1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/stream.h>
32 #include <sys/cmn_err.h>
33 #include <sys/socket.h>
34 #include <sys/kmem.h>
35 #include <sys/strsubr.h>
36 #include <sys/strsun.h>
37 
38 #include <netinet/in.h>
39 #include <netinet/ip6.h>
40 #include <netinet/sctp.h>
41 
42 #include <inet/common.h>
43 #include <inet/ip.h>
44 #include <inet/ip6.h>
45 #include <inet/mib2.h>
46 #include "sctp_impl.h"
47 #include "sctp_asconf.h"
48 #include "sctp_addr.h"
49 
50 typedef struct sctp_asconf_s {
51 	mblk_t *head;
52 	uint32_t cid;
53 } sctp_asconf_t;
54 
55 /*
56  * The ASCONF chunk per-parameter request interface. ph is the
57  * parameter header for the parameter in the request, and cid
58  * is the parameters correlation ID. cont should be set to 1
59  * if the ASCONF framework should continue processing request
60  * parameters following this one, or 0 if it should stop. If
61  * cont is -1, this indicates complete memory depletion, which
62  * will cause the ASCONF framework to abort building a reply. If
63  * act is 1, the callback should take whatever action it needs
64  * to fulfil this request. If act is 0, this request has already
65  * been processed, so the callback should only verify and pass
66  * back error parameters, and not take any action.
67  *
68  * The callback should return an mblk with any reply enclosed,
69  * with the correlation ID in the first four bytes of the
70  * message. A NULL return implies implicit success to the
71  * requestor.
72  */
73 typedef mblk_t *sctp_asconf_func_t(sctp_t *, sctp_parm_hdr_t *ph, uint32_t cid,
74     sctp_faddr_t *, int *cont, int act);
75 
76 /*
77  * The ASCONF chunk per-parameter ACK interface. ph is the parameter
78  * header for the parameter returned in the ACK, and oph is the
79  * original parameter sent out in the ASCONF request.
80  * If the peer implicitly responded OK (by not including an
81  * explicit OK for the request), ph will be NULL.
82  * ph can also point to an Unrecognized Parameter parameter,
83  * in which case the peer did not understand the request
84  * parameter.
85  *
86  * ph and oph parameter headers are in host byte order. Encapsulated
87  * parameters will still be in network byte order.
88  */
89 typedef void sctp_asconf_ack_func_t(sctp_t *, sctp_parm_hdr_t *ph,
90     sctp_parm_hdr_t *oph, sctp_faddr_t *);
91 
92 typedef struct {
93 	uint16_t id;
94 	sctp_asconf_func_t *asconf;
95 	sctp_asconf_ack_func_t *asconf_ack;
96 } dispatch_t;
97 
98 static sctp_asconf_func_t sctp_addip_req, sctp_setprim_req,
99     sctp_asconf_unrec_parm;
100 
101 static sctp_asconf_ack_func_t sctp_addip_ack, sctp_setprim_ack,
102     sctp_asconf_ack_unrec_parm;
103 
104 static const dispatch_t sctp_asconf_dispatch_tbl[] = {
105 /*	ID			ASCONF			ASCONF_ACK */
106 	{ PARM_ADD_IP,		sctp_addip_req,		sctp_addip_ack },
107 	{ PARM_DEL_IP,		sctp_addip_req,		sctp_addip_ack },
108 	{ PARM_SET_PRIMARY,	sctp_setprim_req,	sctp_setprim_ack }
109 };
110 
111 static const dispatch_t sctp_asconf_default_dispatch = {
112 	0, sctp_asconf_unrec_parm, sctp_asconf_ack_unrec_parm
113 };
114 
115 /*
116  * ASCONF framework
117  */
118 
119 static const dispatch_t *
120 sctp_lookup_asconf_dispatch(int id)
121 {
122 	int i;
123 
124 	for (i = 0; i < A_CNT(sctp_asconf_dispatch_tbl); i++) {
125 		if (sctp_asconf_dispatch_tbl[i].id == id) {
126 			return (sctp_asconf_dispatch_tbl + i);
127 		}
128 	}
129 
130 	return (&sctp_asconf_default_dispatch);
131 }
132 
133 /*
134  * Frees mp on failure
135  */
136 static mblk_t *
137 sctp_asconf_prepend_errwrap(mblk_t *mp, uint32_t cid)
138 {
139 	mblk_t		*wmp;
140 	sctp_parm_hdr_t	*wph;
141 
142 	/* Prepend a wrapper err cause ind param */
143 	wmp = allocb(sizeof (*wph) + sizeof (cid), BPRI_MED);
144 	if (wmp == NULL) {
145 		freemsg(mp);
146 		return (NULL);
147 	}
148 	wmp->b_wptr += sizeof (*wph) + sizeof (cid);
149 	wph = (sctp_parm_hdr_t *)wmp->b_rptr;
150 	wph->sph_type = htons(PARM_ERROR_IND);
151 	wph->sph_len = htons(msgdsize(mp) + sizeof (*wph) + sizeof (cid));
152 	bcopy(&cid, wph + 1, sizeof (uint32_t));
153 
154 	wmp->b_cont = mp;
155 	return (wmp);
156 }
157 
158 /*ARGSUSED*/
159 static mblk_t *
160 sctp_asconf_unrec_parm(sctp_t *sctp, sctp_parm_hdr_t *ph, uint32_t cid,
161     sctp_faddr_t *fp, int *cont, int act)
162 {
163 	mblk_t *mp = NULL;
164 
165 	/* Unrecognized param; check the high order bits */
166 	if ((ph->sph_type & 0xc000) == 0xc000) {
167 		/* report unrecognized param, and keep processing */
168 		sctp_add_unrec_parm(ph, &mp);
169 		if (mp == NULL) {
170 			*cont = -1;
171 			return (NULL);
172 		}
173 		/* Prepend a the CID and a wrapper err cause ind param */
174 		mp = sctp_asconf_prepend_errwrap(mp, cid);
175 		if (mp == NULL) {
176 			*cont = -1;
177 			return (NULL);
178 		}
179 
180 		*cont = 1;
181 		return (mp);
182 	}
183 	if (ph->sph_type & 0x4000) {
184 		/* Stop processing and drop; report unrecognized param */
185 		sctp_add_unrec_parm(ph, &mp);
186 		if (mp == NULL) {
187 			*cont = -1;
188 			return (NULL);
189 		}
190 		/* Prepend a the CID and a wrapper err cause ind param */
191 		mp = sctp_asconf_prepend_errwrap(mp, cid);
192 		if (mp == NULL) {
193 			*cont = -1;
194 			return (NULL);
195 		}
196 
197 		*cont = 0;
198 		return (mp);
199 	}
200 	if (ph->sph_type & 0x8000) {
