sys/netinet/sctp_output.c

   1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
   2
   3 /*
   4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #if !(defined(__OpenBSD__) || defined (__APPLE__))
  33 #include "opt_ipsec.h"
  34 #endif
  35 #if defined(__FreeBSD__) || defined(__DragonFly__)
  36 #include "opt_compat.h"
  37 #include "opt_inet6.h"
  38 #include "opt_inet.h"
  39 #endif
  40 #if defined(__NetBSD__)
  41 #include "opt_inet.h"
  42 #endif
  43 #ifdef __APPLE__
  44 #include <sctp.h>
  45 #elif !defined(__OpenBSD__)
  46 #include "opt_sctp.h"
  47 #endif
  48 #include <sys/param.h>
  49 #include <sys/systm.h>
  50 #include <sys/malloc.h>
  51 #include <sys/mbuf.h>
  52 #ifndef __OpenBSD__
  53 #include <sys/domain.h>
  54 #endif
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/sysctl.h>
  61 #include <sys/resourcevar.h>
  62 #include <sys/uio.h>
  63 #ifdef INET6
  64 #include <sys/domain.h>
  65 #endif
  66 #include <sys/thread2.h>
  67 #include <sys/socketvar2.h>
  68
  69 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  70 #include <sys/limits.h>
  71 #else
  72 #include <machine/limits.h>
  73 #endif
  74 #include <machine/cpu.h>
  75
  76 #include <net/if.h>
  77 #include <net/if_types.h>
  78
  79 #if defined(__FreeBSD__) || defined(__DragonFly__)
  80 #include <net/if_var.h>
  81 #endif
  82
  83 #include <net/route.h>
  84
  85 #include <netinet/in.h>
  86 #include <netinet/in_systm.h>
  87 #include <netinet/ip.h>
  88 #include <netinet/in_pcb.h>
  89 #include <netinet/in_var.h>
  90 #include <netinet/ip_var.h>
  91
  92 #ifdef INET6
  93 #include <netinet/ip6.h>
  94 #include <netinet6/ip6_var.h>
  95 #include <netinet6/scope6_var.h>
  96 #include <netinet6/nd6.h>
  97
  98 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
  99 #include <netinet6/in6_pcb.h>
 100 #elif defined(__OpenBSD__)
 101 #include <netinet/in_pcb.h>
 102 #endif
 103
 104 #include <netinet/icmp6.h>
 105
 106 #endif /* INET6 */
 107
 108 #include <net/net_osdep.h>
 109
 110 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
 111 #ifndef in6pcb
 112 #define in6pcb          inpcb
 113 #endif
 114 #endif
 115
 116 #include <netinet/sctp_pcb.h>
 117
 118 #ifdef IPSEC
 119 #ifndef __OpenBSD__
 120 #include <netinet6/ipsec.h>
 121 #include <netproto/key/key.h>
 122 #else
 123 #undef IPSEC
 124 #endif
 125 #endif /* IPSEC */
 126
 127 #include <netinet/sctp_var.h>
 128 #include <netinet/sctp_header.h>
 129 #include <netinet/sctputil.h>
 130 #include <netinet/sctp_pcb.h>
 131 #include <netinet/sctp_output.h>
 132 #include <netinet/sctp_uio.h>
 133 #include <netinet/sctputil.h>
 134 #include <netinet/sctp_hashdriver.h>
 135 #include <netinet/sctp_timer.h>
 136 #include <netinet/sctp_asconf.h>
 137 #include <netinet/sctp_indata.h>
 138
 139 #ifdef SCTP_DEBUG
 140 extern uint32_t sctp_debug_on;
 141 #endif
 142
 143 extern int sctp_peer_chunk_oh;
 144
 145 static int
 146 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
 147 {
 148         struct cmsghdr cmh;
 149         int tlen, at;
 150
 151         tlen = control->m_len;
 152         at = 0;
 153         /*
 154          * Independent of how many mbufs, find the c_type inside the control
 155          * structure and copy out the data.
 156          */
 157         while (at < tlen) {
 158                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
 159                         /* not enough room for one more we are done. */
 160                         return (0);
 161                 }
 162                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
 163                 if ((cmh.cmsg_len + at) > tlen) {
 164                         /*
 165                          * this is real messed up since there is not enough
 166                          * data here to cover the cmsg header. We are done.
 167                          */
 168                         return (0);
 169                 }
 170                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
 171                     (c_type == cmh.cmsg_type)) {
 172                         /* found the one we want, copy it out */
 173                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
 174                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
 175                                 /*
 176                                  * space of cmsg_len after header not
 177                                  * big enough
 178                                  */
 179                                 return (0);
 180                         }
 181                         m_copydata(control, at, cpsize, data);
 182                         return (1);
 183                  } else {
 184                         at += CMSG_ALIGN(cmh.cmsg_len);
 185                         if (cmh.cmsg_len == 0) {
 186                                 break;
 187                         }
 188                 }
 189         }
 190         /* not found */
 191         return (0);
 192 }
 193
 194 static struct mbuf *
 195 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
 196 {
 197         struct sctp_paramhdr *parmh;
 198         struct mbuf *mret;
 199         int len;
 200         if (ifa->ifa_addr->sa_family == AF_INET) {
 201                 len = sizeof(struct sctp_ipv4addr_param);
 202         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 203                 len = sizeof(struct sctp_ipv6addr_param);
 204         } else {
 205                 /* unknown type */
 206                 return (m);
 207         }
 208
 209         if (M_TRAILINGSPACE(m) >= len) {
 210                 /* easy side we just drop it on the end */
 211                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
 212                 mret = m;
 213         } else {
 214                 /* Need more space */
 215                 mret = m;
 216                 while (mret->m_next != NULL) {
 217                         mret = mret->m_next;
 218                 }
 219                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
 220                 if (mret->m_next == NULL) {
 221                         /* We are hosed, can't add more addresses */
 222                         return (m);
 223                 }
 224                 mret = mret->m_next;
 225                 parmh = mtod(mret, struct sctp_paramhdr *);
 226         }
 227         /* now add the parameter */
 228         if (ifa->ifa_addr->sa_family == AF_INET) {
 229                 struct sctp_ipv4addr_param *ipv4p;
 230                 struct sockaddr_in *sin;
 231                 sin = (struct sockaddr_in *)ifa->ifa_addr;
 232                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
 233                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
 234                 parmh->param_length = htons(len);
 235                 ipv4p->addr = sin->sin_addr.s_addr;
 236                 mret->m_len += len;
 237         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 238                 struct sctp_ipv6addr_param *ipv6p;
 239                 struct sockaddr_in6 *sin6;
 240                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
 241                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
 242                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
 243                 parmh->param_length = htons(len);
 244                 memcpy(ipv6p->addr, &sin6->sin6_addr,
 245                     sizeof(ipv6p->addr));
 246                 /* clear embedded scope in the address */
 247                 in6_clearscope((struct in6_addr *)ipv6p->addr);
 248                 mret->m_len += len;
 249         } else {
 250                 return (m);
 251         }
 252         return (mret);
 253 }
 254
 255
 256
 257 static struct mbuf *
 258 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
 259     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
 260 {
 261         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
 262         struct sctp_state_cookie *stc;
 263         struct sctp_paramhdr *ph;
 264         uint8_t *signature;
 265         int sig_offset;
 266         uint16_t cookie_sz;
 267
 268         mret = NULL;
 269
 270         MGET(mret, MB_DONTWAIT, MT_DATA);
 271         if (mret == NULL) {
 272                 return (NULL);
 273         }
 274         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
 275         if (copy_init == NULL) {
 276                 sctp_m_freem(mret);
 277                 return (NULL);
 278         }
 279         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
 280             MB_DONTWAIT);
 281         if (copy_initack == NULL) {
 282                 sctp_m_freem(mret);
 283                 sctp_m_freem(copy_init);
 284                 return (NULL);
 285         }
 286         /* easy side we just drop it on the end */
 287         ph = mtod(mret, struct sctp_paramhdr *);
 288         mret->m_len = sizeof(struct sctp_state_cookie) +
 289             sizeof(struct sctp_paramhdr);
 290         stc = (struct sctp_state_cookie *)((caddr_t)ph +
 291             sizeof(struct sctp_paramhdr));
 292         ph->param_type = htons(SCTP_STATE_COOKIE);
 293         ph->param_length = 0;   /* fill in at the end */
 294         /* Fill in the stc cookie data */
 295         *stc = *stc_in;
 296
 297         /* tack the INIT and then the INIT-ACK onto the chain */
 298         cookie_sz = 0;
 299         m_at = mret;
 300         for (m_at = mret; m_at; m_at = m_at->m_next) {
 301                 cookie_sz += m_at->m_len;
 302                 if (m_at->m_next == NULL) {
 303                         m_at->m_next = copy_init;
 304                         break;
 305                 }
 306         }
 307
 308         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
 309                 cookie_sz += m_at->m_len;
 310                 if (m_at->m_next == NULL) {
 311                         m_at->m_next = copy_initack;
 312                         break;
 313                 }
 314         }
 315
 316         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
 317                 cookie_sz += m_at->m_len;
 318                 if (m_at->m_next == NULL) {
 319                         break;
 320                 }
 321         }
 322         MGET(sig, MB_DONTWAIT, MT_DATA);
 323         if (sig == NULL) {
 324                 /* no space */
 325                 sctp_m_freem(mret);
 326                 sctp_m_freem(copy_init);
 327                 sctp_m_freem(copy_initack);
 328                 return (NULL);
 329         }
 330         sig->m_len = 0;
 331         m_at->m_next = sig;
 332         sig_offset = 0;
 333         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
 334         /* Time to sign the cookie */
 335         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
 336             (int)(inp->sctp_ep.current_secret_number)],
 337             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), signature);
 338         sig->m_len += SCTP_SIGNATURE_SIZE;
 339         cookie_sz += SCTP_SIGNATURE_SIZE;
 340
 341         ph->param_length = htons(cookie_sz);
 342         return (mret);
 343 }
 344
 345
 346 static struct sockaddr_in *
 347 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 348 {
 349         struct sockaddr_in *sin;
 350         /*
 351          * Here we determine if its a prefered address. A
 352          * prefered address means it is the same scope or
 353          * higher scope then the destination.
 354          *  L = loopback, P = private, G = global
 355          * -----------------------------------------
 356          *  src    |      dest     |    result
 357          *-----------------------------------------
 358          *   L     |       L       |    yes
 359          *-----------------------------------------
 360          *   P     |       L       |    yes
 361          *-----------------------------------------
 362          *   G     |       L       |    yes
 363          *-----------------------------------------
 364          *   L     |       P       |    no
 365          *-----------------------------------------
 366          *   P     |       P       |    yes
 367          *-----------------------------------------
 368          *   G     |       P       |    no
 369          *-----------------------------------------
 370          *   L     |       G       |    no
 371          *-----------------------------------------
 372          *   P     |       G       |    no
 373          *-----------------------------------------
 374          *   G     |       G       |    yes
 375          *-----------------------------------------
 376          */
 377
 378         if (ifa->ifa_addr->sa_family != AF_INET) {
 379                 /* forget non-v4 */
 380                 return (NULL);
 381         }
 382         /* Ok the address may be ok */
 383         sin = (struct sockaddr_in *)ifa->ifa_addr;
 384         if (sin->sin_addr.s_addr == 0) {
 385                 return (NULL);
 386         }
 387         *sin_local = *sin_loop = 0;
 388         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 389             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 390                 *sin_loop = 1;
 391                 *sin_local = 1;
 392         }
 393         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 394                 *sin_local = 1;
 395         }
 396         if (!loopscope && *sin_loop) {
 397                 /* Its a loopback address and we don't have loop scope */
 398                 return (NULL);
 399         }
 400         if (!ipv4_scope && *sin_local) {
 401                 /* Its a private address, and we don't have private address scope */
 402                 return (NULL);
 403         }
 404         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
 405                 /* its a global src and a private dest */
 406                 return (NULL);
 407         }
 408         /* its a prefered address */
 409         return (sin);
 410 }
 411
 412 static struct sockaddr_in *
 413 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 414 {
 415         struct sockaddr_in *sin;
 416         /*
 417          * Here we determine if its a acceptable address. A
 418          * acceptable address means it is the same scope or
 419          * higher scope but we can allow for NAT which means
 420          * its ok to have a global dest and a private src.
 421          *
 422          *  L = loopback, P = private, G = global
 423          * -----------------------------------------
 424          *  src    |      dest     |    result
 425          *-----------------------------------------
 426          *   L     |       L       |    yes
 427          *-----------------------------------------
 428          *   P     |       L       |    yes
 429          *-----------------------------------------
 430          *   G     |       L       |    yes
 431          *-----------------------------------------
 432          *   L     |       P       |    no
 433          *-----------------------------------------
 434          *   P     |       P       |    yes
 435          *-----------------------------------------
 436          *   G     |       P       |    yes - probably this won't work.
 437          *-----------------------------------------
 438          *   L     |       G       |    no
 439          *-----------------------------------------
 440          *   P     |       G       |    yes
 441          *-----------------------------------------
 442          *   G     |       G       |    yes
 443          *-----------------------------------------
 444          */
 445
 446         if (ifa->ifa_addr->sa_family != AF_INET) {
 447                 /* forget non-v4 */
 448                 return (NULL);
 449         }
 450         /* Ok the address may be ok */
 451         sin = (struct sockaddr_in *)ifa->ifa_addr;
 452         if (sin->sin_addr.s_addr == 0) {
 453                 return (NULL);
 454         }
 455         *sin_local = *sin_loop = 0;
 456         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 457             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 458                 *sin_loop = 1;
 459                 *sin_local = 1;
 460         }
 461         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 462                 *sin_local = 1;
 463         }
 464         if (!loopscope && *sin_loop) {
 465                 /* Its a loopback address and we don't have loop scope */
 466                 return (NULL);
 467         }
 468         /* its an acceptable address */
 469         return (sin);
 470 }
 471
 472 /*
 473  * This treats the address list on the ep as a restricted list
 474  * (negative list). If a the passed address is listed, then
 475  * the address is NOT allowed on the association.
 476  */
 477 int
 478 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
 479 {
 480         struct sctp_laddr *laddr;
 481 #ifdef SCTP_DEBUG
 482         int cnt=0;
 483 #endif
 484         if (stcb == NULL) {
 485                 /* There are no restrictions, no TCB :-) */
 486                 return (0);
 487         }
 488 #ifdef SCTP_DEBUG
 489         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 490                 cnt++;
 491         }
 492         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 493                 kprintf("There are %d addresses on the restricted list\n", cnt);
 494         }
 495         cnt = 0;
 496 #endif
 497         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 498                 if (laddr->ifa == NULL) {
 499 #ifdef SCTP_DEBUG
 500                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 501                                 kprintf("Help I have fallen and I can't get up!\n");
 502                         }
 503 #endif
 504                         continue;
 505                 }
 506 #ifdef SCTP_DEBUG
 507                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 508                         cnt++;
 509                         kprintf("Restricted address[%d]:", cnt);
 510                         sctp_print_address(laddr->ifa->ifa_addr);
 511                 }
 512 #endif
 513                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
 514                         /* Yes it is on the list */
 515                         return (1);
 516                 }
 517         }
 518         return (0);
 519 }
 520
 521 static int
 522 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 523 {
 524         struct sctp_laddr *laddr;
 525
 526         if (ifa == NULL)
 527                 return (0);
 528         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 529                 if (laddr->ifa == NULL) {
 530 #ifdef SCTP_DEBUG
 531                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 532                                 kprintf("Help I have fallen and I can't get up!\n");
 533                         }
 534 #endif
 535                         continue;
 536                 }
 537                 if (laddr->ifa->ifa_addr == NULL)
 538                         continue;
 539                 if (laddr->ifa == ifa)
 540                         /* same pointer */
 541                         return (1);
 542                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
 543                         /* skip non compatible address comparison */
 544                         continue;
 545                 }
 546                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 547                         /* Yes it is restricted */
 548                         return (1);
 549                 }
 550         }
 551         return (0);
 552 }
 553
 554
 555
 556 static struct in_addr
 557 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
 558                                  struct rtentry *rt,
 559                                  uint8_t ipv4_scope,
 560                                  uint8_t loopscope)
 561 {
 562         struct in_addr ans;
 563         struct sctp_laddr *laddr;
 564         struct sockaddr_in *sin;
 565         struct ifnet *ifn;
 566         uint8_t sin_loop, sin_local;
 567
 568         /* first question, is the ifn we will emit on
 569          * in our list, if so, we want that one.
