acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2616 	bzero(acp, sizeof(struct sctp_asconf_chunk));
2617 	/* save pointers to lookup address and asconf params */
2618 	lookup_ptr = (caddr_t)(acp + 1);	/* after the header */
2619 	ptr = mtod(m_asconf, caddr_t);	/* beginning of cluster */
2620 
2621 	/* fill in chunk header info */
2622 	acp->ch.chunk_type = SCTP_ASCONF;
2623 	acp->ch.chunk_flags = 0;
2624 	acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2625 	stcb->asoc.asconf_seq_out++;
2626 
2627 	/* add parameters... up to smallest MTU allowed */
2628 	TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2629 		if (aa->sent)
2630 			continue;
2631 		/* get the parameter length */
2632 		p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2633 		/* will it fit in current chunk? */
2634 		if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2635 		    (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2636 			/* won't fit, so we're done with this chunk */
2637 			break;
2638 		}
2639 		/* assign (and store) a correlation id */
2640 		aa->ap.aph.correlation_id = correlation_id++;
2641 
2642 		/*
2643 		 * fill in address if we're doing a delete this is a simple
2644 		 * way for us to fill in the correlation address, which
2645 		 * should only be used by the peer if we're deleting our
2646 		 * source address and adding a new address (e.g. renumbering
2647 		 * case)
2648 		 */
2649 		if (lookup_used == 0 &&
2650 		    (aa->special_del == 0) &&
2651 		    aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2652 			struct sctp_ipv6addr_param *lookup;
2653 			uint16_t p_size, addr_size;
2654 
2655 			lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2656 			lookup->ph.param_type =
2657 			    htons(aa->ap.addrp.ph.param_type);
2658 			if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2659 				/* copy IPv6 address */
2660 				p_size = sizeof(struct sctp_ipv6addr_param);
2661 				addr_size = sizeof(struct in6_addr);
2662 			} else {
2663 				/* copy IPv4 address */
2664 				p_size = sizeof(struct sctp_ipv4addr_param);
2665 				addr_size = sizeof(struct in_addr);
2666 			}
2667 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2668 			memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2669 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2670 			lookup_used = 1;
2671 		}
2672 		/* copy into current space */
2673 		memcpy(ptr, &aa->ap, p_length);
2674 
2675 		/* network elements and update lengths */
2676 		aph = (struct sctp_asconf_paramhdr *)ptr;
2677 		aap = (struct sctp_asconf_addr_param *)ptr;
2678 		/* correlation_id is transparent to peer, no htonl needed */
2679 		aph->ph.param_type = htons(aph->ph.param_type);
2680 		aph->ph.param_length = htons(aph->ph.param_length);
2681 		aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2682 		aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2683 
2684 		SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2685 		ptr += SCTP_SIZE32(p_length);
2686 
2687 		/*
2688 		 * these params are removed off the pending list upon
2689 		 * getting an ASCONF-ACK back from the peer, just set flag
2690 		 */
2691 		aa->sent = 1;
2692 	}
2693 	/* check to see if the lookup addr has been populated yet */
2694 	if (lookup_used == 0) {
2695 		/* NOTE: if the address param is optional, can skip this... */
2696 		/* add any valid (existing) address... */
2697 		struct sctp_ipv6addr_param *lookup;
2698 		uint16_t p_size, addr_size;
2699 		struct sockaddr *found_addr;
2700 		caddr_t addr_ptr;
2701 
2702 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2703 			found_addr = sctp_find_valid_localaddr(stcb,
2704 			    addr_locked);
2705 		else
2706 			found_addr = sctp_find_valid_localaddr_ep(stcb);
2707 
2708 		lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2709 		if (found_addr != NULL) {
2710 			switch (found_addr->sa_family) {
2711 #ifdef INET6
2712 			case AF_INET6:
2713 				/* copy IPv6 address */
2714 				lookup->ph.param_type =
2715 				    htons(SCTP_IPV6_ADDRESS);
2716 				p_size = sizeof(struct sctp_ipv6addr_param);
2717 				addr_size = sizeof(struct in6_addr);
2718 				addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2719 				    found_addr)->sin6_addr;
2720 				break;
2721 #endif
2722 #ifdef INET
2723 			case AF_INET:
2724 				/* copy IPv4 address */
2725 				lookup->ph.param_type =
2726 				    htons(SCTP_IPV4_ADDRESS);
2727 				p_size = sizeof(struct sctp_ipv4addr_param);
2728 				addr_size = sizeof(struct in_addr);
2729 				addr_ptr = (caddr_t)&((struct sockaddr_in *)