201 		/* skip and continue processing */
202 		*cont = 1;
203 		return (NULL);
204 	}
205 
206 	/* 2 high bits are clear; stop processing and drop packet */
207 	*cont = 0;
208 	return (NULL);
209 }
210 
211 /*ARGSUSED*/
212 static void
213 sctp_asconf_ack_unrec_parm(sctp_t *sctp, sctp_parm_hdr_t *ph,
214     sctp_parm_hdr_t *oph, sctp_faddr_t *fp)
215 {
216 	ASSERT(ph);
217 	sctp_error_event(sctp, (sctp_chunk_hdr_t *)ph);
218 }
219 
220 static void
221 sctp_asconf_init(sctp_asconf_t *asc)
222 {
223 	ASSERT(asc != NULL);
224 
225 	asc->head = NULL;
226 	asc->cid = 0;
227 }
228 
229 static int
230 sctp_asconf_add(sctp_asconf_t *asc, mblk_t *mp)
231 {
232 	uint32_t *cp;
233 
234 	/* XXX can't exceed MTU */
235 
236 	cp = (uint32_t *)(mp->b_rptr + sizeof (sctp_parm_hdr_t));
237 	*cp = asc->cid++;
238 
239 	if (asc->head == NULL)
240 		asc->head = mp;
241 	else
242 		linkb(asc->head, mp);
243 
244 	return (0);
245 }
246 
247 static void
248 sctp_asconf_destroy(sctp_asconf_t *asc)
249 {
250 	if (asc->head != NULL) {
251 		freemsg(asc->head);
252 		asc->head = NULL;
253 	}
254 	asc->cid = 0;
255 }
256 
257 static int
258 sctp_asconf_send(sctp_t *sctp, sctp_asconf_t *asc, sctp_faddr_t *fp)
259 {
260 	mblk_t			*mp, *nmp;
261 	sctp_chunk_hdr_t	*ch;
262 	boolean_t		isv4;
263 	size_t			msgsize;
264 
265 	ASSERT(asc != NULL && asc->head != NULL);
266 
267 	isv4 = (fp != NULL) ? fp->isv4 : sctp->sctp_current->isv4;
268 
269 	/* SCTP chunk header + Serial Number + Address Param TLV */
270 	msgsize = sizeof (*ch) + sizeof (uint32_t) +
271 	    (isv4 ? PARM_ADDR4_LEN : PARM_ADDR6_LEN);
272 
273 	mp = allocb(msgsize, BPRI_MED);
274 	if (mp == NULL)
275 		return (ENOMEM);
276 
277 	mp->b_wptr += msgsize;
278 	mp->b_cont = asc->head;
279 
280 	ch = (sctp_chunk_hdr_t *)mp->b_rptr;
281 	ch->sch_id = CHUNK_ASCONF;
282 	ch->sch_flags = 0;
283 	ch->sch_len = htons(msgdsize(mp));
284 
285 	nmp = msgpullup(mp, -1);
286 	if (nmp == NULL) {
287 		freeb(mp);
288 		return (ENOMEM);
289 	}
290 
291 	/* Clean up the temporary mblk chain */
292 	freemsg(mp);
293 	asc->head = NULL;
294 	asc->cid = 0;
295 
296 	/* Queue it ... */
297 	if (sctp->sctp_cxmit_list == NULL) {
298 		sctp->sctp_cxmit_list = nmp;
299 	} else {
300 		linkb(sctp->sctp_cxmit_list, nmp);
301 	}
302 
303 	BUMP_LOCAL(sctp->sctp_obchunks);
304 
305 	/* And try to send it. */
306 	sctp_wput_asconf(sctp, fp);
307 
308 	return (0);
309 }
310 
311 /*
312  * If the peer does not understand an ASCONF chunk, we simply
313  * clear out the cxmit_list, since we can send nothing further
314  * that the peer will understand.
315  *
316  * Assumes chunk length has already been checked.
317  */
318 /*ARGSUSED*/
319 void
320 sctp_asconf_unrec_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch)
321 {
322 	if (sctp->sctp_cxmit_list == NULL) {
323 		/* Nothing pending */
324 		return;
325 	}
326 
327 	freemsg(sctp->sctp_cxmit_list);
328 	sctp->sctp_cxmit_list = NULL;
329 }
330 
331 void
332 sctp_input_asconf(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp)
333 {
334 	const dispatch_t	*dp;
335 	mblk_t			*hmp;
336 	mblk_t			*mp;
337 	uint32_t		*idp;
338 	uint32_t		*hidp;
339 	ssize_t			rlen;
340 	sctp_parm_hdr_t		*ph;
341 	sctp_chunk_hdr_t	*ach;
342 	int			cont;
343 	int			act;
344 	uint16_t		plen;
345 
346 	ASSERT(ch->sch_id == CHUNK_ASCONF);
347 
348 	idp = (uint32_t *)(ch + 1);
349 	rlen = ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*idp);
350 
351 	if (rlen < 0 || rlen < sizeof (*idp)) {
352 		/* nothing there; bail out */
353 		return;
354 	}
355 
356 	/* Check for duplicates */
357 	*idp = ntohl(*idp);
358 	if (*idp == (sctp->sctp_fcsn + 1)) {
359 		act = 1;
360 	} else if (*idp == sctp->sctp_fcsn) {
361 		act = 0;
362 	} else {
363 		/* stale or malicious packet; drop */
364 		return;
365 	}
366 
367 	/* Create the ASCONF_ACK header */
368 	hmp = sctp_make_mp(sctp, fp, sizeof (*ach) + sizeof (*idp));
369 	if (hmp == NULL) {
370 		/* Let the peer retransmit */
371 		return;
372 	}
373 	ach = (sctp_chunk_hdr_t *)hmp->b_wptr;
374 	ach->sch_id = CHUNK_ASCONF_ACK;
375 	ach->sch_flags = 0;
376 	/* Set the length later */
377 	hidp = (uint32_t *)(ach + 1);
378 	*hidp = htonl(*idp);
379 	hmp->b_wptr = (uchar_t *)(hidp + 1);
380 
381 	/* Move to the Address Parameter */
382 	ph = (sctp_parm_hdr_t *)(idp + 1);
383 	if (rlen <= ntohs(ph->sph_len)) {
384 		freeb(hmp);
385 		return;
386 	}
387 
388 	/*
389 	 * We already have the association here, so this address parameter
390 	 * doesn't seem to be very useful, should we make sure this is part
391 	 * of the association and send an error, if not?
392 	 * Ignore it for now.
393 	 */
394 	rlen -= ntohs(ph->sph_len);
395 	ph = (sctp_parm_hdr_t *)((char *)ph + ntohs(ph->sph_len));
396 	cont = 1;
397 	while (rlen > 0 && cont) {
398 		/* Sanity checks */
399 		if (rlen < sizeof (*ph))
400 			break;
401 		plen = ntohs(ph->sph_len);
402 		if (plen < sizeof (*ph) || plen > rlen) {
403 			break;
404 		}
405 		idp = (uint32_t *)(ph + 1);
406 		dp = sctp_lookup_asconf_dispatch(ntohs(ph->sph_type));
407 		ASSERT(dp);
408 		if (dp->asconf) {
409 			mp = dp->asconf(sctp, ph, *idp, fp, &cont, act);
410 			if (cont == -1) {
411 				/*
412 				 * Not even enough memory to create
413 				 * an out-of-resources error. Free
414 				 * everything and return; the peer
415 				 * should retransmit.