 570          */
 571         ifn = rt->rt_ifp;
 572         if (ifn) {
 573                 struct ifaddr_container *ifac;
 574
 575                 /* is a prefered one on the interface we route out? */
 576                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 577                         struct ifaddr *ifa = ifac->ifa;
 578
 579                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 580                         if (sin == NULL)
 581                                 continue;
 582                         if (sctp_is_addr_in_ep(inp, ifa)) {
 583                                 return (sin->sin_addr);
 584                         }
 585                 }
 586                 /* is an acceptable one on the interface we route out? */
 587                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 588                         struct ifaddr *ifa = ifac->ifa;
 589
 590                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 591                         if (sin == NULL)
 592                                 continue;
 593                         if (sctp_is_addr_in_ep(inp, ifa)) {
 594                                 return (sin->sin_addr);
 595                         }
 596                 }
 597         }
 598         /* ok, what about a prefered address in the inp */
 599         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 600              laddr && (laddr != inp->next_addr_touse);
 601              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 602                 if (laddr->ifa == NULL) {
 603                         /* address has been removed */
 604                         continue;
 605                 }
 606                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 607                 if (sin == NULL)
 608                         continue;
 609                 return (sin->sin_addr);
 610
 611         }
 612         /* ok, what about an acceptable address in the inp */
 613         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 614              laddr && (laddr != inp->next_addr_touse);
 615              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 616                 if (laddr->ifa == NULL) {
 617                         /* address has been removed */
 618                         continue;
 619                 }
 620                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 621                 if (sin == NULL)
 622                         continue;
 623                 return (sin->sin_addr);
 624
 625         }
 626
 627         /* no address bound can be a source for the destination we are in trouble */
 628 #ifdef SCTP_DEBUG
 629         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 630                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
 631         }
 632 #endif
 633         memset(&ans, 0, sizeof(ans));
 634         return (ans);
 635 }
 636
 637
 638
 639 static struct in_addr
 640 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
 641                                   struct sctp_tcb *stcb,
 642                                   struct sctp_nets *net,
 643                                   struct rtentry *rt,
 644                                   uint8_t ipv4_scope,
 645                                   uint8_t loopscope,
 646                                   int non_asoc_addr_ok)
 647 {
 648         /*
 649          * Here we have two cases, bound all asconf
 650          * allowed. bound all asconf not allowed.
 651          *
 652          */
 653         struct sctp_laddr *laddr, *starting_point;
 654         struct in_addr ans;
 655         struct ifnet *ifn;
 656         uint8_t sin_loop, sin_local, start_at_beginning=0;
 657         struct sockaddr_in *sin;
 658
 659         /* first question, is the ifn we will emit on
 660          * in our list, if so, we want that one.
 661          */
 662         ifn = rt->rt_ifp;
 663
 664         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
 665                 /*
 666                  * Here we use the list of addresses on the endpoint. Then
 667                  * the addresses listed on the "restricted" list is just that,
 668                  * address that have not been added and can't be used (unless
 669                  * the non_asoc_addr_ok is set).
 670                  */
 671 #ifdef SCTP_DEBUG
 672                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 673                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
 674                 }
 675 #endif
 676                 /* first question, is the ifn we will emit on
 677                  * in our list, if so, we want that one.
 678                  */
 679                 if (ifn) {
 680                         struct ifaddr_container *ifac;
 681
 682                         /* first try for an prefered address on the ep */
 683                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 684                                 struct ifaddr *ifa = ifac->ifa;
 685
 686                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 687                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 688                                         if (sin == NULL)
 689                                                 continue;
 690                                         if ((non_asoc_addr_ok == 0) &&
 691                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 692                                                 /* on the no-no list */
 693                                                 continue;
 694                                         }
 695                                         return (sin->sin_addr);
 696                                 }
 697                         }
 698                         /* next try for an acceptable address on the ep */
 699                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 700                                 struct ifaddr *ifa = ifac->ifa;
 701
 702                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 703                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 704                                         if (sin == NULL)
 705                                                 continue;
 706                                         if ((non_asoc_addr_ok == 0) &&
 707                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 708                                                 /* on the no-no list */
 709                                                 continue;
 710                                         }
 711                                         return (sin->sin_addr);
 712                                 }
 713                         }
 714
 715                 }
 716                 /* if we can't find one like that then we must
 717                  * look at all addresses bound to pick one at
 718                  * first prefereable then secondly acceptable.
 719                  */
 720                 starting_point = stcb->asoc.last_used_address;
 721         sctpv4_from_the_top:
 722                 if (stcb->asoc.last_used_address == NULL) {
 723                         start_at_beginning=1;
 724                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 725                 }
 726                 /* search beginning with the last used address */
 727                 for (laddr = stcb->asoc.last_used_address; laddr;
 728                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 729                         if (laddr->ifa == NULL) {
 730                                 /* address has been removed */
 731                                 continue;
 732                         }
 733                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 734                         if (sin == NULL)
 735                                 continue;
 736                         if ((non_asoc_addr_ok == 0) &&
 737                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 738                                 /* on the no-no list */
 739                                 continue;
 740                         }
 741                         return (sin->sin_addr);
 742
 743                 }
 744                 if (start_at_beginning == 0) {
 745                         stcb->asoc.last_used_address = NULL;
 746                         goto sctpv4_from_the_top;
 747                 }
 748                 /* now try for any higher scope than the destination */
 749                 stcb->asoc.last_used_address = starting_point;
 750                 start_at_beginning = 0;
 751         sctpv4_from_the_top2:
 752                 if (stcb->asoc.last_used_address == NULL) {
 753                         start_at_beginning=1;
 754                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 755                 }
 756                 /* search beginning with the last used address */
 757                 for (laddr = stcb->asoc.last_used_address; laddr;
 758                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 759                         if (laddr->ifa == NULL) {
 760                                 /* address has been removed */
 761                                 continue;
 762                         }
 763                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 764                         if (sin == NULL)
 765                                 continue;
 766                         if ((non_asoc_addr_ok == 0) &&
 767                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 768                                 /* on the no-no list */
 769                                 continue;
 770                         }
 771                         return (sin->sin_addr);
 772                 }
 773                 if (start_at_beginning == 0) {
 774                         stcb->asoc.last_used_address = NULL;
 775                         goto sctpv4_from_the_top2;
 776                 }
 777         } else {
 778                 /*
 779                  * Here we have an address list on the association, thats the
 780                  * only valid source addresses that we can use.
 781                  */
 782 #ifdef SCTP_DEBUG
 783                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 784                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
 785                 }
 786 #endif
 787                 /* First look at all addresses for one that is on
 788                  * the interface we route out
 789                  */
 790                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 791                              sctp_nxt_addr) {
 792                         if (laddr->ifa == NULL) {
 793                                 /* address has been removed */
 794                                 continue;
 795                         }
 796                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 797                         if (sin == NULL)
 798                                 continue;
 799                         /* first question, is laddr->ifa an address associated with the emit interface */
 800                         if (ifn) {
 801                                 struct ifaddr_container *ifac;
 802
 803                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 804                                         struct ifaddr *ifa = ifac->ifa;
 805
 806                                         if (laddr->ifa == ifa) {
 807                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 808                                                 return (sin->sin_addr);
 809                                         }
 810                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 811                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 812                                                 return (sin->sin_addr);
 813                                         }
 814                                 }
 815                         }
 816                 }
 817                 /* what about an acceptable one on the interface? */
 818                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 819                              sctp_nxt_addr) {
 820                         if (laddr->ifa == NULL) {
 821                                 /* address has been removed */
 822                                 continue;
 823                         }
 824                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 825                         if (sin == NULL)
 826                                 continue;
 827                         /* first question, is laddr->ifa an address associated with the emit interface */
 828                         if (ifn) {
 829                                 struct ifaddr_container *ifac;
 830
 831                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 832                                         struct ifaddr *ifa = ifac->ifa;
 833
 834                                         if (laddr->ifa == ifa) {
 835                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 836                                                 return (sin->sin_addr);
 837                                         }
 838                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 839                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 840                                                 return (sin->sin_addr);
 841                                         }
 842                                 }
 843                         }
 844                 }
 845                 /* ok, next one that is preferable in general */
 846                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 847                              sctp_nxt_addr) {
 848                         if (laddr->ifa == NULL) {
 849                                 /* address has been removed */
 850                                 continue;
 851                         }
 852                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 853                         if (sin == NULL)
 854                                 continue;
 855                         return (sin->sin_addr);
 856                 }
 857
 858                 /* last, what about one that is acceptable */
 859                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 860                              sctp_nxt_addr) {
 861                         if (laddr->ifa == NULL) {
 862                                 /* address has been removed */
 863                                 continue;
 864                         }
 865                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 866                         if (sin == NULL)
 867                                 continue;
 868                         return (sin->sin_addr);
 869                 }
 870         }
 871         memset(&ans, 0, sizeof(ans));
 872         return (ans);
 873 }
 874
 875 static struct sockaddr_in *
 876 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 877                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
 878 {
 879         struct ifaddr_container *ifac;
 880         struct sockaddr_in *sin;
 881         uint8_t sin_loop, sin_local;
 882         int num_eligible_addr = 0;
 883
 884         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 885                 struct ifaddr *ifa = ifac->ifa;
 886
 887                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 888                 if (sin == NULL)
 889                         continue;
 890                 if (stcb) {
 891                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 892                                 /* It is restricted for some reason.. probably
 893                                  * not yet added.
 894                                  */
 895                                 continue;
 896                         }
 897                 }
 898                 if (cur_addr_num == num_eligible_addr) {
 899                         return (sin);
 900                 }
 901         }
 902         return (NULL);
 903 }
 904
 905
 906 static int
 907 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 908                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 909 {
 910         struct ifaddr_container *ifac;
 911         struct sockaddr_in *sin;
 912         int num_eligible_addr = 0;
 913
 914         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 915                 struct ifaddr *ifa = ifac->ifa;
 916
 917                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
 918                 if (sin == NULL)
 919                         continue;
 920                 if (stcb) {
 921                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 922                                 /* It is restricted for some reason.. probably
 923                                  * not yet added.
 924                                  */
 925                                 continue;
 926                         }
 927                 }
 928                 num_eligible_addr++;
 929         }
 930         return (num_eligible_addr);
 931
 932 }
 933
 934 static struct in_addr
 935 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
 936                         struct sctp_tcb *stcb,
 937                         struct sctp_nets *net,
 938                         struct rtentry *rt,
 939                         uint8_t ipv4_scope,
 940                         uint8_t loopscope,
 941                         int non_asoc_addr_ok)
 942 {
 943         int cur_addr_num=0, num_prefered=0;
 944         uint8_t sin_loop, sin_local;
 945         struct ifnet *ifn;
 946         struct sockaddr_in *sin;
 947         struct in_addr ans;
 948         struct ifaddr_container *ifac;
 949         /*
 950          * For v4 we can use (in boundall) any address in the association. If
 951          * non_asoc_addr_ok is set we can use any address (at least in theory).
 952          * So we look for prefered addresses first. If we find one, we use it.
 953          * Otherwise we next try to get an address on the interface, which we
 954          * should be able to do (unless non_asoc_addr_ok is false and we are
 955          * routed out that way). In these cases where we can't use the address
 956          * of the interface we go through all the ifn's looking for an address
 957          * we can use and fill that in. Punting means we send back address
 958          * 0, which will probably cause problems actually since then IP will
 959          * fill in the address of the route ifn, which means we probably already
 960          * rejected it.. i.e. here comes an abort :-<.
 961          */
 962         ifn = rt->rt_ifp;
 963         if (net) {
 964                 cur_addr_num = net->indx_of_eligible_next_to_use;
 965         }
 966         if (ifn == NULL) {
 967                 goto bound_all_v4_plan_c;
 968         }
 969         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
 970 #ifdef SCTP_DEBUG
 971         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 972                 kprintf("Found %d preferred source addresses\n", num_prefered);
 973         }
 974 #endif
 975         if (num_prefered == 0) {
 976                 /* no eligible addresses, we must use some other
 977                  * interface address if we can find one.
 978                  */
 979                 goto bound_all_v4_plan_b;
 980         }
 981         /* Ok we have num_eligible_addr set with how many we can use,
 982          * this may vary from call to call due to addresses being deprecated etc..
 983          */
 984         if (cur_addr_num >= num_prefered) {
 985                 cur_addr_num = 0;
 986         }
 987         /* select the nth address from the list (where cur_addr_num is the nth) and
 988          * 0 is the first one, 1 is the second one etc...
 989          */
 990 #ifdef SCTP_DEBUG
 991         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 992                 kprintf("cur_addr_num:%d\n", cur_addr_num);
 993         }
 994 #endif
 995         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
 996                                                                    ipv4_scope, cur_addr_num);
 997
 998         /* if sin is NULL something changed??, plan_a now */
 999         if (sin) {
1000                 return (sin->sin_addr);
1001         }
1002
1003         /*
1004          * plan_b: Look at the interface that we emit on
1005          *         and see if we can find an acceptable address.
1006          */
1007  bound_all_v4_plan_b:
1008         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1009                 struct ifaddr *ifa = ifac->ifa;
1010
1011                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1012                 if (sin == NULL)
1013                         continue;
1014                 if (stcb) {
1015                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1016                                 /* It is restricted for some reason.. probably
1017                                  * not yet added.
1018                                  */
1019                                 continue;
1020                         }
1021                 }
1022                 return (sin->sin_addr);
1023         }
1024         /*
1025          * plan_c: Look at all interfaces and find a prefered
1026          *         address. If we reache here we are in trouble I think.
1027          */
1028  bound_all_v4_plan_c:
1029         for (ifn = TAILQ_FIRST(&ifnet);
1030              ifn && (ifn != inp->next_ifn_touse);
1031              ifn=TAILQ_NEXT(ifn, if_list)) {
1032                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1033                         /* wrong base scope */
1034                         continue;
1035                 }
1036                 if (ifn == rt->rt_ifp)
1037                         /* already looked at this guy */
1038                         continue;
1039                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1040                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1041 #ifdef SCTP_DEBUG
1042                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1043                         kprintf("Found ifn:%p %d preferred source addresses\n", ifn, num_prefered);
1044                 }
1045 #endif
1046                 if (num_prefered == 0) {
1047                         /*
1048                          * None on this interface.
1049                          */
1050                         continue;
1051                 }
1052                 /* Ok we have num_eligible_addr set with how many we can use,
1053                  * this may vary from call to call due to addresses being deprecated etc..
1054                  */
1055                 if (cur_addr_num >= num_prefered) {
1056                         cur_addr_num = 0;
1057                 }
1058                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1059                                                                           ipv4_scope, cur_addr_num);
1060                 if (sin == NULL)
1061                         continue;
1062                 return (sin->sin_addr);
1063
1064         }
1065
1066         /*
1067          * plan_d: We are in deep trouble. No prefered address on
1068          *         any interface. And the emit interface does not
1069          *         even have an acceptable address. Take anything
1070          *         we can get! If this does not work we are
1071          *         probably going to emit a packet that will
1072          *         illicit an ABORT, falling through.
1073          */
1074
1075         for (ifn = TAILQ_FIRST(&ifnet);
1076              ifn && (ifn != inp->next_ifn_touse);
1077              ifn=TAILQ_NEXT(ifn, if_list)) {
1078                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1079                         /* wrong base scope */
1080                         continue;
1081                 }
1082                 if (ifn == rt->rt_ifp)
1083                         /* already looked at this guy */
1084                         continue;
1085
1086                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1087                         struct ifaddr *ifa = ifac->ifa;
1088
1089                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1090                         if (sin == NULL)
1091                                 continue;
1092                         if (stcb) {
1093                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1094                                         /* It is restricted for some reason.. probably
1095                                          * not yet added.
1096                                          */
1097                                         continue;
1098                                 }
1099                         }
1100                         return (sin->sin_addr);
1101                 }
1102         }
1103         /*
1104          * Ok we can find NO address to source from that is
1105          * not on our negative list. It is either the special
1106          * ASCONF case where we are sourceing from a intf that
1107          * has been ifconfig'd to a different address (i.e.