2730 				    found_addr)->sin_addr;
2731 				break;
2732 #endif
2733 			default:
2734 				p_size = 0;
2735 				addr_size = 0;
2736 				addr_ptr = NULL;
2737 				break;
2738 			}
2739 			lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2740 			memcpy(lookup->addr, addr_ptr, addr_size);
2741 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2742 		} else {
2743 			/* uh oh... don't have any address?? */
2744 			SCTPDBG(SCTP_DEBUG_ASCONF1,
2745 			    "compose_asconf: no lookup addr!\n");
2746 			/* XXX for now, we send a IPv4 address of 0.0.0.0 */
2747 			lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2748 			lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2749 			bzero(lookup->addr, sizeof(struct in_addr));
2750 			SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2751 		}
2752 	}
2753 	/* chain it all together */
2754 	SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2755 	*retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2756 	acp->ch.chunk_length = htons(*retlen);
2757 
2758 	return (m_asconf_chk);
2759 }
2760 
2761 /*
2762  * section to handle address changes before an association is up eg. changes
2763  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2764  */
2765 
2766 /*
2767  * processes the (local) addresses in the INIT-ACK chunk
2768  */
2769 static void
2770 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2771     unsigned int offset, unsigned int length)
2772 {
2773 	struct sctp_paramhdr tmp_param, *ph;
2774 	uint16_t plen, ptype;
2775 	struct sctp_ifa *sctp_ifa;
2776 	union sctp_sockstore store;
2777 
2778 #ifdef INET6
2779 	struct sctp_ipv6addr_param addr6_store;
2780 
2781 #endif
2782 #ifdef INET
2783 	struct sctp_ipv4addr_param addr4_store;
2784 
2785 #endif
2786 
2787 	SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2788 	if (stcb == NULL)	/* Un-needed check for SA */
2789 		return;
2790 
2791 	/* convert to upper bound */
2792 	length += offset;
2793 
2794 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2795 		return;
2796 	}
2797 	/* go through the addresses in the init-ack */
2798 	ph = (struct sctp_paramhdr *)
2799 	    sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2800 	    (uint8_t *) & tmp_param);
2801 	while (ph != NULL) {
2802 		ptype = ntohs(ph->param_type);
2803 		plen = ntohs(ph->param_length);
2804 		switch (ptype) {
2805 #ifdef INET6
2806 		case SCTP_IPV6_ADDRESS:
2807 			{
2808 				struct sctp_ipv6addr_param *a6p;
2809 
2810 				/* get the entire IPv6 address param */
2811 				a6p = (struct sctp_ipv6addr_param *)
2812 				    sctp_m_getptr(m, offset,
2813 				    sizeof(struct sctp_ipv6addr_param),
2814 				    (uint8_t *) & addr6_store);
2815 				if (plen != sizeof(struct sctp_ipv6addr_param) ||
2816 				    a6p == NULL) {
2817 					return;
2818 				}
2819 				memset(&store, 0, sizeof(union sctp_sockstore));
2820 				store.sin6.sin6_family = AF_INET6;
2821 				store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2822 				store.sin6.sin6_port = stcb->rport;
2823 				memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2824 				break;
2825 			}
2826 #endif
2827 #ifdef INET
2828 		case SCTP_IPV4_ADDRESS:
2829 			{
2830 				struct sctp_ipv4addr_param *a4p;
2831 
2832 				/* get the entire IPv4 address param */
2833 				a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2834 				    sizeof(struct sctp_ipv4addr_param),
2835 				    (uint8_t *) & addr4_store);
2836 				if (plen != sizeof(struct sctp_ipv4addr_param) ||
2837 				    a4p == NULL) {
2838 					return;
2839 				}
2840 				memset(&store, 0, sizeof(union sctp_sockstore));
2841 				store.sin.sin_family = AF_INET;
2842 				store.sin.sin_len = sizeof(struct sockaddr_in);
2843 				store.sin.sin_port = stcb->rport;
2844 				store.sin.sin_addr.s_addr = a4p->addr;
2845 				break;
2846 			}
2847 #endif
2848 		default:
2849 			goto next_addr;
2850 		}
2851 
2852 		/* see if this address really (still) exists */
2853 		sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2854 		    SCTP_ADDR_NOT_LOCKED);
2855 		if (sctp_ifa == NULL) {
2856 			/* address doesn't exist anymore */
2857 			int status;
2858 
2859 			/* are ASCONFs allowed ? */
2860 			if ((sctp_is_feature_on(stcb->sctp_ep,
2861 			    SCTP_PCB_FLAGS_DO_ASCONF)) &&
2862 			    stcb->asoc.asconf_supported) {
2863 				/* queue an ASCONF DEL_IP_ADDRESS */
2864 				status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2865 				/*
2866 				 * if queued ok, and in correct state, send
2867 				 * out the ASCONF.