416 				 */
417 				freemsg(hmp);
418 				return;
419 			}
420 			if (mp != NULL) {
421 				linkb(hmp, mp);
422 			}
423 		}
424 		ph = sctp_next_parm(ph, &rlen);
425 		if (ph == NULL)
426 			break;
427 	}
428 
429 	/* Now that the params have been processed, increment the fcsn */
430 	if (act) {
431 		sctp->sctp_fcsn++;
432 	}
433 	BUMP_LOCAL(sctp->sctp_obchunks);
434 
435 	if (fp->isv4)
436 		ach->sch_len = htons(msgdsize(hmp) - sctp->sctp_hdr_len);
437 	else
438 		ach->sch_len = htons(msgdsize(hmp) - sctp->sctp_hdr6_len);
439 	sctp_set_iplen(sctp, hmp);
440 
441 	sctp_add_sendq(sctp, hmp);
442 	sctp_validate_peer(sctp);
443 }
444 
445 static sctp_parm_hdr_t *
446 sctp_lookup_asconf_param(sctp_parm_hdr_t *ph, uint32_t cid, ssize_t rlen)
447 {
448 	uint32_t *idp;
449 
450 	while (rlen > 0) {
451 		idp = (uint32_t *)(ph + 1);
452 		if (*idp == cid) {
453 			return (ph);
454 		}
455 		ph = sctp_next_parm(ph, &rlen);
456 		if (ph == NULL)
457 			break;
458 	}
459 	return (NULL);
460 }
461 
462 void
463 sctp_input_asconf_ack(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp)
464 {
465 	const dispatch_t	*dp;
466 	uint32_t		*idp;
467 	uint32_t		*snp;
468 	ssize_t			rlen;
469 	ssize_t			plen;
470 	sctp_parm_hdr_t		*ph;
471 	sctp_parm_hdr_t		*oph;
472 	sctp_parm_hdr_t		*fph;
473 	mblk_t			*mp;
474 	sctp_chunk_hdr_t	*och;
475 	int			redosrcs = 0;
476 	uint16_t		param_len;
477 
478 	ASSERT(ch->sch_id == CHUNK_ASCONF_ACK);
479 
480 	snp = (uint32_t *)(ch + 1);
481 	rlen = ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*snp);
482 	if (rlen < 0) {
483 		return;
484 	}
485 
486 	/* Accept only an ACK for the current serial number */
487 	*snp = ntohl(*snp);
488 	if (sctp->sctp_cxmit_list == NULL || *snp != (sctp->sctp_lcsn - 1)) {
489 		/* Need to send an abort */
490 		return;
491 	}
492 	sctp->sctp_cchunk_pend = 0;
493 	SCTP_FADDR_RC_TIMER_STOP(fp);
494 
495 	/*
496 	 * Pass explicit replies to callbacks:
497 	 * For each reply in the ACK, look up the corresponding
498 	 * original parameter in the request using the correlation
499 	 * ID, and pass it to the right callback.
500 	 */
501 	och = (sctp_chunk_hdr_t *)sctp->sctp_cxmit_list->b_rptr;
502 
503 	plen = ntohs(och->sch_len) - sizeof (*och) - sizeof (*idp);
504 	idp = (uint32_t *)(och + 1);
505 
506 	/* Get to the 1st ASCONF param, need to skip Address TLV parm */
507 	fph = (sctp_parm_hdr_t *)(idp + 1);
508 	plen -= ntohs(fph->sph_len);
509 	fph = (sctp_parm_hdr_t *)((char *)fph + ntohs(fph->sph_len));
510 	ph = (sctp_parm_hdr_t *)(snp + 1);
511 	while (rlen > 0) {
512 		/* Sanity checks */
513 		if (rlen < sizeof (*ph)) {
514 			break;
515 		}
516 		param_len = ntohs(ph->sph_len);
517 		if (param_len < sizeof (*ph) || param_len > rlen) {
518 			break;
519 		}
520 		idp = (uint32_t *)(ph + 1);
521 		oph = sctp_lookup_asconf_param(fph, *idp, plen);
522 		if (oph != NULL) {
523 			dp = sctp_lookup_asconf_dispatch(ntohs(oph->sph_type));
524 			ASSERT(dp);
525 			if (dp->asconf_ack) {
526 				dp->asconf_ack(sctp, ph, oph, fp);
527 
528 				/* hack. see below */
529 				if (oph->sph_type == htons(PARM_ADD_IP) ||
530 				    oph->sph_type == htons(PARM_DEL_IP)) {
531 					redosrcs = 1;
532 				}
533 			}
534 		}
535 
536 		ph = sctp_next_parm(ph, &rlen);
537 		if (ph == NULL)
538 			break;
539 	}
540 
541 	/*
542 	 * Pass implicit replies to callbacks:
543 	 * For each original request, look up its parameter
544 	 * in the ACK. If there is no corresponding reply,
545 	 * call the callback with a NULL parameter, indicating
546 	 * success.
547 	 */
548 	rlen = plen;
549 	plen = ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*idp);
550 	oph = fph;
551 	fph = (sctp_parm_hdr_t *)((char *)ch + sizeof (sctp_chunk_hdr_t) +
552 	    sizeof (uint32_t));
553 	while (rlen > 0) {
554 		idp = (uint32_t *)(oph + 1);
555 		ph = sctp_lookup_asconf_param(fph, *idp, plen);
556 		if (ph == NULL) {
557 			dp = sctp_lookup_asconf_dispatch(ntohs(oph->sph_type));
558 			ASSERT(dp);
559 			if (dp->asconf_ack) {
560 				dp->asconf_ack(sctp, NULL, oph, fp);
561 
562 				/* hack. see below */
563 				if (oph->sph_type == htons(PARM_ADD_IP) ||
564 				    oph->sph_type == htons(PARM_DEL_IP)) {
565 					redosrcs = 1;
566 				}
567 			}
568 		}
569 		oph = sctp_next_parm(oph, &rlen);
570 		if (oph == NULL) {
571 			break;
572 		}
573 	}
574 
575 	/* We can now free up the first chunk in the cxmit list */
576 	mp = sctp->sctp_cxmit_list;
577 	sctp->sctp_cxmit_list = mp->b_cont;
578 	mp->b_cont = NULL;
579 
580 	fp = SCTP_CHUNK_DEST(mp);
581 	ASSERT(fp != NULL && fp->suna >= MBLKL(mp));
582 	fp->suna -= MBLKL(mp);
583 	freeb(mp);
584 
585 	/* can now send the next control chunk */
586 	if (sctp->sctp_cxmit_list != NULL)
587 		sctp_wput_asconf(sctp, NULL);
588 
589 	/*
590 	 * If an add-ip or del-ip has completed (successfully or
591 	 * unsuccessfully), the pool of available source addresses
592 	 * may have changed, so we need to redo faddr source
593 	 * address selections. This is a bit of a hack since
594 	 * this really belongs in the add/del-ip code. However,
595 	 * that code consists of callbacks called for *each*
596 	 * add/del-ip parameter, and sctp_redo_faddr_srcs() is
597 	 * expensive enough that we really don't want to be
598 	 * doing it for each one. So we do it once here.
599 	 */
600 	if (redosrcs)
601 		sctp_redo_faddr_srcs(sctp);
602 }
603 
604 static void
605 sctp_rc_timer(sctp_t *sctp, sctp_faddr_t *fp)
606 {
607 #define	SCTP_CLR_SENT_FLAG(mp)	((mp)->b_flag &= ~SCTP_CHUNK_FLAG_SENT)
608 	sctp_faddr_t	*nfp;
609 	sctp_faddr_t	*ofp;
610 
611 	ASSERT(fp != NULL);
612 
613 	fp->rc_timer_running = 0;
614 
615 	if (sctp->sctp_state != SCTPS_ESTABLISHED ||
616 	    sctp->sctp_cxmit_list == NULL) {
617 		return;
618 	}
619 	/*
620 	 * Not a retransmission, this was deferred due to some error
621 	 * condition
622 	 */
623 	if (!SCTP_CHUNK_ISSENT(sctp->sctp_cxmit_list)) {
624 		sctp_wput_asconf(sctp, fp);
625 		return;
626 	}
627 	/*
628 	 * The sent flag indicates if the msg has been sent on this fp.