1108          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1109          * address. OR we are hosed, and this baby is going
1110          * to abort the association.
1111          */
1112         if (non_asoc_addr_ok) {
1113                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1114         } else {
1115                 memset(&ans, 0, sizeof(ans));
1116                 return (ans);
1117         }
1118 }
1119
1120
1121
1122 /* tcb may be NULL */
1123 struct in_addr
1124 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1125     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1126     int non_asoc_addr_ok)
1127 {
1128         struct in_addr ans;
1129         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1130         uint8_t ipv4_scope, loopscope;
1131         /*
1132          * Rules:
1133          * - Find the route if needed, cache if I can.
1134          * - Look at interface address in route, Is it
1135          *   in the bound list. If so we have the best source.
1136          * - If not we must rotate amongst the addresses.
1137          *
1138          * Cavets and issues
1139          *
1140          * Do we need to pay attention to scope. We can have
1141          * a private address or a global address we are sourcing
1142          * or sending to. So if we draw it out
1143          *      source     *      dest   *  result
1144          *  ------------------------------------------
1145          *  a   Private    *     Global  *  NAT?
1146          *  ------------------------------------------
1147          *  b   Private    *     Private *  No problem
1148          *  ------------------------------------------
1149          *  c   Global     *     Private *  Huh, How will this work?
1150          *  ------------------------------------------
1151          *  d   Global     *     Global  *  No Problem
1152          *  ------------------------------------------
1153          *
1154          * And then we add to that what happens if there are multiple
1155          * addresses assigned to an interface. Remember the ifa on a
1156          * ifn is a linked list of addresses. So one interface can
1157          * have more than one IPv4 address. What happens if we
1158          * have both a private and a global address? Do we then
1159          * use context of destination to sort out which one is
1160          * best? And what about NAT's sending P->G may get you
1161          * a NAT translation, or should you select the G thats
1162          * on the interface in preference.
1163          *
1164          * Decisions:
1165          *
1166          *  - count the number of addresses on the interface.
1167          *  - if its one, no problem except case <c>. For <a>
1168          *    we will assume a NAT out there.
1169          *  - if there are more than one, then we need to worry
1170          *    about scope P or G. We should prefer G -> G and
1171          *    P -> P if possible. Then as a secondary fall back
1172          *    to mixed types G->P being a last ditch one.
1173          *  - The above all works for bound all, but bound
1174          *    specific we need to use the same concept but instead
1175          *    only consider the bound addresses. If the bound set
1176          *    is NOT assigned to the interface then we must use
1177          *    rotation amongst them.
1178          *
1179          * Notes: For v4, we can always punt and let ip_output
1180          * decide by sending back a source of 0.0.0.0
1181          */
1182
1183         if (ro->ro_rt == NULL) {
1184                 /*
1185                  * Need a route to cache.
1186                  *
1187                  */
1188 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1189                 rtalloc_ign(ro, 0UL);
1190 #else
1191                 rtalloc(ro);
1192 #endif
1193         }
1194         if (ro->ro_rt == NULL) {
1195                 /* No route to host .. punt */
1196                 memset(&ans, 0, sizeof(ans));
1197                 return (ans);
1198         }
1199         /* Setup our scopes */
1200         if (stcb) {
1201                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1202                 loopscope = stcb->asoc.loopback_scope;
1203         } else {
1204                 /* Scope based on outbound address */
1205                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1206                         ipv4_scope = 1;
1207                         loopscope = 0;
1208                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1209                         ipv4_scope = 1;
1210                         loopscope = 1;
1211                 } else {
1212                         ipv4_scope = 0;
1213                         loopscope = 0;
1214                 }
1215         }
1216 #ifdef SCTP_DEBUG
1217         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1218                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1219                        loopscope, ipv4_scope);
1220         }
1221 #endif
1222         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1223                 /*
1224                  * When bound to all if the address list is set
1225                  * it is a negative list. Addresses being added
1226                  * by asconf.
1227                  */
1228                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1229                     ipv4_scope, loopscope, non_asoc_addr_ok));
1230         }
1231         /*
1232          * Three possiblities here:
1233          *
1234          * a) stcb is NULL, which means we operate only from
1235          *    the list of addresses (ifa's) bound to the assoc and
1236          *    we care not about the list.
1237          * b) stcb is NOT-NULL, which means we have an assoc structure and
1238          *    auto-asconf is on. This means that the list of addresses is
1239          *    a NOT list. We use the list from the inp, but any listed address
1240          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1241          *    set we CAN use an address NOT available (i.e. being added). Its
1242          *    a negative list.
1243          * c) stcb is NOT-NULL, which means we have an assoc structure and
1244          *    auto-asconf is off. This means that the list of addresses is
1245          *    the ONLY addresses I can use.. its positive.
1246          *
1247          *    Note we collapse b & c into the same function just like in
1248          *    the v6 address selection.
1249          */
1250         if (stcb) {
1251                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1252                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1253         } else {
1254                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1255                     ipv4_scope, loopscope));
1256         }
1257         /* this should not be reached */
1258         memset(&ans, 0, sizeof(ans));
1259         return (ans);
1260 }
1261
1262
1263
1264 static struct sockaddr_in6 *
1265 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1266 {
1267         struct in6_ifaddr *ifa6;
1268         struct sockaddr_in6 *sin6;
1269
1270         if (ifa->ifa_addr->sa_family != AF_INET6) {
1271                 /* forget non-v6 */
1272                 return (NULL);
1273         }
1274         ifa6 = (struct in6_ifaddr *)ifa;
1275         /* ok to use deprecated addresses? */
1276         if (!ip6_use_deprecated) {
1277                 if (IFA6_IS_DEPRECATED(ifa6)) {
1278                         /* can't use this type */
1279                         return (NULL);
1280                 }
1281         }
1282         /* are we ok, with the current state of this address? */
1283         if (ifa6->ia6_flags &
1284             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1285                 /* Can't use these types */
1286                 return (NULL);
1287         }
1288         /* Ok the address may be ok */
1289         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1290         *sin_local = *sin_loop = 0;
1291         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1292             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1293                 *sin_loop = 1;
1294         }
1295         if (!loopscope && *sin_loop) {
1296                 /* Its a loopback address and we don't have loop scope */
1297                 return (NULL);
1298         }
1299         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1300                 /* we skip unspecifed addresses */
1301                 return (NULL);
1302         }
1303
1304         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1305                 *sin_local = 1;
1306         }
1307         if (!loc_scope && *sin_local) {
1308                 /* Its a link local address, and we don't have link local scope */
1309                 return (NULL);
1310         }
1311         return (sin6);
1312 }
1313
1314
1315 static struct sockaddr_in6 *
1316 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1317                                   struct sctp_tcb *stcb,
1318                                   struct sctp_nets *net,
1319                                   struct rtentry *rt,
1320                                   uint8_t loc_scope,
1321                                   uint8_t loopscope,
1322                                   int non_asoc_addr_ok)
1323 {
1324         /*
1325          *   Each endpoint has a list of local addresses associated
1326          *   with it. The address list is either a "negative list" i.e.
1327          *   those addresses that are NOT allowed to be used as a source OR
1328          *   a "postive list" i.e. those addresses that CAN be used.
1329          *
1330          *   Its a negative list if asconf is allowed. What we do
1331          *   in this case is use the ep address list BUT we have
1332          *   to cross check it against the negative list.
1333          *
1334          *   In the case where NO asconf is allowed, we have just
1335          *   a straight association level list that we must use to
1336          *   find a source address.
1337          */
1338         struct sctp_laddr *laddr, *starting_point;
1339         struct sockaddr_in6 *sin6;
1340         int sin_loop, sin_local;
1341         int start_at_beginning=0;
1342         struct ifnet *ifn;
1343
1344         ifn = rt->rt_ifp;
1345         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1346 #ifdef SCTP_DEBUG
1347                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1348                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1349                 }
1350 #endif
1351                 /* first question, is the ifn we will emit on
1352                  * in our list, if so, we want that one.
1353                  */
1354                 if (ifn) {
1355                         struct ifaddr_container *ifac;
1356
1357                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1358                                 struct ifaddr *ifa = ifac->ifa;
1359
1360                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1361                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1362                                         if (sin6 == NULL)
1363                                                 continue;
1364                                         if ((non_asoc_addr_ok == 0) &&
1365                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1366                                                 /* on the no-no list */
1367                                                 continue;
1368                                         }
1369                                         return (sin6);
1370                                 }
1371                         }
1372                 }
1373                 starting_point = stcb->asoc.last_used_address;
1374                 /* First try for matching scope */
1375         sctp_from_the_top:
1376                 if (stcb->asoc.last_used_address == NULL) {
1377                         start_at_beginning=1;
1378                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1379                 }
1380                 /* search beginning with the last used address */
1381                 for (laddr = stcb->asoc.last_used_address; laddr;
1382                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1383                         if (laddr->ifa == NULL) {
1384                                 /* address has been removed */
1385                                 continue;
1386                         }
1387                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1388                         if (sin6 == NULL)
1389                                 continue;
1390                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1391                                 /* on the no-no list */
1392                                 continue;
1393                         }
1394                         /* is it of matching scope ? */
1395                         if ((loopscope == 0) &&
1396                             (loc_scope == 0) &&
1397                             (sin_loop == 0) &&
1398                             (sin_local == 0)) {
1399                                 /* all of global scope we are ok with it */
1400                                 return (sin6);
1401                         }
1402                         if (loopscope && sin_loop)
1403                                 /* both on the loopback, thats ok */
1404                                 return (sin6);
1405                         if (loc_scope && sin_local)
1406                                 /* both local scope */
1407                                 return (sin6);
1408
1409                 }
1410                 if (start_at_beginning == 0) {
1411                         stcb->asoc.last_used_address = NULL;
1412                         goto sctp_from_the_top;
1413                 }
1414                 /* now try for any higher scope than the destination */
1415                 stcb->asoc.last_used_address = starting_point;
1416                 start_at_beginning = 0;
1417         sctp_from_the_top2:
1418                 if (stcb->asoc.last_used_address == NULL) {
1419                         start_at_beginning=1;
1420                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1421                 }
1422                 /* search beginning with the last used address */
1423                 for (laddr = stcb->asoc.last_used_address; laddr;
1424                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1425                         if (laddr->ifa == NULL) {
1426                                 /* address has been removed */
1427                                 continue;
1428                         }
1429                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1430                         if (sin6 == NULL)
1431                                 continue;
1432                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1433                                 /* on the no-no list */
1434                                 continue;
1435                         }
1436                         return (sin6);
1437                 }
1438                 if (start_at_beginning == 0) {
1439                         stcb->asoc.last_used_address = NULL;
1440                         goto sctp_from_the_top2;
1441                 }
1442         } else {
1443 #ifdef SCTP_DEBUG
1444                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1445                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
1446                 }
1447 #endif
1448                 /* First try for interface output match */
1449                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1450                              sctp_nxt_addr) {
1451                         if (laddr->ifa == NULL) {
1452                                 /* address has been removed */
1453                                 continue;
1454                         }
1455                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1456                         if (sin6 == NULL)
1457                                 continue;
1458                         /* first question, is laddr->ifa an address associated with the emit interface */
1459                         if (ifn) {
1460                                 struct ifaddr_container *ifac;
1461
1462                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1463                                         struct ifaddr *ifa = ifac->ifa;
1464
1465                                         if (laddr->ifa == ifa) {
1466                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1467                                                 return (sin6);
1468                                         }
1469                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1470                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1471                                                 return (sin6);
1472                                         }
1473                                 }
1474                         }
1475                 }
1476                 /* Next try for matching scope */
1477                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1478                              sctp_nxt_addr) {
1479                         if (laddr->ifa == NULL) {
1480                                 /* address has been removed */
1481                                 continue;
1482                         }
1483                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1484                         if (sin6 == NULL)
1485                                 continue;
1486
1487                         if ((loopscope == 0) &&
1488                             (loc_scope == 0) &&
1489                             (sin_loop == 0) &&
1490                             (sin_local == 0)) {
1491                                 /* all of global scope we are ok with it */
1492                                 return (sin6);
1493                         }
1494                         if (loopscope && sin_loop)
1495                                 /* both on the loopback, thats ok */
1496                                 return (sin6);
1497                         if (loc_scope && sin_local)
1498                                 /* both local scope */
1499                                 return (sin6);
1500                 }
1501                 /* ok, now try for a higher scope in the source address */
1502                 /* First try for matching scope */
1503                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1504                              sctp_nxt_addr) {
1505                         if (laddr->ifa == NULL) {
1506                                 /* address has been removed */
1507                                 continue;
1508                         }
1509                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1510                         if (sin6 == NULL)
1511                                 continue;
1512                         return (sin6);
1513                 }
1514         }
1515         return (NULL);
1516 }
1517
1518 static struct sockaddr_in6 *
1519 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1520                                  struct rtentry *rt,
1521                                  uint8_t loc_scope,
1522                                  uint8_t loopscope)
1523 {
1524         /*
1525          * Here we are bound specific and have only
1526          * an inp. We must find an address that is bound
1527          * that we can give out as a src address. We
1528          * prefer two addresses of same scope if we can
1529          * find them that way.
1530          */
1531         struct sctp_laddr *laddr;
1532         struct sockaddr_in6 *sin6;
1533         struct ifnet *ifn;
1534         int sin_loop, sin_local;
1535
1536         /* first question, is the ifn we will emit on
1537          * in our list, if so, we want that one.
1538          */
1539
1540         ifn = rt->rt_ifp;
1541         if (ifn) {
1542                 struct ifaddr_container *ifac;
1543
1544                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1545                         struct ifaddr *ifa = ifac->ifa;
1546
1547                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1548                         if (sin6 == NULL)
1549                                 continue;
1550                         if (sctp_is_addr_in_ep(inp, ifa)) {
1551                                 return (sin6);
1552                         }
1553                 }
1554         }
1555         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1556              laddr && (laddr != inp->next_addr_touse);
1557              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1558                 if (laddr->ifa == NULL) {
1559                         /* address has been removed */
1560                         continue;
1561                 }
1562                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1563                 if (sin6 == NULL)
1564                         continue;
1565
1566                 if ((loopscope == 0) &&
1567                     (loc_scope == 0) &&
1568                     (sin_loop == 0) &&
1569                     (sin_local == 0)) {
1570                         /* all of global scope we are ok with it */
1571                         return (sin6);
1572                 }
1573                 if (loopscope && sin_loop)
1574                         /* both on the loopback, thats ok */
1575                         return (sin6);
1576                 if (loc_scope && sin_local)
1577                         /* both local scope */
1578                         return (sin6);
1579
1580         }
1581         /* if we reach here, we could not find two addresses
1582          * of the same scope to give out. Lets look for any higher level
1583          * scope for a source address.
1584          */
1585         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1586              laddr && (laddr != inp->next_addr_touse);
1587              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1588                 if (laddr->ifa == NULL) {
1589                         /* address has been removed */
1590                         continue;
1591                 }
1592                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1593                 if (sin6 == NULL)
1594                         continue;
1595                 return (sin6);
1596         }
1597         /* no address bound can be a source for the destination */
1598 #ifdef SCTP_DEBUG
1599         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1600                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1601         }
1602 #endif
1603         return (NULL);
1604 }
1605
1606
1607 static struct sockaddr_in6 *
1608 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1609                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1610 {
1611         struct ifaddr_container *ifac;
1612         struct sockaddr_in6 *sin6;
1613         int sin_loop, sin_local;
1614         int num_eligible_addr = 0;
1615
1616         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1617                 struct ifaddr *ifa = ifac->ifa;
1618
1619                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1620                 if (sin6 == NULL)
1621                         continue;
1622                 if (stcb) {
1623                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1624                                 /* It is restricted for some reason.. probably
1625                                  * not yet added.