2868 				 */
2869 				if (status == 0 &&
2870 				    SCTP_GET_STATE(&stcb->asoc) ==
2871 				    SCTP_STATE_OPEN) {
2872 #ifdef SCTP_TIMER_BASED_ASCONF
2873 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2874 					    stcb->sctp_ep, stcb,
2875 					    stcb->asoc.primary_destination);
2876 #else
2877 					sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2878 #endif
2879 				}
2880 			}
2881 		}
2882 next_addr:
2883 		/*
2884 		 * Sanity check:  Make sure the length isn't 0, otherwise
2885 		 * we'll be stuck in this loop for a long time...
2886 		 */
2887 		if (SCTP_SIZE32(plen) == 0) {
2888 			SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2889 			    plen, ptype);
2890 			return;
2891 		}
2892 		/* get next parameter */
2893 		offset += SCTP_SIZE32(plen);
2894 		if ((offset + sizeof(struct sctp_paramhdr)) > length)
2895 			return;
2896 		ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2897 		    sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2898 	}			/* while */
2899 }
2900 
2901 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2902 /*
2903  * checks to see if a specific address is in the initack address list returns
2904  * 1 if found, 0 if not
2905  */
2906 static uint32_t
2907 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2908 {
2909 	struct sctp_paramhdr tmp_param, *ph;
2910 	uint16_t plen, ptype;
2911 
2912 #ifdef INET
2913 	struct sockaddr_in *sin;
2914 	struct sctp_ipv4addr_param *a4p;
2915 	struct sctp_ipv6addr_param addr4_store;
2916 
2917 #endif
2918 #ifdef INET6
2919 	struct sockaddr_in6 *sin6;
2920 	struct sctp_ipv6addr_param *a6p;
2921 	struct sctp_ipv6addr_param addr6_store;
2922 	struct sockaddr_in6 sin6_tmp;
2923 
2924 #endif
2925 
2926 	switch (sa->sa_family) {
2927 #ifdef INET
2928 	case AF_INET:
2929 		break;
2930 #endif
2931 #ifdef INET6
2932 	case AF_INET6:
2933 		break;
2934 #endif
2935 	default:
2936 		return (0);
2937 	}
2938 
2939 	SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2940 	SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2941 	/* convert to upper bound */
2942 	length += offset;
2943 
2944 	if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2945 		SCTPDBG(SCTP_DEBUG_ASCONF1,
2946 		    "find_initack_addr: invalid offset?\n");
2947 		return (0);
2948 	}
2949 	/* go through the addresses in the init-ack */
2950 	ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2951 	    sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2952 	while (ph != NULL) {
2953 		ptype = ntohs(ph->param_type);
2954 		plen = ntohs(ph->param_length);
2955 		switch (ptype) {
2956 #ifdef INET6
2957 		case SCTP_IPV6_ADDRESS:
2958 			if (sa->sa_family == AF_INET6) {
2959 				/* get the entire IPv6 address param */
2960 				if (plen != sizeof(struct sctp_ipv6addr_param)) {
2961 					break;
2962 				}
2963 				/* get the entire IPv6 address param */
2964 				a6p = (struct sctp_ipv6addr_param *)
2965 				    sctp_m_getptr(m, offset,
2966 				    sizeof(struct sctp_ipv6addr_param),
2967 				    (uint8_t *) & addr6_store);
2968 				if (a6p == NULL) {
2969 					return (0);
2970 				}
2971 				sin6 = (struct sockaddr_in6 *)sa;
2972 				if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2973 					/* create a copy and clear scope */
2974 					memcpy(&sin6_tmp, sin6,
2975 					    sizeof(struct sockaddr_in6));
2976 					sin6 = &sin6_tmp;
2977 					in6_clearscope(&sin6->sin6_addr);
2978 				}
2979 				if (memcmp(&sin6->sin6_addr, a6p->addr,
2980 				    sizeof(struct in6_addr)) == 0) {
2981 					/* found it */
2982 					return (1);
2983 				}
2984 			}
2985 			break;
2986 #endif				/* INET6 */
2987 #ifdef INET
2988 		case SCTP_IPV4_ADDRESS:
2989 			if (sa->sa_family == AF_INET) {
2990 				if (plen != sizeof(struct sctp_ipv4addr_param)) {
2991 					break;
2992 				}
2993 				/* get the entire IPv4 address param */