629 	 */
630 	SCTP_CLR_SENT_FLAG(sctp->sctp_cxmit_list);
631 	/* Retransmission */
632 	if (sctp->sctp_strikes >= sctp->sctp_pa_max_rxt) {
633 		/* time to give up */
634 		BUMP_MIB(&sctp_mib, sctpAborted);
635 		sctp_assoc_event(sctp, SCTP_COMM_LOST, 0, NULL);
636 		sctp_clean_death(sctp, ETIMEDOUT);
637 		return;
638 	}
639 	if (fp->strikes >= fp->max_retr) {
640 		if (sctp_faddr_dead(sctp, fp, SCTP_FADDRS_DOWN) == -1)
641 			return;
642 	}
643 
644 	fp->strikes++;
645 	sctp->sctp_strikes++;
646 	SCTP_CALC_RXT(fp, sctp->sctp_rto_max);
647 
648 	nfp = sctp_rotate_faddr(sctp, fp);
649 	sctp->sctp_cchunk_pend = 0;
650 	ofp = SCTP_CHUNK_DEST(sctp->sctp_cxmit_list);
651 	SCTP_SET_CHUNK_DEST(sctp->sctp_cxmit_list, NULL);
652 	ASSERT(ofp != NULL && ofp == fp);
653 	ASSERT(ofp->suna >= MBLKL(sctp->sctp_cxmit_list));
654 	/*
655 	 * Enter slow start for this destination.
656 	 * XXX anything in the data path that needs to be considered?
657 	 */
658 	ofp->ssthresh = ofp->cwnd / 2;
659 	if (ofp->ssthresh < 2 * ofp->sfa_pmss)
660 		ofp->ssthresh = 2 * ofp->sfa_pmss;
661 	ofp->cwnd = ofp->sfa_pmss;
662 	ofp->pba = 0;
663 	ofp->suna -= MBLKL(sctp->sctp_cxmit_list);
664 	/*
665 	 * The rexmit flags is used to determine if a serial number needs to
666 	 * be assigned or not, so once set we leave it there.
667 	 */
668 	if (!SCTP_CHUNK_WANT_REXMIT(sctp->sctp_cxmit_list))
669 		SCTP_CHUNK_REXMIT(sctp->sctp_cxmit_list);
670 	sctp_wput_asconf(sctp, nfp);
671 #undef	SCTP_CLR_SENT_FLAG
672 }
673 
674 void
675 sctp_wput_asconf(sctp_t *sctp, sctp_faddr_t *fp)
676 {
677 #define	SCTP_SET_SENT_FLAG(mp)	((mp)->b_flag = SCTP_CHUNK_FLAG_SENT)
678 
679 	mblk_t 			*mp;
680 	mblk_t			*ipmp;
681 	uint32_t 		*snp;
682 	sctp_parm_hdr_t		*ph;
683 	boolean_t		isv4;
684 
685 	if (sctp->sctp_cchunk_pend || sctp->sctp_cxmit_list == NULL ||
686 	    /* Queue it for later transmission if not yet established */
687 	    sctp->sctp_state < SCTPS_ESTABLISHED) {
688 		ip2dbg(("sctp_wput_asconf: cchunk pending? (%d) or null "\
689 		    "sctp_cxmit_list? (%s) or incorrect state? (%x)\n",
690 		    sctp->sctp_cchunk_pend, sctp->sctp_cxmit_list == NULL ?
691 		    "yes" : "no", sctp->sctp_state));
692 		return;
693 	}
694 
695 	if (fp == NULL)
696 		fp = sctp->sctp_current;
697 
698 	/* OK to send */
699 	ipmp = sctp_make_mp(sctp, fp, 0);
700 	if (ipmp == NULL) {
701 		SCTP_FADDR_RC_TIMER_RESTART(sctp, fp, fp->rto);
702 		return;
703 	}
704 	mp = sctp->sctp_cxmit_list;
705 	/* Fill in the mandatory  Address Parameter TLV */
706 	isv4 = (fp != NULL) ? fp->isv4 : sctp->sctp_current->isv4;
707 	ph = (sctp_parm_hdr_t *)(mp->b_rptr + sizeof (sctp_chunk_hdr_t) +
708 	    sizeof (uint32_t));
709 	if (isv4) {
710 		ipha_t		*ipha = (ipha_t *)ipmp->b_rptr;
711 		in6_addr_t	ipaddr;
712 		ipaddr_t	addr4;
713 
714 		ph->sph_type = htons(PARM_ADDR4);
715 		ph->sph_len = htons(PARM_ADDR4_LEN);
716 		if (ipha->ipha_src != INADDR_ANY) {
717 			bcopy(&ipha->ipha_src, ph + 1, IP_ADDR_LEN);
718 		} else {
719 			ipaddr = sctp_get_valid_addr(sctp, B_FALSE);
720 			/*
721 			 * All the addresses are down.
722 			 * Maybe we might have better luck next time.
723 			 */
724 			if (IN6_IS_ADDR_V4MAPPED_ANY(&ipaddr)) {
725 				SCTP_FADDR_RC_TIMER_RESTART(sctp, fp, fp->rto);
726 				freeb(ipmp);
727 				return;
728 			}
729 			IN6_V4MAPPED_TO_IPADDR(&ipaddr, addr4);
730 			bcopy(&addr4, ph + 1, IP_ADDR_LEN);
731 		}
732 	} else {
733 		ip6_t		*ip6 = (ip6_t *)ipmp->b_rptr;
734 		in6_addr_t	ipaddr;
735 
736 		ph->sph_type = htons(PARM_ADDR6);
737 		ph->sph_len = htons(PARM_ADDR6_LEN);
738 		if (!IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
739 			bcopy(&ip6->ip6_src, ph + 1, IPV6_ADDR_LEN);
740 		} else {
741 			ipaddr = sctp_get_valid_addr(sctp, B_TRUE);
742 			/*
743 			 * All the addresses are down.
744 			 * Maybe we might have better luck next time.
745 			 */
746 			if (IN6_IS_ADDR_UNSPECIFIED(&ipaddr)) {
747 				SCTP_FADDR_RC_TIMER_RESTART(sctp, fp, fp->rto);
748 				freeb(ipmp);
749 				return;
750 			}
751 			bcopy(&ipaddr, ph + 1, IPV6_ADDR_LEN);
752 		}
753 	}
754 
755 	/* Don't exceed CWND */
756 	if ((MBLKL(mp) > (fp->cwnd - fp->suna)) ||
757 	    ((mp = dupb(sctp->sctp_cxmit_list)) == NULL)) {
758 		SCTP_FADDR_RC_TIMER_RESTART(sctp, fp, fp->rto);
759 		freeb(ipmp);
760 		return;
761 	}
762 
763 	/* Set the serial number now, if sending for the first time */
764 	if (!SCTP_CHUNK_WANT_REXMIT(mp)) {
765 		snp = (uint32_t *)(mp->b_rptr + sizeof (sctp_chunk_hdr_t));
766 		*snp = htonl(sctp->sctp_lcsn++);
767 	}
768 	SCTP_CHUNK_CLEAR_FLAGS(mp);
769 	fp->suna += MBLKL(mp);
770 	/* Attach the header and send the chunk */
771 	ipmp->b_cont = mp;
772 	sctp_set_iplen(sctp, ipmp);
773 	sctp->sctp_cchunk_pend = 1;
774 
775 	SCTP_SET_SENT_FLAG(sctp->sctp_cxmit_list);
776 	SCTP_SET_CHUNK_DEST(sctp->sctp_cxmit_list, fp);
777 	sctp_add_sendq(sctp, ipmp);
778 	SCTP_FADDR_RC_TIMER_RESTART(sctp, fp, fp->rto);
779 #undef	SCTP_SET_SENT_FLAG
780 }
781 
782 /*
783  * Generate ASCONF error param, include errph, if present.