1626                                  */
1627                                 continue;
1628                         }
1629                 }
1630                 if (match_scope) {
1631                         /* Here we are asked to match scope if possible */
1632                         if (loopscope && sin_loop)
1633                                 /* src and destination are loopback scope */
1634                                 return (sin6);
1635                         if (loc_scope && sin_local)
1636                                 /* src and destination are local scope */
1637                                 return (sin6);
1638                         if ((loopscope == 0) &&
1639                             (loc_scope == 0)  &&
1640                             (sin_loop == 0) &&
1641                             (sin_local == 0)) {
1642                                 /* src and destination are global scope */
1643                                 return (sin6);
1644                         }
1645                         continue;
1646                 }
1647                 if (num_eligible_addr == cur_addr_num) {
1648                         /* this is it */
1649                         return (sin6);
1650                 }
1651                 num_eligible_addr++;
1652         }
1653         return (NULL);
1654 }
1655
1656
1657 static int
1658 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1659                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1660 {
1661         struct ifaddr_container *ifac;
1662         struct sockaddr_in6 *sin6;
1663         int num_eligible_addr = 0;
1664         int sin_loop, sin_local;
1665
1666         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1667                 struct ifaddr *ifa = ifac->ifa;
1668
1669                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1670                 if (sin6 == NULL)
1671                         continue;
1672                 if (stcb) {
1673                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1674                                 /* It is restricted for some reason.. probably
1675                                  * not yet added.
1676                                  */
1677                                 continue;
1678                         }
1679                 }
1680                 num_eligible_addr++;
1681         }
1682         return (num_eligible_addr);
1683 }
1684
1685
1686 static struct sockaddr_in6 *
1687 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1688                         struct sctp_tcb *stcb,
1689                         struct sctp_nets *net,
1690                         struct rtentry *rt,
1691                         uint8_t loc_scope,
1692                         uint8_t loopscope,
1693                         int non_asoc_addr_ok)
1694 {
1695         /* Ok, we are bound all SO any address
1696          * is ok to use as long as it is NOT in the negative
1697          * list.
1698          */
1699         int num_eligible_addr;
1700         int cur_addr_num=0;
1701         int started_at_beginning=0;
1702         int match_scope_prefered;
1703         /* first question is, how many eligible addresses are
1704          * there for the destination ifn that we are using that
1705          * are within the proper scope?
1706          */
1707         struct ifnet *ifn;
1708         struct sockaddr_in6 *sin6;
1709
1710         ifn = rt->rt_ifp;
1711         if (net) {
1712                 cur_addr_num = net->indx_of_eligible_next_to_use;
1713         }
1714         if (cur_addr_num == 0) {
1715                 match_scope_prefered = 1;
1716         } else {
1717                 match_scope_prefered = 0;
1718         }
1719         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1720 #ifdef SCTP_DEBUG
1721         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1722                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1723         }
1724 #endif
1725         if (num_eligible_addr == 0) {
1726                 /* no eligible addresses, we must use some other
1727                  * interface address if we can find one.
1728                  */
1729                 goto bound_all_v6_plan_b;
1730         }
1731         /* Ok we have num_eligible_addr set with how many we can use,
1732          * this may vary from call to call due to addresses being deprecated etc..
1733          */
1734         if (cur_addr_num >= num_eligible_addr) {
1735                 cur_addr_num = 0;
1736         }
1737         /* select the nth address from the list (where cur_addr_num is the nth) and
1738          * 0 is the first one, 1 is the second one etc...
1739          */
1740 #ifdef SCTP_DEBUG
1741         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1742                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1743                        cur_addr_num, match_scope_prefered);
1744         }
1745 #endif
1746         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1747                                                           loc_scope, cur_addr_num, match_scope_prefered);
1748         if (match_scope_prefered && (sin6 == NULL)) {
1749                 /* retry without the preference for matching scope */
1750 #ifdef SCTP_DEBUG
1751         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1752                 kprintf("retry with no match_scope_prefered\n");
1753         }
1754 #endif
1755                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1756                                                                   loc_scope, cur_addr_num, 0);
1757         }
1758         if (sin6) {
1759 #ifdef SCTP_DEBUG
1760                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1761                         kprintf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1762                 }
1763 #endif
1764                 if (net) {
1765                         /* store so we get the next one */
1766                         if (cur_addr_num < 255)
1767                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1768                         else
1769                                 net->indx_of_eligible_next_to_use = 0;
1770                 }
1771                 return (sin6);
1772         }
1773         num_eligible_addr = 0;
1774  bound_all_v6_plan_b:
1775         /* ok, if we reach here we either fell through
1776          * due to something changing during an interupt (unlikely)
1777          * or we have NO eligible source addresses for the ifn
1778          * of the route (most likely). We must look at all the other
1779          * interfaces EXCEPT rt->rt_ifp and do the same game.
1780          */
1781 #ifdef SCTP_DEBUG
1782         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1783                 kprintf("bound-all Plan B\n");
1784         }
1785 #endif
1786         if (inp->next_ifn_touse == NULL) {
1787                 started_at_beginning=1;
1788                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1789 #ifdef SCTP_DEBUG
1790                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1791                         kprintf("Start at first IFN:%p\n", inp->next_ifn_touse);
1792                 }
1793 #endif
1794         } else {
1795                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1796 #ifdef SCTP_DEBUG
1797                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1798                         kprintf("Resume at IFN:%p\n", inp->next_ifn_touse);
1799                 }
1800 #endif
1801                 if (inp->next_ifn_touse == NULL) {
1802 #ifdef SCTP_DEBUG
1803                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1804                                 kprintf("IFN Resets\n");
1805                         }
1806 #endif
1807                         started_at_beginning=1;
1808                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1809                 }
1810         }
1811         for (ifn = inp->next_ifn_touse; ifn;
1812              ifn = TAILQ_NEXT(ifn, if_list)) {
1813                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1814                         /* wrong base scope */
1815                         continue;
1816                 }
1817                 if (loc_scope && (ifn->if_index != loc_scope)) {
1818                         /* by definition the scope (from to->sin6_scopeid)
1819                          * must match that of the interface. If not then
1820                          * we could pick a wrong scope for the address.
1821                          * Ususally we don't hit plan-b since the route
1822                          * handles this. However we can hit plan-b when
1823                          * we send to local-host so the route is the
1824                          * loopback interface, but the destination is a
1825                          * link local.
1826                          */
1827                         continue;
1828                 }
1829                 if (ifn == rt->rt_ifp) {
1830                         /* already looked at this guy */
1831                         continue;
1832                 }
1833                 /* Address rotation will only work when we are not
1834                  * rotating sourced interfaces and are using the interface
1835                  * of the route. We would need to have a per interface index
1836                  * in order to do proper rotation.
1837                  */
1838                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1839 #ifdef SCTP_DEBUG
1840                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1841                         kprintf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1842                 }
1843 #endif
1844                 if (num_eligible_addr == 0) {
1845                         /* none we can use */
1846                         continue;
1847                 }
1848                 /* Ok we have num_eligible_addr set with how many we can use,
1849                  * this may vary from call to call due to addresses being deprecated etc..
1850                  */
1851                 inp->next_ifn_touse = ifn;
1852
1853                 /* select the first one we can find with perference for matching scope.
1854                  */
1855                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1856                 if (sin6 == NULL) {
1857                         /* can't find one with matching scope how about a source with higher
1858                          * scope
1859                          */
1860                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1861                         if (sin6 == NULL)
1862                                 /* Hmm, can't find one in the interface now */
1863                                 continue;
1864                 }
1865 #ifdef SCTP_DEBUG
1866                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1867                         kprintf("Selected the %d'th address of ifn:%p\n",
1868                                cur_addr_num,
1869                                ifn);
1870                 }
1871 #endif
1872                 return (sin6);
1873         }
1874         if (started_at_beginning == 0) {
1875                 /* we have not been through all of them yet, force
1876                  * us to go through them all.
1877                  */
1878 #ifdef SCTP_DEBUG
1879                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1880                         kprintf("Force a recycle\n");
1881                 }
1882 #endif
1883                 inp->next_ifn_touse = NULL;
1884                 goto bound_all_v6_plan_b;
1885         }
1886         return (NULL);
1887
1888 }
1889
1890 /* stcb and net may be NULL */
1891 struct in6_addr
1892 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1893     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1894     int non_asoc_addr_ok)
1895 {
1896         struct in6_addr ans;
1897         struct sockaddr_in6 *rt_addr;
1898         uint8_t loc_scope, loopscope;
1899         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1900
1901         /*
1902          * This routine is tricky standard v6 src address
1903          * selection cannot take into account what we have
1904          * bound etc, so we can't use it.
1905          *
1906          * Instead here is what we must do:
1907          * 1) Make sure we have a route, if we
1908          *    don't have a route we can never reach the peer.
1909          * 2) Once we have a route, determine the scope of the
1910          *     route. Link local, loopback or global.
1911          * 3) Next we divide into three types. Either we
1912          *    are bound all.. which means we want to use
1913          *    one of the addresses of the interface we are
1914          *    going out. <or>
1915          * 4a) We have not stcb, which means we are using the
1916          *    specific addresses bound on an inp, in this
1917          *    case we are similar to the stcb case (4b below)
1918          *    accept the list is always a positive list.<or>
1919          * 4b) We are bound specific with a stcb, which means we have a
1920          *    list of bound addresses and we must see if the
1921          *    ifn of the route is actually one of the bound addresses.
1922          *    If not, then we must rotate addresses amongst properly
1923          *    scoped bound addresses, if so we use the address
1924          *    of the interface.
1925          * 5) Always, no matter which path we take through the above
1926          *    we must be sure the source address we use is allowed to
1927          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1928          *    addresses cannot be used.
1929          * 6) Addresses that are deprecated MAY be used
1930          *              if (!ip6_use_deprecated) {
1931          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1932          *                        skip the address
1933          *                    }
1934          *              }
1935          */
1936
1937         /*** 1> determine route, if not already done */
1938         if (ro->ro_rt == NULL) {
1939                 /*
1940                  * Need a route to cache.
1941                  */
1942 #ifndef SCOPEDROUTING
1943                 int scope_save;
1944                 scope_save = to->sin6_scope_id;
1945                 to->sin6_scope_id = 0;
1946 #endif
1947
1948 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1949                 rtalloc_ign(ro, 0UL);
1950 #else
1951                 rtalloc(ro);
1952 #endif
1953 #ifndef SCOPEDROUTING
1954                 to->sin6_scope_id = scope_save;
1955 #endif
1956         }
1957         if (ro->ro_rt == NULL) {
1958                 /*
1959                  * no route to host. this packet is going no-where.
1960                  * We probably should make sure we arrange to send back
1961                  * an error.
1962                  */
1963 #ifdef SCTP_DEBUG
1964                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1965                         kprintf("No route to host, this packet cannot be sent!\n");
1966                 }
1967 #endif
1968                 memset(&ans, 0, sizeof(ans));
1969                 return (ans);
1970         }
1971
1972         /*** 2a> determine scope for outbound address/route */
1973         loc_scope = loopscope = 0;
1974         /*
1975          * We base our scope on the outbound packet scope and route,
1976          * NOT the TCB (if there is one). This way in local scope we will only
1977          * use a local scope src address when we send to a local address.
1978          */
1979
1980         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1981                 /* If the route goes to the loopback address OR
1982                  * the address is a loopback address, we are loopback
1983                  * scope.
1984                  */
1985 #ifdef SCTP_DEBUG
1986                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1987                         kprintf("Loopback scope is set\n");
1988                 }
1989 #endif
1990                 loc_scope = 0;
1991                 loopscope = 1;
1992                 if (net != NULL) {
1993                         /* mark it as local */
1994                         net->addr_is_local = 1;
1995                 }
1996
1997         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
1998 #ifdef SCTP_DEBUG
1999                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2000                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2001                 }
2002 #endif
2003                 if (to->sin6_scope_id)
2004                         loc_scope = to->sin6_scope_id;
2005                 else {
2006                         loc_scope = 1;
2007                 }
2008                 loopscope = 0;
2009         } else {
2010 #ifdef SCTP_DEBUG
2011                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2012                         kprintf("Global scope is set\n");
2013                 }
2014 #endif
2015         }
2016
2017         /* now, depending on which way we are bound we call the appropriate
2018          * routine to do steps 3-6
2019          */
2020 #ifdef SCTP_DEBUG
2021         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2022                 kprintf("Destination address:");
2023                 sctp_print_address((struct sockaddr *)to);
2024         }
2025 #endif
2026
2027         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2028 #ifdef SCTP_DEBUG
2029                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2030                         kprintf("Calling bound-all src addr selection for v6\n");
2031                 }
2032 #endif
2033                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2034         } else {
2035 #ifdef SCTP_DEBUG
2036                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2037                         kprintf("Calling bound-specific src addr selection for v6\n");
2038                 }
2039 #endif
2040                 if (stcb)
2041                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2042                 else
2043                         /* we can't have a non-asoc address since we have no association */
2044                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2045         }
2046         if (rt_addr == NULL) {
2047                 /* no suitable address? */
2048                 struct in6_addr in6;
2049 #ifdef SCTP_DEBUG
2050                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2051                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2052                 }
2053 #endif
2054                 memset(&in6, 0, sizeof(in6));
2055                 return (in6);
2056         }
2057 #ifdef SCTP_DEBUG
2058         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2059                 kprintf("Source address selected is:");
2060                 sctp_print_address((struct sockaddr *)rt_addr);
2061         }
2062 #endif
2063         return (rt_addr->sin6_addr);
2064 }
2065
2066 static uint8_t
2067 sctp_get_ect(struct sctp_tcb *stcb,
2068              struct sctp_tmit_chunk *chk)
2069 {
2070         uint8_t this_random;
2071
2072         /* Huh? */
2073         if (sctp_ecn == 0)
2074                 return (0);
2075
2076         if (sctp_ecn_nonce == 0)
2077                 /* no nonce, always return ECT0 */
2078                 return (SCTP_ECT0_BIT);
2079
2080         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2081                 /* Peer does NOT support it, so we send a ECT0 only */
2082                 return (SCTP_ECT0_BIT);
2083         }
2084
2085         if (chk == NULL)
2086            return (SCTP_ECT0_BIT);
2087
2088         if (((stcb->asoc.hb_random_idx == 3) &&
2089              (stcb->asoc.hb_ect_randombit > 7)) ||
2090              (stcb->asoc.hb_random_idx > 3)) {
2091                 uint32_t rndval;
2092                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2093                 memcpy(stcb->asoc.hb_random_values, &rndval,
2094                        sizeof(stcb->asoc.hb_random_values));
2095                 this_random = stcb->asoc.hb_random_values[0];
2096                 stcb->asoc.hb_random_idx = 0;
2097                 stcb->asoc.hb_ect_randombit = 0;
2098         } else {
2099                 if (stcb->asoc.hb_ect_randombit > 7) {
2100                   stcb->asoc.hb_ect_randombit = 0;
2101                   stcb->asoc.hb_random_idx++;
2102                 }
2103                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2104         }
2105         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2106                 if (chk != NULL)
2107                         /* ECN Nonce stuff */
2108                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2109                 stcb->asoc.hb_ect_randombit++;
2110                 return (SCTP_ECT1_BIT);
2111         } else {
2112                 stcb->asoc.hb_ect_randombit++;
2113                 return (SCTP_ECT0_BIT);
2114         }
2115 }
2116
2117 extern int sctp_no_csum_on_loopback;
2118
2119 static int
2120 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2121                            struct sctp_tcb *stcb,    /* may be NULL */
2122                            struct sctp_nets *net,
2123                            struct sockaddr *to,
2124                            struct mbuf *m,
2125                            int nofragment_flag,
2126                            int ecn_ok,
2127                            struct sctp_tmit_chunk *chk,
2128                            int out_of_asoc_ok)
2129         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2130 {
2131         /*
2132          * Given a mbuf chain (via m_next) that holds a packet header
2133          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2134          * - calculate SCTP checksum and fill in
2135          * - prepend a IP address header
2136          * - if boundall use INADDR_ANY
2137          * - if boundspecific do source address selection
2138          * - set fragmentation option for ipV4
2139          * - On return from IP output, check/adjust mtu size
2140          * - of output interface and smallest_mtu size as well.