2994 				a4p = (struct sctp_ipv4addr_param *)
2995 				    sctp_m_getptr(m, offset,
2996 				    sizeof(struct sctp_ipv4addr_param),
2997 				    (uint8_t *) & addr4_store);
2998 				if (a4p == NULL) {
2999 					return (0);
3000 				}
3001 				sin = (struct sockaddr_in *)sa;
3002 				if (sin->sin_addr.s_addr == a4p->addr) {
3003 					/* found it */
3004 					return (1);
3005 				}
3006 			}
3007 			break;
3008 #endif
3009 		default:
3010 			break;
3011 		}
3012 		/* get next parameter */
3013 		offset += SCTP_SIZE32(plen);
3014 		if (offset + sizeof(struct sctp_paramhdr) > length) {
3015 			return (0);
3016 		}
3017 		ph = (struct sctp_paramhdr *)
3018 		    sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3019 		    (uint8_t *) & tmp_param);
3020 	}			/* while */
3021 	/* not found! */
3022 	return (0);
3023 }
3024 
3025 /*
3026  * makes sure that the current endpoint local addr list is consistent with
3027  * the new association (eg. subset bound, asconf allowed) adds addresses as
3028  * necessary
3029  */
3030 static void
3031 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3032     int length, struct sockaddr *init_addr)
3033 {
3034 	struct sctp_laddr *laddr;
3035 
3036 	/* go through the endpoint list */
3037 	LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3038 		/* be paranoid and validate the laddr */
3039 		if (laddr->ifa == NULL) {
3040 			SCTPDBG(SCTP_DEBUG_ASCONF1,
3041 			    "check_addr_list_ep: laddr->ifa is NULL");
3042 			continue;
3043 		}
3044 		if (laddr->ifa == NULL) {
3045 			SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3046 			continue;
3047 		}
3048 		/* do i have it implicitly? */
3049 		if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3050 			continue;
3051 		}
3052 		/* check to see if in the init-ack */
3053 		if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3054 			/* try to add it */
3055 			sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3056 			    SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3057 		}
3058 	}
3059 }
3060 
3061 /*
3062  * makes sure that the current kernel address list is consistent with the new
3063  * association (with all addrs bound) adds addresses as necessary
3064  */
3065 static void
3066 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3067     int length, struct sockaddr *init_addr,
3068     uint16_t local_scope, uint16_t site_scope,
3069     uint16_t ipv4_scope, uint16_t loopback_scope)
3070 {
3071 	struct sctp_vrf *vrf = NULL;
3072 	struct sctp_ifn *sctp_ifn;
3073 	struct sctp_ifa *sctp_ifa;
3074 	uint32_t vrf_id;
3075 
3076 #ifdef INET
3077 	struct sockaddr_in *sin;
3078 
3079 #endif
3080 #ifdef INET6
3081 	struct sockaddr_in6 *sin6;
3082 
3083 #endif
3084 
3085 	if (stcb) {
3086 		vrf_id = stcb->asoc.vrf_id;
3087 	} else {
3088 		return;
3089 	}
3090 	SCTP_IPI_ADDR_RLOCK();
3091 	vrf = sctp_find_vrf(vrf_id);
3092 	if (vrf == NULL) {
3093 		SCTP_IPI_ADDR_RUNLOCK();
3094 		return;
3095 	}
3096 	/* go through all our known interfaces */
3097 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3098 		if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3099 			/* skip loopback interface */
3100 			continue;
3101 		}
3102 		/* go through each interface address */
3103 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3104 			/* do i have it implicitly? */
3105 			if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3106 				continue;
3107 			}
3108 			switch (sctp_ifa->address.sa.sa_family) {
3109 #ifdef INET
3110 			case AF_INET:
3111 				sin = &sctp_ifa->address.sin;
3112 				if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3113 				    &sin->sin_addr) != 0) {
3114 					continue;
3115 				}
3116 				if ((ipv4_scope == 0) &&
3117 				    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3118 					/* private address not in scope */
3119 					continue;
3120 				}
3121 				break;
3122 #endif