784  */
785 static mblk_t *
786 sctp_asconf_adderr(int err, sctp_parm_hdr_t *errph, uint32_t cid)
787 {
788 	mblk_t		*mp;
789 	sctp_parm_hdr_t	*eph;
790 	sctp_parm_hdr_t	*wph;
791 	size_t		len;
792 	size_t		elen = 0;
793 
794 	len = sizeof (*wph) + sizeof (*eph) + sizeof (cid);
795 	if (errph != NULL) {
796 		elen = ntohs(errph->sph_len);
797 		len += elen;
798 	}
799 	mp = allocb(len, BPRI_MED);
800 	if (mp == NULL) {
801 		return (NULL);
802 	}
803 	wph = (sctp_parm_hdr_t *)mp->b_rptr;
804 	/* error cause wrapper */
805 	wph->sph_type = htons(PARM_ERROR_IND);
806 	wph->sph_len = htons(len);
807 	bcopy(&cid, wph + 1, sizeof (uint32_t));
808 
809 	/* error cause */
810 	eph = (sctp_parm_hdr_t *)((char *)wph + sizeof (sctp_parm_hdr_t) +
811 	    sizeof (cid));
812 	eph->sph_type = htons(err);
813 	eph->sph_len = htons(len - sizeof (*wph) - sizeof (cid));
814 	mp->b_wptr = (uchar_t *)(eph + 1);
815 
816 	/* details */
817 	if (elen > 0) {
818 		bcopy(errph, mp->b_wptr, elen);
819 		mp->b_wptr += elen;
820 	}
821 	return (mp);
822 }
823 
824 static mblk_t *
825 sctp_check_addip_addr(sctp_parm_hdr_t *ph, sctp_parm_hdr_t *oph, int *cont,
826     uint32_t cid, in6_addr_t *raddr)
827 {
828 	uint16_t	atype;
829 	uint16_t	alen;
830 	mblk_t		*mp;
831 	in6_addr_t	addr;
832 	ipaddr_t	*addr4;
833 
834 	atype = ntohs(ph->sph_type);
835 	alen = ntohs(ph->sph_len);
836 
837 	if (atype != PARM_ADDR4 && atype != PARM_ADDR6) {
838 		mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph, cid);
839 		if (mp == NULL) {
840 			*cont = -1;
841 		}
842 		return (mp);
843 	}
844 	if ((atype == PARM_ADDR4 && alen < PARM_ADDR4_LEN) ||
845 	    (atype == PARM_ADDR6 && alen < PARM_ADDR6_LEN)) {
846 		mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph, cid);
847 		if (mp == NULL) {
848 			*cont = -1;
849 		}
850 		return (mp);
851 	}
852 
853 	/* Address parameter is present; extract and screen it */
854 	if (atype == PARM_ADDR4) {
855 		addr4 = (ipaddr_t *)(ph + 1);
856 		IN6_IPADDR_TO_V4MAPPED(*addr4, &addr);
857 
858 		/* screen XXX loopback to scoping */
859 		if (*addr4 == 0 || *addr4 == INADDR_BROADCAST ||
860 		    *addr4 == htonl(INADDR_LOOPBACK) || IN_MULTICAST(*addr4)) {
861 			dprint(1, ("addip: addr not unicast: %x:%x:%x:%x\n",
862 			    SCTP_PRINTADDR(addr)));
863 			mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph,
864 			    cid);
865 			if (mp == NULL) {
866 				*cont = -1;
867 			}
868 			return (mp);
869 		}
870 		/*
871 		 * XXX also need to check for subnet
872 		 * broadcasts. This should probably
873 		 * wait until we have full access
874 		 * to the ILL tables.
875 		 */
876 
877 	} else {
878 		bcopy(ph + 1, &addr, sizeof (addr));
879 
880 		/* screen XXX loopback to scoping */
881 		if (IN6_IS_ADDR_LINKLOCAL(&addr) ||
882 		    IN6_IS_ADDR_MULTICAST(&addr) ||
883 		    IN6_IS_ADDR_LOOPBACK(&addr)) {
884 			dprint(1, ("addip: addr not unicast: %x:%x:%x:%x\n",
885 			    SCTP_PRINTADDR(addr)));
886 			mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph,
887 			    cid);
888 			if (mp == NULL) {
889 				*cont = -1;
890 			}
891 			return (mp);
892 		}
893 
894 	}
895 
896 	/* OK */
897 	*raddr = addr;
898 	return (NULL);
899 }
900 
901 /*
902  * Handles both add and delete address requests.
903  */
904 static mblk_t *
905 sctp_addip_req(sctp_t *sctp, sctp_parm_hdr_t *ph, uint32_t cid,
906     sctp_faddr_t *fp, int *cont, int act)
907 {
908 	in6_addr_t	addr;
909 	uint16_t	type;
910 	mblk_t		*mp;
911 	sctp_faddr_t	*nfp;
912 	sctp_parm_hdr_t	*oph;
913 
914 	*cont = 1;
915 
916 	/* Send back an authorization error if addip is disabled */
917 	if (!sctp_addip_enabled) {
918 		mp = sctp_asconf_adderr(SCTP_ERR_UNAUTHORIZED, ph, cid);
919 		if (mp == NULL)
920 			*cont = -1;
921 		return (mp);
922 	}
923 	/* Check input */
924 	if (ntohs(ph->sph_len) < (sizeof (*ph) * 2)) {
925 		mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, ph, cid);
926 		if (mp == NULL) {
927 			*cont = -1;
928 		}
929 		return (mp);
930 	}
931 
932 	type = ntohs(ph->sph_type);
933 	oph = ph;
934 	ph = (sctp_parm_hdr_t *)((char *)ph + sizeof (sctp_parm_hdr_t) +
935 	    sizeof (cid));
936 	mp = sctp_check_addip_addr(ph, oph, cont, cid, &addr);
937 	if (mp != NULL)
938 		return (mp);
939 
940 	if (type == PARM_ADD_IP) {
941 		if (sctp_lookup_faddr(sctp, &addr) != NULL) {
942 			/* Address is already part of association */
943 			dprint(1, ("addip: addr already here: %x:%x:%x:%x\n",
944 			    SCTP_PRINTADDR(addr)));
945 			mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph,
946 			    cid);
947 			if (mp == NULL) {
948 				*cont = -1;
949 			}
950 			return (mp);
951 		}
952 
953 		if (!act) {
954 			return (NULL);
955 		}
956 		/* Add the new address */
957 		mutex_enter(&sctp->sctp_conn_tfp->tf_lock);
958 		if (sctp_add_faddr(sctp, &addr, KM_NOSLEEP) != 0) {
959 			mutex_exit(&sctp->sctp_conn_tfp->tf_lock);
960 			/* no memory */
961 			*cont = -1;
962 			return (NULL);
963 		}
964 		mutex_exit(&sctp->sctp_conn_tfp->tf_lock);
965 		sctp_intf_event(sctp, addr, SCTP_ADDR_ADDED, 0);
966 	} else if (type == PARM_DEL_IP) {
967 		nfp = sctp_lookup_faddr(sctp, &addr);
968 		if (nfp == NULL) {
969 			/*
970 			 * Peer is trying to delete an address that is not
971 			 * part of the association.