2141          */
2142         struct sctphdr *sctphdr;
2143         int o_flgs;
2144         uint32_t csum;
2145         int ret;
2146         unsigned int have_mtu;
2147         struct route *ro;
2148
2149         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2150                 sctp_m_freem(m);
2151                 return (EFAULT);
2152         }
2153         if ((m->m_flags & M_PKTHDR) == 0) {
2154 #ifdef SCTP_DEBUG
2155                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2156                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2157                 }
2158 #endif
2159                 sctp_m_freem(m);
2160                 return (EFAULT);
2161         }
2162         /* Calculate the csum and fill in the length of the packet */
2163         sctphdr = mtod(m, struct sctphdr *);
2164         have_mtu = 0;
2165         if (sctp_no_csum_on_loopback &&
2166              (stcb) &&
2167              (stcb->asoc.loopback_scope)) {
2168                 sctphdr->checksum = 0;
2169                 m->m_pkthdr.len = sctp_calculate_len(m);
2170         } else {
2171                 sctphdr->checksum = 0;
2172                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2173                 sctphdr->checksum = csum;
2174         }
2175         if (to->sa_family == AF_INET) {
2176                 struct ip *ip;
2177                 struct route iproute;
2178                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2179                 if (m == NULL) {
2180                         /* failed to prepend data, give up */
2181                         return (ENOMEM);
2182                 }
2183                 ip = mtod(m, struct ip *);
2184                 ip->ip_v = IPVERSION;
2185                 ip->ip_hl = (sizeof(struct ip) >> 2);
2186                 if (nofragment_flag) {
2187 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2188 #if defined( __OpenBSD__) || defined(__NetBSD__)
2189                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2190                         ip->ip_off = htons(IP_DF);
2191 #else
2192                         ip->ip_off = IP_DF;
2193 #endif
2194 #else
2195                         ip->ip_off = htons(IP_DF);
2196 #endif
2197                 } else
2198                         ip->ip_off = 0;
2199
2200 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2201 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2202                 ip->ip_id = htons(ip_randomid());
2203 #else
2204                 ip->ip_id = htons(ip_id++);
2205 #endif
2206
2207 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2208                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2209 #else
2210                 ip->ip_ttl = inp->inp_ip_ttl;
2211 #endif
2212 #if defined(__OpenBSD__) || defined(__NetBSD__)
2213                 ip->ip_len = htons(m->m_pkthdr.len);
2214 #else
2215                 ip->ip_len = m->m_pkthdr.len;
2216 #endif
2217                 if (stcb) {
2218                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2219                                 /* Enable ECN */
2220 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2221                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2222                                                       sctp_get_ect(stcb, chk));
2223 #elif defined(__NetBSD__)
2224                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2225                                                       sctp_get_ect(stcb, chk));
2226 #else
2227                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2228                                                       sctp_get_ect(stcb, chk));
2229 #endif
2230                         } else {
2231                                 /* No ECN */
2232 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2233                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2234 #elif defined(__NetBSD__)
2235                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2236 #else
2237                                 ip->ip_tos = inp->inp_ip_tos;
2238 #endif
2239                         }
2240                 } else {
2241                         /* no association at all */
2242 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2243                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2244 #else
2245                         ip->ip_tos = inp->inp_ip_tos;
2246 #endif
2247                 }
2248                 ip->ip_p = IPPROTO_SCTP;
2249                 ip->ip_sum = 0;
2250                 if (net == NULL) {
2251                         ro = &iproute;
2252                         memset(&iproute, 0, sizeof(iproute));
2253                         memcpy(&ro->ro_dst, to, to->sa_len);
2254                 } else {
2255                         ro = (struct route *)&net->ro;
2256                 }
2257                 /* Now the address selection part */
2258                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2259
2260                 /* call the routine to select the src address */
2261                 if (net) {
2262                         if (net->src_addr_selected == 0) {
2263                                 /* Cache the source address */
2264                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2265                                     stcb,
2266                                     ro, net, out_of_asoc_ok);
2267                                 if (ro->ro_rt)
2268                                         net->src_addr_selected = 1;
2269                         }
2270                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2271                 } else {
2272                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2273                             stcb, ro, net, out_of_asoc_ok);
2274                 }
2275                 /*
2276                  * If source address selection fails and we find no route then
2277                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2278                  * type error. We probably should catch that somewhere and
2279                  * abort the association right away (assuming this is an INIT
2280                  * being sent).
2281                  */
2282                 if ((ro->ro_rt == NULL)) {
2283                         /*
2284                          * src addr selection failed to find a route (or valid
2285                          * source addr), so we can't get there from here!
2286                          */
2287 #ifdef SCTP_DEBUG
2288                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2289                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2290                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2291                         }
2292 #endif /* SCTP_DEBUG */
2293                         if (net) {
2294                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2295                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2296                                                         stcb,
2297                                                         SCTP_FAILED_THRESHOLD,
2298                                                         (void *)net);
2299                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2300                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2301                                 if (stcb) {
2302                                         if (net == stcb->asoc.primary_destination) {
2303                                                 /* need a new primary */
2304                                                 struct sctp_nets *alt;
2305                                                 alt = sctp_find_alternate_net(stcb, net);
2306                                                 if (alt != net) {
2307                                                         if (sctp_set_primary_addr(stcb,
2308                                                                               NULL,
2309                                                                                  alt) == 0) {
2310                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2311                                                                 net->src_addr_selected = 0;
2312                                                         }
2313                                                 }
2314                                         }
2315                                 }
2316                         }
2317                         sctp_m_freem(m);
2318                         return (EHOSTUNREACH);
2319                 } else {
2320                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2321                 }
2322
2323                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2324 #ifdef SCTP_DEBUG
2325                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2326                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2327                                (u_int)(ntohl(ip->ip_src.s_addr)));
2328                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2329                         kprintf("RTP route is %p through\n", ro->ro_rt);
2330                 }
2331 #endif
2332                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2333                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2334                 }
2335                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2336                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2337 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2338     || defined(__DragonFly__)
2339                                 , NULL
2340 #endif
2341 #if defined(__NetBSD__)
2342                                 ,(struct socket *)inp->sctp_socket
2343 #endif
2344
2345 );
2346                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2347                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2348                 }
2349                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2350 #ifdef SCTP_DEBUG
2351                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2352                         kprintf("Ip output returns %d\n", ret);
2353                 }
2354 #endif
2355                 if (net == NULL) {
2356                         /* free tempy routes */
2357                         if (ro->ro_rt)
2358                                 RTFREE(ro->ro_rt);
2359                 } else {
2360                         /* PMTU check versus smallest asoc MTU goes here */
2361                         if (ro->ro_rt != NULL) {
2362                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2363                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2364                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2365                                             ro->ro_rt->rt_rmx.rmx_mtu);
2366                                 }
2367                         } else {
2368                                 /* route was freed */
2369                                 net->src_addr_selected = 0;
2370                         }
2371                 }
2372                 return (ret);
2373         }
2374 #ifdef INET6
2375         else if (to->sa_family == AF_INET6) {
2376                 struct ip6_hdr *ip6h;
2377 #ifdef NEW_STRUCT_ROUTE
2378                 struct route ip6route;
2379 #else
2380                 struct route_in6 ip6route;
2381 #endif
2382                 struct ifnet *ifp;
2383                 u_char flowTop;
2384                 uint16_t flowBottom;
2385                 u_char tosBottom, tosTop;
2386                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2387                 struct sockaddr_in6 lsa6_storage;
2388                 int prev_scope=0;
2389                 int error;
2390                 u_short prev_port=0;
2391
2392                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2393                 if (m == NULL) {
2394                         /* failed to prepend data, give up */
2395                         return (ENOMEM);
2396                 }
2397                 ip6h = mtod(m, struct ip6_hdr *);
2398
2399                 /*
2400                  * We assume here that inp_flow is in host byte order within
2401                  * the TCB!
2402                  */
2403                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2404                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2405
2406                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2407
2408                 /* protect *sin6 from overwrite */
2409                 sin6 = (struct sockaddr_in6 *)to;
2410                 tmp = *sin6;
2411                 sin6 = &tmp;
2412
2413                 /* KAME hack: embed scopeid */
2414 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2415                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2416 #else
2417                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2418 #endif
2419                         return (EINVAL);
2420                 if (net == NULL) {
2421                         memset(&ip6route, 0, sizeof(ip6route));
2422                         ro = (struct route *)&ip6route;
2423                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2424                 } else {
2425                         ro = (struct route *)&net->ro;
2426                 }
2427                 if (stcb != NULL) {
2428                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2429                                 /* Enable ECN */
2430                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2431                         } else {
2432                                 /* No ECN */
2433                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2434                         }
2435                 } else {
2436                         /* we could get no asoc if it is a O-O-T-B packet */
2437                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2438                 }
2439                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2440                 ip6h->ip6_nxt = IPPROTO_SCTP;
2441                 ip6h->ip6_plen = m->m_pkthdr.len;
2442                 ip6h->ip6_dst = sin6->sin6_addr;
2443
2444                 /*
2445                  * Add SRC address selection here:
2446                  * we can only reuse to a limited degree the kame src-addr-sel,
2447                  * since we can try their selection but it may not be bound.
2448                  */
2449                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2450                 lsa6_tmp.sin6_family = AF_INET6;
2451                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2452                 lsa6 = &lsa6_tmp;
2453                 if (net) {
2454                         if (net->src_addr_selected == 0) {
2455                                 /* Cache the source address */
2456                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2457                                     stcb, ro, net, out_of_asoc_ok);
2458
2459                                 if (ro->ro_rt)
2460                                         net->src_addr_selected = 1;
2461                         }
2462                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2463                 } else {
2464                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2465                             inp, stcb, ro, net, out_of_asoc_ok);
2466                 }
2467                 lsa6->sin6_port = inp->sctp_lport;
2468
2469                 if ((ro->ro_rt ==  NULL)) {
2470                         /*
2471                          * src addr selection failed to find a route (or valid
2472                          * source addr), so we can't get there from here!
2473                          */
2474 #ifdef SCTP_DEBUG
2475                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2476                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2477                         }
2478 #endif
2479                         sctp_m_freem(m);
2480                         if (net) {
2481                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2482                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2483                                                         stcb,
2484                                                         SCTP_FAILED_THRESHOLD,
2485                                                         (void *)net);
2486                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2487                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2488                                 if (stcb) {
2489                                         if (net == stcb->asoc.primary_destination) {
2490                                                 /* need a new primary */
2491                                                 struct sctp_nets *alt;
2492                                                 alt = sctp_find_alternate_net(stcb, net);
2493                                                 if (alt != net) {
2494                                                         if (sctp_set_primary_addr(stcb,
2495                                                                               NULL,
2496                                                                                  alt) == 0) {
2497                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2498                                                                 net->src_addr_selected = 0;
2499                                                         }
2500                                                 }
2501                                         }
2502                                 }
2503                         }
2504                         return (EHOSTUNREACH);
2505                 }
2506
2507 #ifndef SCOPEDROUTING
2508                 /*
2509                  * XXX: sa6 may not have a valid sin6_scope_id in
2510                  * the non-SCOPEDROUTING case.
2511                  */
2512                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2513                 lsa6_storage.sin6_family = AF_INET6;
2514                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2515                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2516                                               NULL)) != 0) {
2517                         sctp_m_freem(m);
2518                         return (error);
2519                 }
2520                 /* XXX */
2521                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2522                 lsa6_storage.sin6_port = inp->sctp_lport;
2523                 lsa6 = &lsa6_storage;
2524 #endif /* SCOPEDROUTING */
2525                 ip6h->ip6_src = lsa6->sin6_addr;
2526
2527                 /*
2528                  * We set the hop limit now since there is a good chance that
2529                  * our ro pointer is now filled
2530                  */
2531                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2532                                                 (ro ?
2533                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2534                                                  (NULL)));
2535                 o_flgs = 0;
2536                 ifp = ro->ro_rt->rt_ifp;
2537 #ifdef SCTP_DEBUG
2538                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2539                         /* Copy to be sure something bad is not happening */
2540                         sin6->sin6_addr = ip6h->ip6_dst;
2541                         lsa6->sin6_addr = ip6h->ip6_src;
2542
2543                         kprintf("Calling ipv6 output routine from low level\n");
2544                         kprintf("src: ");
2545                         sctp_print_address((struct sockaddr *)lsa6);
2546                         kprintf("dst: ");
2547                         sctp_print_address((struct sockaddr *)sin6);
2548                 }
2549 #endif /* SCTP_DEBUG */
2550                 if (net) {
2551                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2552                         /* preserve the port and scope for link local send */
2553                         prev_scope = sin6->sin6_scope_id;
2554                         prev_port = sin6->sin6_port;
2555                 }
2556                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2557 #ifdef NEW_STRUCT_ROUTE
2558                                  ro,
2559 #else
2560                                  (struct route_in6 *)ro,
2561 #endif
2562                                  o_flgs,
2563                                  ((struct in6pcb *)inp)->in6p_moptions,
2564 #if defined(__NetBSD__)
2565                                  (struct socket *)inp->sctp_socket,
2566 #endif
2567                                  &ifp
2568 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2569                     , NULL
2570 #endif
2571                         );
2572                 if (net) {
2573                         /* for link local this must be done */
2574                         sin6->sin6_scope_id = prev_scope;
2575                         sin6->sin6_port = prev_port;
2576                 }
2577 #ifdef SCTP_DEBUG
2578                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2579                         kprintf("return from send is %d\n", ret);
2580                 }
2581 #endif /* SCTP_DEBUG_OUTPUT */
2582                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2583                 if (net == NULL) {
2584                         /* Now if we had a temp route free it */
2585                         if (ro->ro_rt) {
2586                                 RTFREE(ro->ro_rt);
2587                         }
2588                 } else {
2589                         /* PMTU check versus smallest asoc MTU goes here */
2590                         if (ro->ro_rt == NULL) {
2591                                 /* Route was freed */
2592                                 net->src_addr_selected = 0;
2593                         }
2594                         if (ro->ro_rt != NULL) {
2595                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2596                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2597                                         sctp_mtu_size_reset(inp,
2598                                                             &stcb->asoc,
2599                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2600                                 }
2601                         } else if (ifp) {
2602 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2603 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2604 #endif /* SCTP_BASE_FREEBSD */
2605                                 if (ND_IFINFO(ifp)->linkmtu &&
2606                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2607                                         sctp_mtu_size_reset(inp,
2608                                                             &stcb->asoc,
2609                                                             ND_IFINFO(ifp)->linkmtu);
2610                                 }
2611                         }
2612                 }
2613                 return (ret);
2614         }
2615 #endif
2616         else {
2617 #ifdef SCTP_DEBUG
2618                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2619                         kprintf("Unknown protocol (TSNH) type %d\n",
2620                             to->sa_family);
2621                 }
2622 #endif
2623                 sctp_m_freem(m);
2624                 return (EFAULT);
2625         }
2626 }
2627
2628 static int
2629 sctp_is_address_in_scope(struct ifaddr *ifa,
2630                          int ipv4_addr_legal,
2631                          int ipv6_addr_legal,
2632                          int loopback_scope,
2633                          int ipv4_local_scope,
2634                          int local_scope,
2635                          int site_scope)
2636 {
2637         if ((loopback_scope == 0) &&
2638             (ifa->ifa_ifp) &&
2639             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2640                 /* skip loopback if not in scope *
2641                  */
2642                 return (0);
2643         }
2644         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2645                 struct sockaddr_in *sin;
2646                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2647                 if (sin->sin_addr.s_addr == 0) {
2648                         /* not in scope , unspecified */
2649                         return (0);
2650                 }
2651                 if ((ipv4_local_scope == 0) &&
2652                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2653                         /* private address not in scope */
2654                         return (0);
2655                 }
2656         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2657                 struct sockaddr_in6 *sin6;
2658                 struct in6_ifaddr *ifa6;
2659
2660                 ifa6 = (struct in6_ifaddr *)ifa;
2661                 /* ok to use deprecated addresses? */
2662                 if (!ip6_use_deprecated) {
2663                         if (ifa6->ia6_flags &
2664                             IN6_IFF_DEPRECATED) {
2665                                 return (0);
2666                         }
2667                 }
2668                 if (ifa6->ia6_flags &
2669                     (IN6_IFF_DETACHED |
2670                      IN6_IFF_ANYCAST |
2671                      IN6_IFF_NOTREADY)) {
2672                         return (0);
2673                 }
2674                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2675                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2676                         /* skip unspecifed addresses */
2677                         return (0);
2678                 }
2679                 if (/*(local_scope == 0) && */
2680                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2681                         return (0);
2682                 }
2683                 if ((site_scope == 0) &&
2684                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2685                         return (0);
2686                 }
2687         } else {
2688                 return (0);
2689         }
2690         return (1);
2691 }
2692
2693
2694 void
2695 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2696 {
2697         struct mbuf *m, *m_at, *m_last;
2698         struct sctp_nets *net;
2699         struct sctp_init_msg *initm;
2700         struct sctp_supported_addr_param *sup_addr;
2701         struct sctp_ecn_supported_param *ecn;
2702         struct sctp_prsctp_supported_param *prsctp;
2703         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2704         struct sctp_supported_chunk_types_param *pr_supported;
2705         int cnt_inits_to=0;
2706         int padval, ret;
2707
2708         /* INIT's always go to the primary (and usually ONLY address) */
2709         m_last = NULL;
2710         net = stcb->asoc.primary_destination;
2711         if (net == NULL) {
2712                 net = TAILQ_FIRST(&stcb->asoc.nets);
2713                 if (net == NULL) {
2714                         /* TSNH */
2715                         return;
2716                 }
2717                 /* we confirm any address we send an INIT to */
2718                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2719                 sctp_set_primary_addr(stcb, NULL, net);
2720         } else {
2721                 /* we confirm any address we send an INIT to */
2722                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2723         }
2724 #ifdef SCTP_DEBUG
2725         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2726                 kprintf("Sending INIT to ");
2727                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2728         }
2729 #endif
2730         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2731                 /* special hook, if we are sending to link local
2732                  * it will not show up in our private address count.