3123 #ifdef INET6
3124 			case AF_INET6:
3125 				sin6 = &sctp_ifa->address.sin6;
3126 				if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3127 				    &sin6->sin6_addr) != 0) {
3128 					continue;
3129 				}
3130 				if ((local_scope == 0) &&
3131 				    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3132 					continue;
3133 				}
3134 				if ((site_scope == 0) &&
3135 				    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3136 					continue;
3137 				}
3138 				break;
3139 #endif
3140 			default:
3141 				break;
3142 			}
3143 			/* check to see if in the init-ack */
3144 			if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3145 				/* try to add it */
3146 				sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3147 				    sctp_ifa, SCTP_ADD_IP_ADDRESS,
3148 				    SCTP_ADDR_LOCKED);
3149 			}
3150 		}		/* end foreach ifa */
3151 	}			/* end foreach ifn */
3152 	SCTP_IPI_ADDR_RUNLOCK();
3153 }
3154 
3155 /*
3156  * validates an init-ack chunk (from a cookie-echo) with current addresses
3157  * adds addresses from the init-ack into our local address list, if needed
3158  * queues asconf adds/deletes addresses as needed and makes appropriate list
3159  * changes for source address selection m, offset: points to the start of the
3160  * address list in an init-ack chunk length: total length of the address
3161  * params only init_addr: address where my INIT-ACK was sent from
3162  */
3163 void
3164 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3165     int length, struct sockaddr *init_addr,
3166     uint16_t local_scope, uint16_t site_scope,
3167     uint16_t ipv4_scope, uint16_t loopback_scope)
3168 {
3169 	/* process the local addresses in the initack */
3170 	sctp_process_initack_addresses(stcb, m, offset, length);
3171 
3172 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3173 		/* bound all case */
3174 		sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3175 		    local_scope, site_scope, ipv4_scope, loopback_scope);
3176 	} else {
3177 		/* subset bound case */
3178 		if (sctp_is_feature_on(stcb->sctp_ep,
3179 		    SCTP_PCB_FLAGS_DO_ASCONF)) {
3180 			/* asconf's allowed */
3181 			sctp_check_address_list_ep(stcb, m, offset, length,
3182 			    init_addr);
3183 		}
3184 		/* else, no asconfs allowed, so what we sent is what we get */
3185 	}
3186 }
3187 
3188 /*
3189  * sctp_bindx() support
3190  */
3191 uint32_t
3192 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3193     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3194 {
3195 	struct sctp_ifa *ifa;
3196 	struct sctp_laddr *laddr, *nladdr;
3197 
3198 	if (sa->sa_len == 0) {
3199 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3200 		return (EINVAL);
3201 	}
3202 	if (sctp_ifap) {
3203 		ifa = sctp_ifap;
3204 	} else if (type == SCTP_ADD_IP_ADDRESS) {
3205 		/* For an add the address MUST be on the system */
3206 		ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3207 	} else if (type == SCTP_DEL_IP_ADDRESS) {
3208 		/* For a delete we need to find it in the inp */
3209 		ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3210 	} else {
3211 		ifa = NULL;
3212 	}
3213 	if (ifa != NULL) {
3214 		if (type == SCTP_ADD_IP_ADDRESS) {
3215 			sctp_add_local_addr_ep(inp, ifa, type);
3216 		} else if (type == SCTP_DEL_IP_ADDRESS) {
3217 			if (inp->laddr_count < 2) {
3218 				/* can't delete the last local address */
3219 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3220 				return (EINVAL);
3221 			}
3222 			LIST_FOREACH(laddr, &inp->sctp_addr_list,
3223 			    sctp_nxt_addr) {
3224 				if (ifa == laddr->ifa) {
3225 					/* Mark in the delete */
3226 					laddr->action = type;
3227 				}
3228 			}
3229 		}
3230 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3231 			/*
3232 			 * There is no need to start the iterator if the inp
3233 			 * has no associations.