972 			 */
973 			dprint(1, ("delip: addr not here: %x:%x:%x:%x\n",
974 			    SCTP_PRINTADDR(addr)));
975 			mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph,
976 			    cid);
977 			if (mp == NULL) {
978 				*cont = -1;
979 			}
980 			return (mp);
981 		}
982 		if (sctp->sctp_faddrs == nfp && nfp->next == NULL) {
983 			/* Peer is trying to delete last address */
984 			dprint(1, ("delip: del last addr: %x:%x:%x:%x\n",
985 			    SCTP_PRINTADDR(addr)));
986 			mp = sctp_asconf_adderr(SCTP_ERR_DEL_LAST_ADDR, oph,
987 			    cid);
988 			if (mp == NULL) {
989 				*cont = -1;
990 			}
991 			return (mp);
992 		}
993 		if (nfp == fp) {
994 			/* Peer is trying to delete source address */
995 			dprint(1, ("delip: del src addr: %x:%x:%x:%x\n",
996 			    SCTP_PRINTADDR(addr)));
997 			mp = sctp_asconf_adderr(SCTP_ERR_DEL_SRC_ADDR, oph,
998 			    cid);
999 			if (mp == NULL) {
1000 				*cont = -1;
1001 			}
1002 			return (mp);
1003 		}
1004 		if (!act) {
1005 			return (NULL);
1006 		}
1007 
1008 		sctp_unlink_faddr(sctp, nfp);
1009 		/* Update all references to the deleted faddr */
1010 		if (sctp->sctp_primary == nfp) {
1011 			sctp->sctp_primary = fp;
1012 		}
1013 		if (sctp->sctp_current == nfp) {
1014 			sctp->sctp_current = fp;
1015 			sctp->sctp_mss = fp->sfa_pmss;
1016 			sctp_faddr2hdraddr(fp, sctp);
1017 
1018 			if (!SCTP_IS_DETACHED(sctp)) {
1019 				sctp_set_ulp_prop(sctp);
1020 			}
1021 		}
1022 		if (sctp->sctp_lastdata == nfp) {
1023 			sctp->sctp_lastdata = fp;
1024 		}
1025 		if (sctp->sctp_shutdown_faddr == nfp) {
1026 			sctp->sctp_shutdown_faddr = nfp;
1027 		}
1028 		if (sctp->sctp_lastfaddr == nfp) {
1029 			for (fp = sctp->sctp_faddrs; fp->next; fp = fp->next)
1030 				;
1031 			sctp->sctp_lastfaddr = fp;
1032 		}
1033 		sctp_intf_event(sctp, addr, SCTP_ADDR_REMOVED, 0);
1034 	} else {
1035 		ASSERT(0);
1036 	}
1037 
1038 	/* Successful, don't need to return anything. */
1039 	return (NULL);
1040 }
1041 
1042 /*
1043  * Handles both add and delete IP ACKs.
1044  */
1045 /*ARGSUSED*/
1046 static void
1047 sctp_addip_ack(sctp_t *sctp, sctp_parm_hdr_t *ph, sctp_parm_hdr_t *oph,
1048     sctp_faddr_t *fp)
1049 {
1050 	in6_addr_t		addr;
1051 	sctp_saddr_ipif_t	*sp;
1052 	ipaddr_t		*addr4;
1053 	boolean_t		backout = B_FALSE;
1054 	uint16_t		type;
1055 	uint32_t		*cid;
1056 
1057 	/* If the peer doesn't understand Add-IP, remember it */
1058 	if (ph != NULL && ph->sph_type == htons(PARM_UNRECOGNIZED)) {
1059 		sctp->sctp_understands_addip = B_FALSE;
1060 		backout = B_TRUE;
1061 	}
1062 
1063 	/*
1064 	 * If OK, continue with the add / delete action, otherwise
1065 	 * back out the action.
1066 	 */
1067 	if (ph != NULL && ph->sph_type != htons(PARM_SUCCESS)) {
1068 		backout = B_TRUE;
1069 		sctp_error_event(sctp, (sctp_chunk_hdr_t *)ph);
1070 	}
1071 
1072 	type = ntohs(oph->sph_type);
1073 	cid = (uint32_t *)(oph + 1);
1074 	oph = (sctp_parm_hdr_t *)(cid + 1);
1075 	if (oph->sph_type == htons(PARM_ADDR4)) {
1076 		addr4 = (ipaddr_t *)(oph + 1);
1077 		IN6_IPADDR_TO_V4MAPPED(*addr4, &addr);
1078 	} else {
1079 		bcopy(oph + 1, &addr, sizeof (addr));
1080 	}
1081 
1082 	sp = sctp_saddr_lookup(sctp, &addr);
1083 	ASSERT(sp != NULL);
1084 
1085 	if (type == PARM_ADD_IP) {
1086 		if (backout) {
1087 			sctp_del_saddr(sctp, sp);
1088 		} else {
1089 			sp->saddr_ipif_dontsrc = 0;
1090 		}
1091 	} else if (type == PARM_DEL_IP) {
1092 		if (backout) {
1093 			sp->saddr_ipif_delete_pending = 0;
1094 			sp->saddr_ipif_dontsrc = 0;
1095 		} else {
1096 			sctp_del_saddr(sctp, sp);
1097 		}
1098 	} else {
1099 		/* Must be either PARM_ADD_IP or PARM_DEL_IP */
1100 		ASSERT(0);
1101 	}
1102 }
1103 
1104 /*ARGSUSED*/
1105 static mblk_t *
1106 sctp_setprim_req(sctp_t *sctp, sctp_parm_hdr_t *ph, uint32_t cid,
1107     sctp_faddr_t *fp, int *cont, int act)
1108 {
1109 	mblk_t *mp;
1110 	sctp_parm_hdr_t *oph;
1111 	sctp_faddr_t *nfp;
1112 	in6_addr_t addr;
1113 
1114 	*cont = 1;
1115 
1116 	/* Check input */
1117 	if (ntohs(ph->sph_len) < (sizeof (*ph) * 2)) {
1118 		mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, ph, cid);
1119 		if (mp == NULL) {
1120 			*cont = -1;
1121 		}
1122 		return (mp);
1123 	}
1124 
1125 	oph = ph;
1126 	ph = (sctp_parm_hdr_t *)((char *)ph + sizeof (sctp_parm_hdr_t) +
1127 	    sizeof (cid));
1128 	mp = sctp_check_addip_addr(ph, oph, cont, cid, &addr);
1129 	if (mp != NULL) {
1130 		return (mp);
1131 	}
1132 
1133 	nfp = sctp_lookup_faddr(sctp, &addr);
1134 	if (nfp == NULL) {
1135 		/*
1136 		 * Peer is trying to set an address that is not
1137 		 * part of the association.