2733                  */
2734                 struct sockaddr_in6 *sin6l;
2735                 sin6l = &net->ro._l_addr.sin6;
2736                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2737                         cnt_inits_to = 1;
2738         }
2739         if (callout_pending(&net->rxt_timer.timer)) {
2740                 /* This case should not happen */
2741                 return;
2742         }
2743         /* start the INIT timer */
2744         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2745                 /* we are hosed since I can't start the INIT timer? */
2746                 return;
2747         }
2748         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2749         if (m == NULL) {
2750                 /* No memory, INIT timer will re-attempt. */
2751                 return;
2752         }
2753         /* make it into a M_EXT */
2754         MCLGET(m, MB_DONTWAIT);
2755         if ((m->m_flags & M_EXT) != M_EXT) {
2756                 /* Failed to get cluster buffer */
2757                 sctp_m_freem(m);
2758                 return;
2759         }
2760         m->m_data += SCTP_MIN_OVERHEAD;
2761         m->m_len = sizeof(struct sctp_init_msg);
2762         /* Now lets put the SCTP header in place */
2763         initm = mtod(m, struct sctp_init_msg *);
2764         initm->sh.src_port = inp->sctp_lport;
2765         initm->sh.dest_port = stcb->rport;
2766         initm->sh.v_tag = 0;
2767         initm->sh.checksum = 0; /* calculate later */
2768         /* now the chunk header */
2769         initm->msg.ch.chunk_type = SCTP_INITIATION;
2770         initm->msg.ch.chunk_flags = 0;
2771         /* fill in later from mbuf we build */
2772         initm->msg.ch.chunk_length = 0;
2773         /* place in my tag */
2774         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2775         /* set up some of the credits. */
2776         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2777             SCTP_MINIMAL_RWND));
2778
2779         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2780         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2781         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2782         /* now the address restriction */
2783         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2784             sizeof(*initm));
2785         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2786         /* we support 2 types IPv6/IPv4 */
2787         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2788                                           sizeof(uint16_t));
2789         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2790         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2791         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2792
2793 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2794         if (inp->sctp_ep.adaption_layer_indicator) {
2795                 struct sctp_adaption_layer_indication *ali;
2796                 ali = (struct sctp_adaption_layer_indication *)(
2797                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2798                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2799                 ali->ph.param_length = htons(sizeof(*ali));
2800                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2801                 m->m_len += sizeof(*ali);
2802                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2803                     sizeof(*ali));
2804         } else {
2805                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2806                     sizeof(*sup_addr) + sizeof(uint16_t));
2807         }
2808
2809         /* now any cookie time extensions */
2810         if (stcb->asoc.cookie_preserve_req) {
2811                 struct sctp_cookie_perserve_param *cookie_preserve;
2812                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2813                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2814                 cookie_preserve->ph.param_length = htons(
2815                     sizeof(*cookie_preserve));
2816                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2817                 m->m_len += sizeof(*cookie_preserve);
2818                 ecn = (struct sctp_ecn_supported_param *)(
2819                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2820                 stcb->asoc.cookie_preserve_req = 0;
2821         }
2822
2823         /* ECN parameter */
2824         if (sctp_ecn == 1) {
2825                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2826                 ecn->ph.param_length = htons(sizeof(*ecn));
2827                 m->m_len += sizeof(*ecn);
2828                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2829                     sizeof(*ecn));
2830         } else {
2831                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2832         }
2833         /* And now tell the peer we do pr-sctp */
2834         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2835         prsctp->ph.param_length = htons(sizeof(*prsctp));
2836         m->m_len += sizeof(*prsctp);
2837
2838
2839         /* And now tell the peer we do all the extensions */
2840         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2841            sizeof(*prsctp));
2842
2843         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2844         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2845         pr_supported->chunk_types[0] = SCTP_ASCONF;
2846         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2847         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2848         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2849         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2850         pr_supported->chunk_types[5] = 0; /* pad */
2851         pr_supported->chunk_types[6] = 0; /* pad */
2852         pr_supported->chunk_types[7] = 0; /* pad */
2853
2854         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2855         /* ECN nonce: And now tell the peer we support ECN nonce */
2856
2857         if (sctp_ecn_nonce) {
2858                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2859                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2860                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2861                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2862                 m->m_len += sizeof(*ecn_nonce);
2863         }
2864
2865         m_at = m;
2866         /* now the addresses */
2867         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2868                 struct ifnet *ifn;
2869                 int cnt;
2870
2871                 cnt = cnt_inits_to;
2872                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2873                         struct ifaddr_container *ifac;
2874
2875                         if ((stcb->asoc.loopback_scope == 0) &&
2876                             (ifn->if_type == IFT_LOOP)) {
2877                                 /*
2878                                  * Skip loopback devices if loopback_scope
2879                                  * not set
2880                                  */
2881                                 continue;
2882                         }
2883                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2884                                 struct ifaddr *ifa = ifac->ifa;
2885
2886                                 if (sctp_is_address_in_scope(ifa,
2887                                     stcb->asoc.ipv4_addr_legal,
2888                                     stcb->asoc.ipv6_addr_legal,
2889                                     stcb->asoc.loopback_scope,
2890                                     stcb->asoc.ipv4_local_scope,
2891                                     stcb->asoc.local_scope,
2892                                     stcb->asoc.site_scope) == 0) {
2893                                         continue;
2894                                 }
2895                                 cnt++;
2896                         }
2897                 }
2898                 if (cnt > 1) {
2899                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2900                                 struct ifaddr_container *ifac;
2901
2902                                 if ((stcb->asoc.loopback_scope == 0) &&
2903                                     (ifn->if_type == IFT_LOOP)) {
2904                                         /*
2905                                          * Skip loopback devices if loopback_scope
2906                                          * not set
2907                                          */
2908                                         continue;
2909                                 }
2910                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2911                                         struct ifaddr *ifa = ifac->ifa;
2912
2913                                         if (sctp_is_address_in_scope(ifa,
2914                                             stcb->asoc.ipv4_addr_legal,
2915                                             stcb->asoc.ipv6_addr_legal,
2916                                             stcb->asoc.loopback_scope,
2917                                             stcb->asoc.ipv4_local_scope,
2918                                             stcb->asoc.local_scope,
2919                                             stcb->asoc.site_scope) == 0) {
2920                                                 continue;
2921                                         }
2922                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2923                                 }
2924                         }
2925                 }
2926         } else {
2927                 struct sctp_laddr *laddr;
2928                 int cnt;
2929                 cnt = cnt_inits_to;
2930                 /* First, how many ? */
2931                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2932                         if (laddr->ifa == NULL) {
2933                                 continue;
2934                         }
2935                         if (laddr->ifa->ifa_addr == NULL)
2936                                 continue;
2937                         if (sctp_is_address_in_scope(laddr->ifa,
2938                             stcb->asoc.ipv4_addr_legal,
2939                             stcb->asoc.ipv6_addr_legal,
2940                             stcb->asoc.loopback_scope,
2941                             stcb->asoc.ipv4_local_scope,
2942                             stcb->asoc.local_scope,
2943                             stcb->asoc.site_scope) == 0) {
2944                                 continue;
2945                         }
2946                         cnt++;
2947                 }
2948                 /* To get through a NAT we only list addresses if
2949                  * we have more than one. That way if you just
2950                  * bind a single address we let the source of the init
2951                  * dictate our address.
2952                  */
2953                 if (cnt > 1) {
2954                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2955                                 if (laddr->ifa == NULL) {
2956                                         continue;
2957                                 }
2958                                 if (laddr->ifa->ifa_addr == NULL) {
2959                                         continue;
2960                                 }
2961
2962                                 if (sctp_is_address_in_scope(laddr->ifa,
2963                                     stcb->asoc.ipv4_addr_legal,
2964                                     stcb->asoc.ipv6_addr_legal,
2965                                     stcb->asoc.loopback_scope,
2966                                     stcb->asoc.ipv4_local_scope,
2967                                     stcb->asoc.local_scope,
2968                                     stcb->asoc.site_scope) == 0) {
2969                                         continue;
2970                                 }
2971                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2972                         }
2973                 }
2974         }
2975         /* calulate the size and update pkt header and chunk header */
2976         m->m_pkthdr.len = 0;
2977         for (m_at = m; m_at; m_at = m_at->m_next) {
2978                 if (m_at->m_next == NULL)
2979                         m_last = m_at;
2980                 m->m_pkthdr.len += m_at->m_len;
2981         }
2982         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2983             sizeof(struct sctphdr)));
2984         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2985          * ignore the return here since the timer will drive
2986          * a retranmission.
2987          */
2988
2989         /* I don't expect this to execute but we will be safe here */
2990         padval = m->m_pkthdr.len % 4;
2991         if ((padval) && (m_last)) {
2992                 /* The compiler worries that m_last may not be
2993                  * set even though I think it is impossible :->
2994                  * however we add m_last here just in case.
2995                  */
2996                 int ret;
2997                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2998                 if (ret) {
2999                         /* Houston we have a problem, no space */
3000                         sctp_m_freem(m);
3001                         return;
3002                 }
3003                 m->m_pkthdr.len += padval;
3004         }
3005 #ifdef SCTP_DEBUG
3006         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3007                 kprintf("Calling lowlevel output stcb:%p net:%p\n", stcb, net);
3008         }
3009 #endif
3010         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3011                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3012 #ifdef SCTP_DEBUG
3013         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3014                 kprintf("Low level output returns %d\n", ret);
3015         }
3016 #endif
3017         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3018         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3019 }
3020
3021 struct mbuf *
3022 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3023     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3024 {
3025         /* Given a mbuf containing an INIT or INIT-ACK
3026          * with the param_offset being equal to the
3027          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3028          * parse through the parameters to the end of the mbuf verifying
3029          * that all parameters are known.
3030          *
3031          * For unknown parameters build and return a mbuf with
3032          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3033          * to stop processing this chunk stop, and set *abort_processing
3034          * to 1.
3035          *
3036          * By having param_offset be pre-set to where parameters begin
3037          * it is hoped that this routine may be reused in the future
3038          * by new features.
3039          */
3040         struct sctp_paramhdr *phdr, params;
3041
3042         struct mbuf *mat, *op_err;
3043         char tempbuf[2048];
3044         int at, limit, pad_needed;
3045         uint16_t ptype, plen;
3046         int err_at;
3047
3048         *abort_processing = 0;
3049         mat = in_initpkt;
3050         err_at = 0;
3051         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3052 #ifdef SCTP_DEBUG
3053         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3054                 kprintf("Limit is %d bytes\n", limit);
3055         }
3056 #endif
3057         at = param_offset;
3058         op_err = NULL;
3059
3060         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3061         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3062                 ptype = ntohs(phdr->param_type);
3063                 plen = ntohs(phdr->param_length);
3064                 limit -= SCTP_SIZE32(plen);
3065                 if (plen < sizeof(struct sctp_paramhdr)) {
3066 #ifdef SCTP_DEBUG
3067         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3068                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3069         }
3070 #endif
3071                         *abort_processing = 1;
3072                         break;
3073                 }
3074                 /* All parameters for all chunks that we
3075                  * know/understand are listed here. We process
3076                  * them other places and make appropriate
3077                  * stop actions per the upper bits. However
3078                  * this is the generic routine processor's can
3079                  * call to get back an operr.. to either incorporate (init-ack)
3080                  * or send.
3081                  */
3082                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3083                     (ptype == SCTP_IPV4_ADDRESS) ||
3084                     (ptype == SCTP_IPV6_ADDRESS) ||
3085                     (ptype == SCTP_STATE_COOKIE) ||
3086                     (ptype == SCTP_UNRECOG_PARAM) ||
3087                     (ptype == SCTP_COOKIE_PRESERVE) ||
3088                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3089                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3090                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3091                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3092                     (ptype == SCTP_ECN_CAPABLE) ||
3093                     (ptype == SCTP_ULP_ADAPTION) ||
3094                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3095                     (ptype == SCTP_SET_PRIM_ADDR) ||
3096                     (ptype == SCTP_SUCCESS_REPORT) ||
3097                     (ptype == SCTP_ULP_ADAPTION) ||
3098                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3099                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3100                         ) {
3101                         /* no skip it */
3102                         at += SCTP_SIZE32(plen);
3103                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3104                         /* We can NOT handle HOST NAME addresses!! */
3105 #ifdef SCTP_DEBUG
3106         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3107                 kprintf("Can't handle hostname addresses.. abort processing\n");
3108         }
3109 #endif
3110                         *abort_processing = 1;
3111                         if (op_err == NULL) {
3112                                 /* Ok need to try to get a mbuf */
3113                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3114                                 if (op_err) {
3115                                         op_err->m_len = 0;
3116                                         op_err->m_pkthdr.len = 0;
3117                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3118                                         op_err->m_data += sizeof(struct ip6_hdr);
3119                                         op_err->m_data += sizeof(struct sctphdr);
3120                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3121                                 }
3122                         }
3123                         if (op_err) {
3124                                 /* If we have space */
3125                                 struct sctp_paramhdr s;
3126                                 if (err_at % 4) {
3127                                         u_int32_t cpthis=0;
3128                                         pad_needed = 4 - (err_at % 4);
3129                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3130                                         err_at += pad_needed;
3131                                 }
3132                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3133                                 s.param_length = htons(sizeof(s) + plen);
3134                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3135                                 err_at += sizeof(s);
3136                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3137                                 if (phdr == NULL) {
3138                                         sctp_m_freem(op_err);
3139                                         /* we are out of memory but we
3140                                          * still need to have a look at what to
3141                                          * do (the system is in trouble though).
3142                                          */
3143                                         return (NULL);
3144                                 }
3145                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3146                                 err_at += plen;
3147                         }
3148                         return (op_err);
3149                 } else {
3150                         /* we do not recognize the parameter
3151                          * figure out what we do.
3152                          */
3153 #ifdef SCTP_DEBUG
3154                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3155                                 kprintf("Got parameter type %x - unknown\n",
3156                                        (u_int)ptype);
3157                         }
3158 #endif
3159                         if ((ptype & 0x4000) == 0x4000) {
3160                                 /* Report bit is set?? */
3161 #ifdef SCTP_DEBUG
3162                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3163                                         kprintf("Report bit is set\n");
3164                                 }
3165 #endif
3166                                 if (op_err == NULL) {
3167                                         /* Ok need to try to get an mbuf */
3168                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3169                                         if (op_err) {
3170                                                 op_err->m_len = 0;
3171                                                 op_err->m_pkthdr.len = 0;
3172                                                 op_err->m_data += sizeof(struct ip6_hdr);
3173                                                 op_err->m_data += sizeof(struct sctphdr);
3174                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3175                                         }
3176                                 }
3177                                 if (op_err) {
3178                                         /* If we have space */
3179                                         struct sctp_paramhdr s;
3180                                         if (err_at % 4) {
3181                                                 u_int32_t cpthis=0;
3182                                                 pad_needed = 4 - (err_at % 4);
3183                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3184                                                 err_at += pad_needed;
3185                                         }
3186                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3187                                         s.param_length = htons(sizeof(s) + plen);
3188                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3189                                         err_at += sizeof(s);
3190                                         if (plen > sizeof(tempbuf)) {
3191                                                 plen = sizeof(tempbuf);
3192                                         }
3193                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3194                                         if (phdr == NULL) {
3195                                                 sctp_m_freem(op_err);
3196                                                 /* we are out of memory but we
3197                                                  * still need to have a look at what to
3198                                                  * do (the system is in trouble though).