3234 			 */
3235 			if (type == SCTP_DEL_IP_ADDRESS) {
3236 				LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3237 					if (laddr->ifa == ifa) {
3238 						sctp_del_local_addr_ep(inp, ifa);
3239 					}
3240 				}
3241 			}
3242 		} else {
3243 			struct sctp_asconf_iterator *asc;
3244 			struct sctp_laddr *wi;
3245 
3246 			SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3247 			    sizeof(struct sctp_asconf_iterator),
3248 			    SCTP_M_ASC_IT);
3249 			if (asc == NULL) {
3250 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3251 				return (ENOMEM);
3252 			}
3253 			wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3254 			if (wi == NULL) {
3255 				SCTP_FREE(asc, SCTP_M_ASC_IT);
3256 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3257 				return (ENOMEM);
3258 			}
3259 			LIST_INIT(&asc->list_of_work);
3260 			asc->cnt = 1;
3261 			SCTP_INCR_LADDR_COUNT();
3262 			wi->ifa = ifa;
3263 			wi->action = type;
3264 			atomic_add_int(&ifa->refcount, 1);
3265 			LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3266 			(void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3267 			    sctp_asconf_iterator_stcb,
3268 			    sctp_asconf_iterator_ep_end,
3269 			    SCTP_PCB_ANY_FLAGS,
3270 			    SCTP_PCB_ANY_FEATURES,
3271 			    SCTP_ASOC_ANY_STATE,
3272 			    (void *)asc, 0,
3273 			    sctp_asconf_iterator_end, inp, 0);
3274 		}
3275 		return (0);
3276 	} else {
3277 		/* invalid address! */
3278 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3279 		return (EADDRNOTAVAIL);
3280 	}
3281 }
3282 
3283 void
3284 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3285     struct sctp_nets *net)
3286 {
3287 	struct sctp_asconf_addr *aa;
3288 	struct sctp_ifa *sctp_ifap;
3289 	struct sctp_asconf_tag_param *vtag;
3290 
3291 #ifdef INET
3292 	struct sockaddr_in *to;
3293 
3294 #endif
3295 #ifdef INET6
3296 	struct sockaddr_in6 *to6;
3297 
3298 #endif
3299 	if (net == NULL) {
3300 		SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3301 		return;
3302 	}
3303 	if (stcb == NULL) {
3304 		SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3305 		return;
3306 	}
3307 	/*
3308 	 * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3309 	 * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3310 	 */
3311 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3312 	    SCTP_M_ASC_ADDR);
3313 	if (aa == NULL) {
3314 		/* didn't get memory */
3315 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3316 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3317 		return;
3318 	}
3319 	aa->special_del = 0;
3320 	/* fill in asconf address parameter fields */
3321 	/* top level elements are "networked" during send */
3322 	aa->ifa = NULL;
3323 	aa->sent = 0;		/* clear sent flag */
3324 	vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3325 	vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3326 	vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3327 	vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3328 	vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3329 	TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3330 
3331 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3332 	    SCTP_M_ASC_ADDR);
3333 	if (aa == NULL) {
3334 		/* didn't get memory */
3335 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3336 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3337 		return;
3338 	}
3339 	memset(aa, 0, sizeof(struct sctp_asconf_addr));
3340 	/* fill in asconf address parameter fields */
3341 	/* ADD(0.0.0.0) */
3342 	switch (net->ro._l_addr.sa.sa_family) {
3343 #ifdef INET
3344 	case AF_INET:
3345 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3346 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3347 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3348 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3349 		/* No need to add an address, we are using 0.0.0.0 */
3350 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3351 		break;
3352 #endif
3353 #ifdef INET6
3354 	case AF_INET6:
3355 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3356 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3357 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3358 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3359 		/* No need to add an address, we are using 0.0.0.0 */
3360 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3361 		break;
3362 #endif
3363 	default:
3364 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3365 		    "sctp_asconf_send_nat_state_update: unknown address family\n");
3366 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3367 		return;