1138 		 */
1139 		dprint(1, ("setprim: addr not here: %x:%x:%x:%x\n",
1140 		    SCTP_PRINTADDR(addr)));
1141 		mp = sctp_asconf_adderr(SCTP_ERR_BAD_MANDPARM, oph, cid);
1142 		if (mp == NULL) {
1143 			*cont = -1;
1144 		}
1145 		return (mp);
1146 	}
1147 
1148 	sctp_intf_event(sctp, addr, SCTP_ADDR_MADE_PRIM, 0);
1149 	sctp->sctp_primary = nfp;
1150 	if (nfp->state != SCTP_FADDRS_ALIVE || nfp == sctp->sctp_current) {
1151 		return (NULL);
1152 	}
1153 	sctp->sctp_current = nfp;
1154 	sctp->sctp_mss = nfp->sfa_pmss;
1155 
1156 	/* Reset the addrs in the composite header */
1157 	sctp_faddr2hdraddr(nfp, sctp);
1158 	if (!SCTP_IS_DETACHED(sctp)) {
1159 		sctp_set_ulp_prop(sctp);
1160 	}
1161 
1162 	return (NULL);
1163 }
1164 
1165 /*ARGSUSED*/
1166 static void
1167 sctp_setprim_ack(sctp_t *sctp, sctp_parm_hdr_t *ph, sctp_parm_hdr_t *oph,
1168     sctp_faddr_t *fp)
1169 {
1170 	if (ph != NULL && ph->sph_type != htons(PARM_SUCCESS)) {
1171 		/* If the peer doesn't understand Add-IP, remember it */
1172 		if (ph->sph_type == htons(PARM_UNRECOGNIZED)) {
1173 			sctp->sctp_understands_addip = B_FALSE;
1174 		}
1175 		sctp_error_event(sctp, (sctp_chunk_hdr_t *)ph);
1176 	}
1177 
1178 	/* On success we do nothing */
1179 }
1180 
1181 int
1182 sctp_add_ip(sctp_t *sctp, const void *addrs, uint32_t cnt)
1183 {
1184 	struct sockaddr_in	*sin4;
1185 	struct sockaddr_in6	*sin6;
1186 	mblk_t			*mp;
1187 	int			error = 0;
1188 	int			i;
1189 	sctp_addip4_t		*ad4;
1190 	sctp_addip6_t		*ad6;
1191 	sctp_asconf_t		asc[1];
1192 	uint16_t		type = htons(PARM_ADD_IP);
1193 	boolean_t		v4mapped = B_FALSE;
1194 
1195 	/* Does the peer understand ASCONF and Add-IP? */
1196 	if (!sctp->sctp_understands_asconf || !sctp->sctp_understands_addip)
1197 		return (EOPNOTSUPP);
1198 
1199 	sctp_asconf_init(asc);
1200 
1201 	/*
1202 	 * Screen addresses:
1203 	 * If adding:
1204 	 *   o Must not already be a part of the association
1205 	 *   o Must be AF_INET or AF_INET6
1206 	 *   o XXX Must be valid source address for this node
1207 	 *   o Must be unicast
1208 	 *   o XXX Must fit scoping rules
1209 	 * If deleting:
1210 	 *   o Must be part of the association
1211 	 */
1212 	for (i = 0; i < cnt; i++) {
1213 		switch (sctp->sctp_family) {
1214 		case AF_INET:
1215 			sin4 = (struct sockaddr_in *)addrs + i;
1216 			v4mapped = B_TRUE;
1217 			break;
1218 
1219 		case AF_INET6:
1220 			sin6 = (struct sockaddr_in6 *)addrs + i;
1221 			break;
1222 		}
1223 
1224 		if (v4mapped) {
1225 			mp = allocb(sizeof (*ad4), BPRI_MED);
1226 			if (mp == NULL) {
1227 				error = ENOMEM;
1228 				goto fail;
1229 			}
1230 			mp->b_wptr += sizeof (*ad4);
1231 			ad4 = (sctp_addip4_t *)mp->b_rptr;
1232 			ad4->sad4_addip_ph.sph_type = type;
1233 			ad4->sad4_addip_ph.sph_len =
1234 			    htons(sizeof (sctp_parm_hdr_t) +
1235 			    PARM_ADDR4_LEN + sizeof (ad4->asconf_req_cid));
1236 			ad4->sad4_addr4_ph.sph_type = htons(PARM_ADDR4);
1237 			ad4->sad4_addr4_ph.sph_len = htons(PARM_ADDR4_LEN);
1238 			ad4->sad4_addr = sin4->sin_addr.s_addr;
1239 		} else {
1240 			mp = allocb(sizeof (*ad6), BPRI_MED);
1241 			if (mp == NULL) {
1242 				error = ENOMEM;
1243 				goto fail;
1244 			}
1245 			mp->b_wptr += sizeof (*ad6);
1246 			ad6 = (sctp_addip6_t *)mp->b_rptr;
1247 			ad6->sad6_addip_ph.sph_type = type;
1248 			ad6->sad6_addip_ph.sph_len =
1249 			    htons(sizeof (sctp_parm_hdr_t) +
1250 			    PARM_ADDR6_LEN + sizeof (ad6->asconf_req_cid));
1251 			ad6->sad6_addr6_ph.sph_type = htons(PARM_ADDR6);
1252 			ad6->sad6_addr6_ph.sph_len = htons(PARM_ADDR6_LEN);
1253 			ad6->sad6_addr = sin6->sin6_addr;
1254 		}
1255 		error = sctp_asconf_add(asc, mp);
1256 		if (error != 0)
1257 			goto fail;
1258 	}
1259 	error = sctp_asconf_send(sctp, asc, sctp->sctp_current);
1260 	if (error != 0)
1261 		goto fail;
1262 
1263 	return (0);
1264 
1265 fail:
1266 	sctp_asconf_destroy(asc);
1267 	return (error);
1268 }
1269 
1270 int
1271 sctp_del_ip(sctp_t *sctp, const void *addrs, uint32_t cnt)
1272 {
1273 	struct sockaddr_in	*sin4;
1274 	struct sockaddr_in6	*sin6;
1275 	mblk_t			*mp;
1276 	int			error = 0;
1277 	int			i;
1278 	int			addrcnt = 0;
1279 	sctp_addip4_t		*ad4;
1280 	sctp_addip6_t		*ad6;
1281 	sctp_asconf_t		asc[1];
1282 	sctp_saddr_ipif_t	*nsp;
1283 	uint16_t		type = htons(PARM_DEL_IP);
1284 	boolean_t		v4mapped = B_FALSE;
1285 	in6_addr_t		addr;
1286 	boolean_t		asconf = B_TRUE;
1287 
1288 	/* Does the peer understand ASCONF and Add-IP? */
1289 	if (sctp->sctp_state <= SCTPS_LISTEN || !sctp_addip_enabled ||
1290 	    !sctp->sctp_understands_asconf || !sctp->sctp_understands_addip) {
1291 		asconf = B_FALSE;
1292 	}
1293 
1294 	if (asconf)
1295 		sctp_asconf_init(asc);
1296 	/*
1297 	 * Screen addresses:
1298 	 * If adding:
1299 	 *   o Must not already be a part of the association
1300 	 *   o Must be AF_INET or AF_INET6
1301 	 *   o XXX Must be valid source address for this node
1302 	 *   o Must be unicast
1303 	 *   o XXX Must fit scoping rules
1304 	 * If deleting:
1305 	 *   o Must be part of the association
1306 	 */
1307 	for (i = 0; i < cnt; i++) {
1308 		switch (sctp->sctp_family) {
1309 		case AF_INET:
1310 			sin4 = (struct sockaddr_in *)addrs + i;
1311 			v4mapped = B_TRUE;
1312 			IN6_IPADDR_TO_V4MAPPED(sin4->sin_addr.s_addr, &addr);