3199                                                  */
3200                                                 goto more_processing;
3201                                         }
3202                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3203                                         err_at += plen;
3204                                 }
3205                         }
3206                 more_processing:
3207                         if ((ptype & 0x8000) == 0x0000) {
3208 #ifdef SCTP_DEBUG
3209                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3210                                         kprintf("Abort bit is now setting1\n");
3211                                 }
3212 #endif
3213                                 return (op_err);
3214                         } else {
3215                                 /* skip this chunk and continue processing */
3216                                 at += SCTP_SIZE32(plen);
3217                         }
3218
3219                 }
3220                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3221         }
3222         return (op_err);
3223 }
3224
3225 static int
3226 sctp_are_there_new_addresses(struct sctp_association *asoc,
3227     struct mbuf *in_initpkt, int iphlen, int offset)
3228 {
3229         /*
3230          * Given a INIT packet, look through the packet to verify that
3231          * there are NO new addresses. As we go through the parameters
3232          * add reports of any un-understood parameters that require an
3233          * error.  Also we must return (1) to drop the packet if we see
3234          * a un-understood parameter that tells us to drop the chunk.
3235          */
3236         struct sockaddr_in sin4, *sa4;
3237         struct sockaddr_in6 sin6, *sa6;
3238         struct sockaddr *sa_touse;
3239         struct sockaddr *sa;
3240         struct sctp_paramhdr *phdr, params;
3241         struct ip *iph;
3242         struct mbuf *mat;
3243         uint16_t ptype, plen;
3244         uint8_t fnd;
3245         struct sctp_nets *net;
3246
3247         memset(&sin4, 0, sizeof(sin4));
3248         memset(&sin6, 0, sizeof(sin6));
3249         sin4.sin_family = AF_INET;
3250         sin4.sin_len = sizeof(sin4);
3251         sin6.sin6_family = AF_INET6;
3252         sin6.sin6_len = sizeof(sin6);
3253
3254         sa_touse = NULL;
3255         /* First what about the src address of the pkt ? */
3256         iph = mtod(in_initpkt, struct ip *);
3257         if (iph->ip_v == IPVERSION) {
3258                 /* source addr is IPv4 */
3259                 sin4.sin_addr = iph->ip_src;
3260                 sa_touse = (struct sockaddr *)&sin4;
3261         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3262                 /* source addr is IPv6 */
3263                 struct ip6_hdr *ip6h;
3264                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3265                 sin6.sin6_addr = ip6h->ip6_src;
3266                 sa_touse = (struct sockaddr *)&sin6;
3267         } else {
3268                 return (1);
3269         }
3270
3271         fnd = 0;
3272         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3273                 sa = (struct sockaddr *)&net->ro._l_addr;
3274                 if (sa->sa_family == sa_touse->sa_family) {
3275                         if (sa->sa_family == AF_INET) {
3276                             sa4 = (struct sockaddr_in *)sa;
3277                                 if (sa4->sin_addr.s_addr ==
3278                                     sin4.sin_addr.s_addr) {
3279                                         fnd = 1;
3280                                         break;
3281                                 }
3282                         } else if (sa->sa_family == AF_INET6) {
3283                                 sa6 = (struct sockaddr_in6 *)sa;
3284                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3285                                     &sin6.sin6_addr)) {
3286                                         fnd = 1;
3287                                         break;
3288                                 }
3289                         }
3290                 }
3291         }
3292         if (fnd == 0) {
3293                 /* New address added! no need to look futher. */
3294                 return (1);
3295         }
3296         /* Ok so far lets munge through the rest of the packet */
3297         mat = in_initpkt;
3298         sa_touse = NULL;
3299         offset += sizeof(struct sctp_init_chunk);
3300         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3301         while (phdr) {
3302                 ptype = ntohs(phdr->param_type);
3303                 plen = ntohs(phdr->param_length);
3304                 if (ptype == SCTP_IPV4_ADDRESS) {
3305                         struct sctp_ipv4addr_param *p4, p4_buf;
3306
3307                         phdr = sctp_get_next_param(mat, offset,
3308                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3309                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3310                             phdr == NULL) {
3311                                 return (1);
3312                         }
3313                         p4 = (struct sctp_ipv4addr_param *)phdr;
3314                         sin4.sin_addr.s_addr = p4->addr;
3315                         sa_touse = (struct sockaddr *)&sin4;
3316                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3317                         struct sctp_ipv6addr_param *p6, p6_buf;
3318
3319                         phdr = sctp_get_next_param(mat, offset,
3320                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3321                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3322                             phdr == NULL) {
3323                                 return (1);
3324                         }
3325                         p6 = (struct sctp_ipv6addr_param *)phdr;
3326                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3327                             sizeof(p6->addr));
3328                         sa_touse = (struct sockaddr *)&sin4;
3329                 }
3330
3331                 if (sa_touse) {
3332                         /* ok, sa_touse points to one to check */
3333                         fnd = 0;
3334                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3335                                 sa = (struct sockaddr *)&net->ro._l_addr;
3336                                 if (sa->sa_family != sa_touse->sa_family) {
3337                                         continue;
3338                                 }
3339                                 if (sa->sa_family == AF_INET) {
3340                                         sa4 = (struct sockaddr_in *)sa;
3341                                         if (sa4->sin_addr.s_addr ==
3342                                             sin4.sin_addr.s_addr) {
3343                                                 fnd = 1;
3344                                                 break;
3345                                         }
3346                                 } else if (sa->sa_family == AF_INET6) {
3347                                         sa6 = (struct sockaddr_in6 *)sa;
3348                                         if (SCTP6_ARE_ADDR_EQUAL(
3349                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3350                                                 fnd = 1;
3351                                                 break;
3352                                         }
3353                                 }
3354                         }
3355                         if (!fnd) {
3356                                 /* New addr added! no need to look further */
3357                                 return (1);
3358                         }
3359                 }
3360                 offset += SCTP_SIZE32(plen);
3361                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3362         }
3363         return (0);
3364 }
3365
3366 /*
3367  * Given a MBUF chain that was sent into us containing an
3368  * INIT. Build a INIT-ACK with COOKIE and send back.
3369  * We assume that the in_initpkt has done a pullup to
3370  * include IPv6/4header, SCTP header and initial part of
3371  * INIT message (i.e. the struct sctp_init_msg).
3372  */
3373 void
3374 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3375     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3376     struct sctp_init_chunk *init_chk)
3377 {
3378         struct sctp_association *asoc;
3379         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3380         struct sctp_init_msg *initackm_out;
3381         struct sctp_ecn_supported_param *ecn;
3382         struct sctp_prsctp_supported_param *prsctp;
3383         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3384         struct sctp_supported_chunk_types_param *pr_supported;
3385         struct sockaddr_storage store;
3386         struct sockaddr_in *sin;
3387         struct sockaddr_in6 *sin6;
3388         struct route *ro;
3389         struct ip *iph;
3390         struct ip6_hdr *ip6;
3391         struct sockaddr *to;
3392         struct sctp_state_cookie stc;
3393         struct sctp_nets *net=NULL;
3394         int cnt_inits_to=0;
3395         uint16_t his_limit, i_want;
3396         int abort_flag, padval, sz_of;
3397
3398         if (stcb) {
3399                 asoc = &stcb->asoc;
3400         } else {
3401                 asoc = NULL;
3402         }
3403         m_last = NULL;
3404         if ((asoc != NULL) &&
3405             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3406             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3407                 /* new addresses, out of here in non-cookie-wait states */
3408                 /*
3409                  * Send a ABORT, we don't add the new address error clause though
3410                  * we even set the T bit and copy in the 0 tag.. this looks no
3411                  * different than if no listner was present.
3412                  */
3413                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3414                 return;
3415         }
3416         abort_flag = 0;
3417         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3418             (offset+sizeof(struct sctp_init_chunk)),
3419             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3420         if (abort_flag) {
3421                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3422                 return;
3423         }
3424         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3425         if (m == NULL) {
3426                 /* No memory, INIT timer will re-attempt. */
3427                 if (op_err)
3428                         sctp_m_freem(op_err);
3429                 return;
3430         }
3431         MCLGET(m, MB_DONTWAIT);
3432         if ((m->m_flags & M_EXT) != M_EXT) {
3433                 /* Failed to get cluster buffer */
3434                 if (op_err)
3435                         sctp_m_freem(op_err);
3436                 sctp_m_freem(m);
3437                 return;
3438         }
3439         m->m_data += SCTP_MIN_OVERHEAD;
3440         m->m_pkthdr.rcvif = 0;
3441         m->m_len = sizeof(struct sctp_init_msg);
3442
3443         /* the time I built cookie */
3444         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3445
3446         /* populate any tie tags */
3447         if (asoc != NULL) {
3448                 /* unlock before tag selections */
3449                 SCTP_TCB_UNLOCK(stcb);
3450                 if (asoc->my_vtag_nonce == 0)
3451                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3452                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3453
3454                 if (asoc->peer_vtag_nonce == 0)
3455                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3456                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3457
3458                 stc.cookie_life = asoc->cookie_life;
3459                 net = asoc->primary_destination;
3460                 /* now we must relock */
3461                 SCTP_INP_RLOCK(inp);
3462                 /* we may be in trouble here if the inp got freed
3463                  * most likely this set of tests will protect
3464                  * us but there is a chance not.
3465                  */
3466                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3467                         if (op_err)
3468                                 sctp_m_freem(op_err);
3469                         sctp_m_freem(m);
3470                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3471                         return;
3472                 }
3473                 SCTP_TCB_LOCK(stcb);
3474                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3475         } else {
3476                 stc.tie_tag_my_vtag = 0;
3477                 stc.tie_tag_peer_vtag = 0;
3478                 /* life I will award this cookie */
3479                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3480         }
3481
3482         /* copy in the ports for later check */
3483         stc.myport = sh->dest_port;
3484         stc.peerport = sh->src_port;
3485
3486         /*
3487          * If we wanted to honor cookie life extentions, we would add
3488          * to stc.cookie_life. For now we should NOT honor any extension
3489          */
3490         stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3491         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3492                 struct inpcb *in_inp;
3493                 /* Its a V6 socket */
3494                 in_inp = (struct inpcb *)inp;
3495                 stc.ipv6_addr_legal = 1;
3496                 /* V4 addresses are NOT legal on the association */
3497                 stc.ipv4_addr_legal = 0;
3498         } else {
3499                 /* Its a V4 socket, no - V6 */
3500                 stc.ipv4_addr_legal = 1;
3501                 stc.ipv6_addr_legal = 0;
3502         }
3503
3504 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3505         stc.ipv4_scope = 1;
3506 #else
3507         stc.ipv4_scope = 0;
3508 #endif
3509         /* now for scope setup */
3510         memset((caddr_t)&store, 0, sizeof(store));
3511         sin = (struct sockaddr_in *)&store;
3512         sin6 = (struct sockaddr_in6 *)&store;
3513         if (net == NULL) {
3514                 to = (struct sockaddr *)&store;
3515                 iph = mtod(init_pkt, struct ip *);
3516                 if (iph->ip_v == IPVERSION) {
3517                         struct in_addr addr;
3518                         struct route iproute;
3519
3520                         sin->sin_family = AF_INET;
3521                         sin->sin_len = sizeof(struct sockaddr_in);
3522                         sin->sin_port = sh->src_port;
3523                         sin->sin_addr = iph->ip_src;
3524                         /* lookup address */
3525                         stc.address[0] = sin->sin_addr.s_addr;
3526                         stc.address[1] = 0;
3527                         stc.address[2] = 0;
3528                         stc.address[3] = 0;
3529                         stc.addr_type = SCTP_IPV4_ADDRESS;
3530                         /* local from address */
3531                         memset(&iproute, 0, sizeof(iproute));
3532                         ro = &iproute;
3533                         memcpy(&ro->ro_dst, sin, sizeof(*sin));
3534                         addr = sctp_ipv4_source_address_selection(inp, NULL,
3535                             ro, NULL, 0);
3536                         if (ro->ro_rt) {
3537                                 RTFREE(ro->ro_rt);
3538                         }
3539                         stc.laddress[0] = addr.s_addr;
3540                         stc.laddress[1] = 0;
3541                         stc.laddress[2] = 0;
3542                         stc.laddress[3] = 0;
3543                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3544                         /* scope_id is only for v6 */
3545                         stc.scope_id = 0;
3546 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3547                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3548                                 stc.ipv4_scope = 1;
3549                         }
3550 #else
3551                         stc.ipv4_scope = 1;
3552 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3553                         /* Must use the address in this case */
3554                         if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3555                                 stc.loopback_scope = 1;
3556                                 stc.ipv4_scope = 1;
3557                                 stc.site_scope = 1;
3558                                 stc.local_scope = 1;
3559                         }
3560                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3561                         struct in6_addr addr;
3562 #ifdef NEW_STRUCT_ROUTE
3563                         struct route iproute6;
3564 #else
3565                         struct route_in6 iproute6;
3566 #endif
3567                         ip6 = mtod(init_pkt, struct ip6_hdr *);
3568                         sin6->sin6_family = AF_INET6;
3569                         sin6->sin6_len = sizeof(struct sockaddr_in6);
3570                         sin6->sin6_port = sh->src_port;
3571                         sin6->sin6_addr = ip6->ip6_src;
3572                         /* lookup address */
3573                         memcpy(&stc.address, &sin6->sin6_addr,
3574                             sizeof(struct in6_addr));
3575                         sin6->sin6_scope_id = 0;
3576                         stc.addr_type = SCTP_IPV6_ADDRESS;
3577                         stc.scope_id = 0;
3578                         if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3579                                 stc.loopback_scope = 1;
3580                                 stc.local_scope = 1;
3581                                 stc.site_scope = 1;
3582                                 stc.ipv4_scope = 1;
3583                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3584                                 /*
3585                                  * If the new destination is a LINK_LOCAL
3586                                  * we must have common both site and local
3587                                  * scope. Don't set local scope though since
3588                                  * we must depend on the source to be added
3589                                  * implicitly. We cannot assure just because
3590                                  * we share one link that all links are common.
3591                                  */
3592                                 stc.local_scope = 0;
3593                                 stc.site_scope = 1;
3594                                 stc.ipv4_scope = 1;
3595                                 /* we start counting for the private
3596                                  * address stuff at 1. since the link
3597                                  * local we source from won't show
3598                                  * up in our scoped cou8nt.
3599                                  */
3600                                 cnt_inits_to=1;
3601                                 /* pull out the scope_id from incoming pkt */
3602                                 in6_recoverscope(sin6, &ip6->ip6_src,
3603                                     init_pkt->m_pkthdr.rcvif);
3604 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
3605                                 in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3606                                     NULL);
3607 #else
3608                                 in6_embedscope(&sin6->sin6_addr, sin6);
3609 #endif
3610                                 stc.scope_id = sin6->sin6_scope_id;
3611                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3612                                 /*
3613                                  * If the new destination is SITE_LOCAL
3614                                  * then we must have site scope in common.
3615                                  */
3616                                 stc.site_scope = 1;
3617                         }
3618                         /* local from address */
3619                         memset(&iproute6, 0, sizeof(iproute6));
3620                         ro = (struct route *)&iproute6;
3621                         memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
3622                         addr = sctp_ipv6_source_address_selection(inp, NULL,
3623                             ro, NULL, 0);
3624                         if (ro->ro_rt) {
3625                                 RTFREE(ro->ro_rt);
3626                         }
3627                         memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3628                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3629                 }
3630         } else {
3631                 /* set the scope per the existing tcb */
3632                 struct sctp_nets *lnet;
3633
3634                 stc.loopback_scope = asoc->loopback_scope;
3635                 stc.ipv4_scope = asoc->ipv4_local_scope;
3636                 stc.site_scope = asoc->site_scope;
3637                 stc.local_scope = asoc->local_scope;
3638                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3639                         if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
3640                                 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
3641                                         /* if we have a LL address, start counting
3642                                          * at 1.