3368 	}
3369 	SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3370 	    SCTP_M_ASC_ADDR);
3371 	if (aa == NULL) {
3372 		/* didn't get memory */
3373 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3374 		    "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3375 		return;
3376 	}
3377 	memset(aa, 0, sizeof(struct sctp_asconf_addr));
3378 	/* fill in asconf address parameter fields */
3379 	/* ADD(0.0.0.0) */
3380 	switch (net->ro._l_addr.sa.sa_family) {
3381 #ifdef INET
3382 	case AF_INET:
3383 		aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3384 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3385 		aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3386 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3387 		/* No need to add an address, we are using 0.0.0.0 */
3388 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3389 		break;
3390 #endif
3391 #ifdef INET6
3392 	case AF_INET6:
3393 		aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3394 		aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3395 		aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3396 		aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3397 		/* No need to add an address, we are using 0.0.0.0 */
3398 		TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3399 		break;
3400 #endif
3401 	default:
3402 		SCTPDBG(SCTP_DEBUG_ASCONF1,
3403 		    "sctp_asconf_send_nat_state_update: unknown address family\n");
3404 		SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3405 		return;
3406 	}
3407 	/* Now we must hunt the addresses and add all global addresses */
3408 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3409 		struct sctp_vrf *vrf = NULL;
3410 		struct sctp_ifn *sctp_ifnp;
3411 		uint32_t vrf_id;
3412 
3413 		vrf_id = stcb->sctp_ep->def_vrf_id;
3414 		vrf = sctp_find_vrf(vrf_id);
3415 		if (vrf == NULL) {
3416 			goto skip_rest;
3417 		}
3418 		SCTP_IPI_ADDR_RLOCK();
3419 		LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3420 			LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3421 				switch (sctp_ifap->address.sa.sa_family) {
3422 #ifdef INET
3423 				case AF_INET:
3424 					to = &sctp_ifap->address.sin;
3425 					if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3426 					    &to->sin_addr) != 0) {
3427 						continue;
3428 					}
3429 					if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3430 						continue;
3431 					}
3432 					if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3433 						continue;
3434 					}
3435 					break;
3436 #endif
3437 #ifdef INET6
3438 				case AF_INET6:
3439 					to6 = &sctp_ifap->address.sin6;
3440 					if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3441 					    &to6->sin6_addr) != 0) {
3442 						continue;
3443 					}
3444 					if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3445 						continue;
3446 					}
3447 					if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3448 						continue;
3449 					}
3450 					break;
3451 #endif
3452 				default:
3453 					continue;
3454 				}
3455 				sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3456 			}
3457 		}
3458 		SCTP_IPI_ADDR_RUNLOCK();
3459 	} else {
3460 		struct sctp_laddr *laddr;
3461 
3462 		LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3463 			if (laddr->ifa == NULL) {
3464 				continue;
3465 			}
3466 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3467 				/*
3468 				 * Address being deleted by the system, dont
3469 				 * list.
3470 				 */
3471 				continue;
3472 			if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3473 				/*
3474 				 * Address being deleted on this ep don't
3475 				 * list.
3476 				 */
3477 				continue;
3478 			}
3479 			sctp_ifap = laddr->ifa;
3480 			switch (sctp_ifap->address.sa.sa_family) {
3481 #ifdef INET
3482 			case AF_INET:
3483 				to = &sctp_ifap->address.sin;
3484 				if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3485 					continue;
3486 				}
3487 				if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3488 					continue;
3489 				}
3490 				break;
3491 #endif
3492 #ifdef INET6
3493 			case AF_INET6:
3494 				to6 = &sctp_ifap->address.sin6;
3495 				if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3496 					continue;
3497 				}
3498 				if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3499 					continue;
3500 				}
3501 				break;
3502 #endif
3503 			default:
3504 				continue;
3505 			}
3506 			sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3507 		}
3508 	}
3509 skip_rest:
3510 	/* Now we must send the asconf into the queue */
3511 	sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3512 }
3513