1313 			break;
1314 
1315 		case AF_INET6:
1316 			sin6 = (struct sockaddr_in6 *)addrs + i;
1317 			addr = sin6->sin6_addr;
1318 			break;
1319 		}
1320 		nsp = sctp_saddr_lookup(sctp, &addr);
1321 		if (nsp == NULL) {
1322 			error = EADDRNOTAVAIL;
1323 			goto fail;
1324 		}
1325 
1326 		if (!asconf)
1327 			continue;
1328 
1329 		nsp->saddr_ipif_delete_pending = 1;
1330 		nsp->saddr_ipif_dontsrc = 1;
1331 		addrcnt++;
1332 		if (v4mapped) {
1333 			mp = allocb(sizeof (*ad4), BPRI_MED);
1334 			if (mp == NULL) {
1335 				error = ENOMEM;
1336 				goto fail;
1337 			}
1338 			mp->b_wptr += sizeof (*ad4);
1339 			ad4 = (sctp_addip4_t *)mp->b_rptr;
1340 			ad4->sad4_addip_ph.sph_type = type;
1341 			ad4->sad4_addip_ph.sph_len =
1342 			    htons(sizeof (sctp_parm_hdr_t) +
1343 			    PARM_ADDR4_LEN + sizeof (ad4->asconf_req_cid));
1344 			ad4->sad4_addr4_ph.sph_type = htons(PARM_ADDR4);
1345 			ad4->sad4_addr4_ph.sph_len = htons(PARM_ADDR4_LEN);
1346 			ad4->sad4_addr = sin4->sin_addr.s_addr;
1347 		} else {
1348 			mp = allocb(sizeof (*ad6), BPRI_MED);
1349 			if (mp == NULL) {
1350 				error = ENOMEM;
1351 				goto fail;
1352 			}
1353 			mp->b_wptr += sizeof (*ad6);
1354 			ad6 = (sctp_addip6_t *)mp->b_rptr;
1355 			ad6->sad6_addip_ph.sph_type = type;
1356 			ad6->sad6_addip_ph.sph_len =
1357 			    htons(sizeof (sctp_parm_hdr_t) + PARM_ADDR6_LEN +
1358 			    sizeof (ad6->asconf_req_cid));
1359 			ad6->sad6_addr6_ph.sph_type = htons(PARM_ADDR6);
1360 			ad6->sad6_addr6_ph.sph_len = htons(PARM_ADDR6_LEN);
1361 			ad6->sad6_addr = addr;
1362 		}
1363 
1364 		error = sctp_asconf_add(asc, mp);
1365 		if (error != 0)
1366 			goto fail;
1367 	}
1368 
1369 	if (!asconf) {
1370 		sctp_del_saddr_list(sctp, addrs, cnt, B_FALSE);
1371 		return (0);
1372 	}
1373 	error = sctp_asconf_send(sctp, asc, sctp->sctp_current);
1374 	if (error != 0)
1375 		goto fail;
1376 	sctp_redo_faddr_srcs(sctp);
1377 	return (0);
1378 
1379 fail:
1380 	if (!asconf)
1381 		return (error);
1382 	for (i = 0; i < addrcnt; i++) {
1383 		switch (sctp->sctp_family) {
1384 		case AF_INET:
1385 			sin4 = (struct sockaddr_in *)addrs + i;
1386 			IN6_INADDR_TO_V4MAPPED(&(sin4->sin_addr), &addr);
1387 			break;
1388 		case AF_INET6:
1389 			sin6 = (struct sockaddr_in6 *)addrs + i;
1390 			addr = sin6->sin6_addr;
1391 			break;
1392 		}
1393 		nsp = sctp_saddr_lookup(sctp, &addr);
1394 		ASSERT(nsp != NULL);
1395 		nsp->saddr_ipif_delete_pending = 0;
1396 		nsp->saddr_ipif_dontsrc = 0;
1397 	}
1398 	sctp_asconf_destroy(asc);
1399 
1400 	return (error);
1401 }
1402 
1403 int
1404 sctp_set_peerprim(sctp_t *sctp, const void *inp, uint_t inlen)
1405 {
1406 	const struct sctp_setprim	*prim = inp;
1407 	const struct sockaddr_storage	*ss;
1408 	struct sockaddr_in *sin;
1409 	struct sockaddr_in6 *sin6;
1410 	in6_addr_t addr;
1411 	mblk_t *mp;
1412 	sctp_saddr_ipif_t *sp;
1413 	sctp_addip4_t *ad4;
1414 	sctp_addip6_t *ad6;
1415 	sctp_asconf_t asc[1];
1416 	int error = 0;
1417 
1418 	/* Does the peer understand ASCONF and Add-IP? */
1419 	if (!sctp->sctp_understands_asconf || !sctp->sctp_understands_addip) {
1420 		return (EOPNOTSUPP);
1421 	}
1422 
1423 	if (inlen < sizeof (*prim))
1424 		return (EINVAL);
1425 
1426 	/* Don't do anything if we are not connected */
1427 	if (sctp->sctp_state != SCTPS_ESTABLISHED)
1428 		return (EINVAL);
1429 
1430 	ss = &prim->ssp_addr;
1431 	sin = NULL;
1432 	sin6 = NULL;
1433 	if (ss->ss_family == AF_INET) {
1434 		sin = (struct sockaddr_in *)ss;
1435 		IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &addr);
1436 	} else if (ss->ss_family == AF_INET6) {
1437 		sin6 = (struct sockaddr_in6 *)ss;
1438 		addr = sin6->sin6_addr;
1439 	} else {
1440 		return (EAFNOSUPPORT);
1441 	}
1442 	sp = sctp_saddr_lookup(sctp, &addr);
1443 	if (sp == NULL)
1444 		return (EADDRNOTAVAIL);
1445 	sctp_asconf_init(asc);
1446 	if (sin) {
1447 		mp = allocb(sizeof (*ad4), BPRI_MED);
1448 		if (mp == NULL) {
1449 			error = ENOMEM;
1450 			goto fail;
1451 		}
1452 		mp->b_wptr += sizeof (*ad4);
1453 		ad4 = (sctp_addip4_t *)mp->b_rptr;
1454 		ad4->sad4_addip_ph.sph_type = htons(PARM_SET_PRIMARY);
1455 		ad4->sad4_addip_ph.sph_len = htons(sizeof (sctp_parm_hdr_t) +
1456 		    PARM_ADDR4_LEN + sizeof (ad4->asconf_req_cid));
1457 		ad4->sad4_addr4_ph.sph_type = htons(PARM_ADDR4);
1458 		ad4->sad4_addr4_ph.sph_len = htons(PARM_ADDR4_LEN);
1459 		ad4->sad4_addr = sin->sin_addr.s_addr;
1460 	} else {
1461 		mp = allocb(sizeof (*ad6), BPRI_MED);
1462 		if (mp == NULL) {
1463 			error = ENOMEM;
1464 			goto fail;
1465 		}
1466 		mp->b_wptr += sizeof (*ad6);
1467 		ad6 = (sctp_addip6_t *)mp->b_rptr;
1468 		ad6->sad6_addip_ph.sph_type = htons(PARM_SET_PRIMARY);
1469 		ad6->sad6_addip_ph.sph_len = htons(sizeof (sctp_parm_hdr_t) +
1470 		    PARM_ADDR6_LEN + sizeof (ad6->asconf_req_cid));
1471 		ad6->sad6_addr6_ph.sph_type = htons(PARM_ADDR6);
1472 		ad6->sad6_addr6_ph.sph_len = htons(PARM_ADDR6_LEN);
1473 		ad6->sad6_addr = sin6->sin6_addr;
1474 	}
1475 
1476 	error = sctp_asconf_add(asc, mp);
1477 	if (error != 0) {
1478 		goto fail;
1479 	}
1480 
1481 	error = sctp_asconf_send(sctp, asc, sctp->sctp_current);
1482 	if (error == 0) {
1483 		return (0);
1484 	}
1485 
1486 fail:
1487 	sctp_asconf_destroy(asc);
1488 	return (error);
1489 }
1490