3643                                          */
3644                                         cnt_inits_to = 1;
3645                                 }
3646                         }
3647                 }
3648
3649                 /* use the net pointer */
3650                 to = (struct sockaddr *)&net->ro._l_addr;
3651                 if (to->sa_family == AF_INET) {
3652                         sin = (struct sockaddr_in *)to;
3653                         stc.address[0] = sin->sin_addr.s_addr;
3654                         stc.address[1] = 0;
3655                         stc.address[2] = 0;
3656                         stc.address[3] = 0;
3657                         stc.addr_type = SCTP_IPV4_ADDRESS;
3658                         if (net->src_addr_selected == 0) {
3659                                 /* strange case here, the INIT
3660                                  * should have did the selection.
3661                                  */
3662                                 net->ro._s_addr.sin.sin_addr =
3663                                     sctp_ipv4_source_address_selection(inp,
3664                                     stcb, (struct route *)&net->ro, net, 0);
3665                                 net->src_addr_selected = 1;
3666
3667                         }
3668
3669                         stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr;
3670                         stc.laddress[1] = 0;
3671                         stc.laddress[2] = 0;
3672                         stc.laddress[3] = 0;
3673                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3674                 } else if (to->sa_family == AF_INET6) {
3675                         sin6 = (struct sockaddr_in6 *)to;
3676                         memcpy(&stc.address, &sin6->sin6_addr,
3677                             sizeof(struct in6_addr));
3678                         stc.addr_type = SCTP_IPV6_ADDRESS;
3679                         if (net->src_addr_selected == 0) {
3680                                 /* strange case here, the INIT
3681                                  * should have did the selection.
3682                                  */
3683                                 net->ro._s_addr.sin6.sin6_addr =
3684                                     sctp_ipv6_source_address_selection(inp,
3685                                     stcb, (struct route *)&net->ro, net, 0);
3686                                 net->src_addr_selected = 1;
3687                         }
3688                         memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr,
3689                             sizeof(struct in6_addr));
3690                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3691                 }
3692         }
3693         /* Now lets put the SCTP header in place */
3694         initackm_out = mtod(m, struct sctp_init_msg *);
3695         initackm_out->sh.src_port = inp->sctp_lport;
3696         initackm_out->sh.dest_port = sh->src_port;
3697         initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3698         /* Save it off for quick ref */
3699         stc.peers_vtag = init_chk->init.initiate_tag;
3700         initackm_out->sh.checksum = 0;  /* calculate later */
3701         /* who are we */
3702         strncpy(stc.identification, SCTP_VERSION_STRING,
3703            min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3704         /* now the chunk header */
3705         initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3706         initackm_out->msg.ch.chunk_flags = 0;
3707         /* fill in later from mbuf we build */
3708         initackm_out->msg.ch.chunk_length = 0;
3709         /* place in my tag */
3710         if ((asoc != NULL) &&
3711             ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3712              (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3713                 /* re-use the v-tags and init-seq here */
3714                 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3715                 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3716         } else {
3717                 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3718                 /* get a TSN to use too */
3719                 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3720         }
3721         /* save away my tag to */
3722         stc.my_vtag = initackm_out->msg.init.initiate_tag;
3723
3724         /* set up some of the credits. */
3725         initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND));
3726         /* set what I want */
3727         his_limit = ntohs(init_chk->init.num_inbound_streams);
3728         /* choose what I want */
3729         if (asoc != NULL) {
3730                 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3731                         i_want = asoc->streamoutcnt;
3732                 } else {
3733                         i_want = inp->sctp_ep.pre_open_stream_count;
3734                 }
3735         } else {
3736                 i_want = inp->sctp_ep.pre_open_stream_count;
3737         }
3738         if (his_limit < i_want) {
3739                 /* I Want more :< */
3740                 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3741         } else {
3742                 /* I can have what I want :> */
3743                 initackm_out->msg.init.num_outbound_streams = htons(i_want);
3744         }
3745         /* tell him his limt. */
3746         initackm_out->msg.init.num_inbound_streams =
3747             htons(inp->sctp_ep.max_open_streams_intome);
3748         /* setup the ECN pointer */
3749
3750 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3751         if (inp->sctp_ep.adaption_layer_indicator) {
3752                 struct sctp_adaption_layer_indication *ali;
3753                 ali = (struct sctp_adaption_layer_indication *)(
3754                     (caddr_t)initackm_out + sizeof(*initackm_out));
3755                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3756                 ali->ph.param_length = htons(sizeof(*ali));
3757                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3758                 m->m_len += sizeof(*ali);
3759                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3760                     sizeof(*ali));
3761         } else {
3762                 ecn = (struct sctp_ecn_supported_param*)(
3763                     (caddr_t)initackm_out + sizeof(*initackm_out));
3764         }
3765
3766         /* ECN parameter */
3767         if (sctp_ecn == 1) {
3768                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3769                 ecn->ph.param_length = htons(sizeof(*ecn));
3770                 m->m_len += sizeof(*ecn);
3771
3772                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
3773                     sizeof(*ecn));
3774         } else {
3775                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
3776         }
3777         /* And now tell the peer we do  pr-sctp */
3778         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3779         prsctp->ph.param_length = htons(sizeof(*prsctp));
3780         m->m_len += sizeof(*prsctp);
3781
3782
3783         /* And now tell the peer we do all the extensions */
3784         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
3785            sizeof(*prsctp));
3786
3787         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3788         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3789         pr_supported->chunk_types[0] = SCTP_ASCONF;
3790         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3791         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3792         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3793         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3794         pr_supported->chunk_types[5] = 0; /* pad */
3795         pr_supported->chunk_types[6] = 0; /* pad */
3796         pr_supported->chunk_types[7] = 0; /* pad */
3797
3798         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3799         if (sctp_ecn_nonce) {
3800                 /* ECN nonce: And now tell the peer we support ECN nonce */
3801                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
3802                      sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3803                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3804                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3805                 m->m_len += sizeof(*ecn_nonce);
3806         }
3807
3808         m_at = m;
3809         /* now the addresses */
3810         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3811                 struct ifnet *ifn;
3812                 int cnt = cnt_inits_to;
3813
3814                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3815                         struct ifaddr_container *ifac;
3816
3817                         if ((stc.loopback_scope == 0) &&
3818                             (ifn->if_type == IFT_LOOP)) {
3819                                 /*
3820                                  * Skip loopback devices if loopback_scope
3821                                  * not set
3822                                  */
3823                                 continue;
3824                         }
3825                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3826                                 struct ifaddr *ifa = ifac->ifa;
3827
3828                                 if (sctp_is_address_in_scope(ifa,
3829                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3830                                     stc.loopback_scope, stc.ipv4_scope,
3831                                     stc.local_scope, stc.site_scope) == 0) {
3832                                         continue;
3833                                 }
3834                                 cnt++;
3835                         }
3836                 }
3837                 if (cnt > 1) {
3838                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
3839                                 struct ifaddr_container *ifac;
3840
3841                                 if ((stc.loopback_scope == 0) &&
3842                                     (ifn->if_type == IFT_LOOP)) {
3843                                         /*
3844                                          * Skip loopback devices if
3845                                          * loopback_scope not set
3846                                          */
3847                                         continue;
3848                                 }
3849                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3850                                         struct ifaddr *ifa = ifac->ifa;
3851
3852                                         if (sctp_is_address_in_scope(ifa,
3853                                             stc.ipv4_addr_legal,
3854                                             stc.ipv6_addr_legal,
3855                                             stc.loopback_scope, stc.ipv4_scope,
3856                                             stc.local_scope, stc.site_scope) == 0) {
3857                                                 continue;
3858                                         }
3859                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3860                                 }
3861                         }
3862                 }
3863         } else {
3864                 struct sctp_laddr *laddr;
3865                 int cnt;
3866                 cnt = cnt_inits_to;
3867                 /* First, how many ? */
3868                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3869                         if (laddr->ifa == NULL) {
3870                                 continue;
3871                         }
3872                         if (laddr->ifa->ifa_addr == NULL)
3873                                 continue;
3874                         if (sctp_is_address_in_scope(laddr->ifa,
3875                             stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3876                             stc.loopback_scope, stc.ipv4_scope,
3877                             stc.local_scope, stc.site_scope) == 0) {
3878                                 continue;
3879                         }
3880                         cnt++;
3881                 }
3882                 /* If we bind a single address only we won't list
3883                  * any. This way you can get through a NAT
3884                  */
3885                 if (cnt > 1) {
3886                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3887                                 if (laddr->ifa == NULL) {
3888 #ifdef SCTP_DEBUG
3889                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3890                                                 kprintf("Help I have fallen and I can't get up!\n");
3891                                         }
3892 #endif
3893                                         continue;
3894                                 }
3895                                 if (laddr->ifa->ifa_addr == NULL)
3896                                         continue;
3897                                 if (sctp_is_address_in_scope(laddr->ifa,
3898                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3899                                     stc.loopback_scope, stc.ipv4_scope,
3900                                     stc.local_scope, stc.site_scope) == 0) {
3901                                         continue;
3902                                 }
3903                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3904                         }
3905                 }
3906         }
3907
3908         /* tack on the operational error if present */
3909         if (op_err) {
3910                 if (op_err->m_pkthdr.len % 4) {
3911                         /* must add a pad to the param */
3912                         u_int32_t cpthis=0;
3913                         int padlen;
3914                         padlen = 4 - (op_err->m_pkthdr.len % 4);
3915                         m_copyback(op_err, op_err->m_pkthdr.len, padlen, (caddr_t)&cpthis);
3916                 }
3917                 while (m_at->m_next != NULL) {
3918                         m_at = m_at->m_next;
3919                 }
3920                 m_at->m_next = op_err;
3921                 while (m_at->m_next != NULL) {
3922                         m_at = m_at->m_next;
3923                 }
3924         }
3925         /* Get total size of init packet */
3926         sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3927         /* pre-calulate the size and update pkt header and chunk header */
3928         m->m_pkthdr.len = 0;
3929         for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3930                 m->m_pkthdr.len += m_tmp->m_len;
3931                 if (m_tmp->m_next == NULL) {
3932                         /* m_tmp should now point to last one */
3933                         break;
3934                 }
3935         }
3936         /*
3937          * Figure now the size of the cookie. We know the size of the
3938          * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3939          * COOKIE-STRUCTURE and SIGNATURE.
3940          */
3941
3942         /*
3943          * take our earlier INIT calc and add in the sz we just calculated
3944          * minus the size of the sctphdr (its not included in chunk size
3945          */
3946
3947         /* add once for the INIT-ACK */
3948         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3949
3950         /* add a second time for the INIT-ACK in the cookie */
3951         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3952
3953         /* Now add the cookie header and cookie message struct */
3954         sz_of += sizeof(struct sctp_state_cookie_param);
3955         /* ...and add the size of our signature */
3956         sz_of += SCTP_SIGNATURE_SIZE;
3957         initackm_out->msg.ch.chunk_length = htons(sz_of);
3958
3959         /* Now we must build a cookie */
3960         m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3961             sizeof(struct sctphdr), &stc);
3962         if (m_cookie == NULL) {
3963                 /* memory problem */
3964                 sctp_m_freem(m);
3965                 return;
3966         }
3967         /* Now append the cookie to the end and update the space/size */
3968         m_tmp->m_next = m_cookie;
3969
3970         /*
3971          * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3972          * return here since the timer will drive a retranmission.
3973          */
3974         padval = m->m_pkthdr.len % 4;
3975         if ((padval) && (m_last)) {
3976                 /* see my previous comments on m_last */
3977                 int ret;
3978                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
3979                 if (ret) {
3980                         /* Houston we have a problem, no space */
3981                         sctp_m_freem(m);
3982                         return;
3983                 }
3984                 m->m_pkthdr.len += padval;
3985         }
3986         sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
3987 }
3988
3989
3990 static void
3991 sctp_insert_on_wheel(struct sctp_association *asoc,
3992                      struct sctp_stream_out *strq)
3993 {
3994         struct sctp_stream_out *stre, *strn;
3995         stre = TAILQ_FIRST(&asoc->out_wheel);
3996         if (stre == NULL) {
3997                 /* only one on wheel */
3998                 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
3999                 return;
4000         }
4001         for (; stre; stre = strn) {
4002                 strn = TAILQ_NEXT(stre, next_spoke);
4003                 if (stre->stream_no > strq->stream_no) {
4004                         TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
4005                         return;
4006                 } else if (stre->stream_no == strq->stream_no) {
4007                         /* huh, should not happen */
4008                         return;
4009                 } else if (strn == NULL) {
4010                         /* next one is null */
4011                         TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
4012                                            next_spoke);
4013                 }
4014         }
4015 }
4016
4017 static void
4018 sctp_remove_from_wheel(struct sctp_association *asoc,
4019                        struct sctp_stream_out *strq)
4020 {
4021         /* take off and then setup so we know it is not on the wheel */
4022         TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
4023         strq->next_spoke.tqe_next = NULL;
4024         strq->next_spoke.tqe_prev = NULL;
4025 }
4026
4027
4028 static void
4029 sctp_prune_prsctp(struct sctp_tcb *stcb,
4030                   struct sctp_association *asoc,
4031                   struct sctp_sndrcvinfo *srcv,
4032                   int dataout
4033         )
4034 {
4035         int freed_spc=0;
4036         struct sctp_tmit_chunk *chk, *nchk;
4037         if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
4038                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4039                         /*
4040                          * Look for chunks marked with the PR_SCTP
4041                          * flag AND the buffer space flag. If the one
4042                          * being sent is equal or greater priority then
4043                          * purge the old one and free some space.
4044                          */
4045                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4046                                            SCTP_PR_SCTP_BUFFER)) ==
4047                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4048                                 /*
4049                                  * This one is PR-SCTP AND buffer space
4050                                  * limited type
4051                                  */
4052                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4053                                         /* Lower numbers equates to
4054                                          * higher priority so if the
4055                                          * one we are looking at has a
4056                                          * larger or equal priority we
4057                                          * want to drop the data and
4058                                          * NOT retransmit it.
4059                                          */
4060                                         if (chk->data) {
4061                                                 /* We release the
4062                                                  * book_size if the
4063                                                  * mbuf is here
4064                                                  */
4065                                                 int ret_spc;
4066                                                 int cause;
4067                                                 if (chk->sent > SCTP_DATAGRAM_UNSENT)
4068                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
4069                                                 else
4070                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
4071                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4072                                                                                       cause,
4073                                                                                       &asoc->sent_queue);
4074                                                 freed_spc += ret_spc;
4075                                                 if (freed_spc >= dataout) {
4076                                                         return;
4077                                                 }
4078                                         } /* if chunk was present */
4079                                 } /* if of sufficent priority */
4080                         } /* if chunk has enabled */
4081                 } /* tailqforeach */
4082
4083                 chk = TAILQ_FIRST(&asoc->send_queue);
4084                 while (chk) {
4085                         nchk = TAILQ_NEXT(chk, sctp_next);
4086                         /* Here we must move to the sent queue and mark */
4087                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4088                                            SCTP_PR_SCTP_BUFFER)) ==
4089                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4090                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4091                                         if (chk->data) {
4092                                                 /* We release the
4093                                                  * book_size if the
4094                                                  * mbuf is here
4095                                                  */
4096                                                 int ret_spc;
4097                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4098                                                     SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
4099                                                     &asoc->send_queue);
4100
4101                                                 freed_spc += ret_spc;
4102                                                 if (freed_spc >= dataout) {
4103                                                         return;
4104                                                 }
4105                                         } /* end if chk->data */
4106                                 } /* end if right class */
4107                         } /* end if chk pr-sctp */
4108                         chk = nchk;
4109                 } /* end while (chk) */
4110         } /* if enabled in asoc */
4111 }
4112
4113 static void
4114 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4115                    struct sctp_tcb *stcb,
4116                    struct sctp_sndrcvinfo *srcv,
4117                    struct sctp_stream_out *strq,
4118                    struct sctp_nets *net)
4119 {
4120         bzero(template, sizeof(struct sctp_tmit_chunk));
4121         template->sent = SCTP_DATAGRAM_UNSENT;
4122         if ((stcb->asoc.peer_supports_prsctp) &&
4123             (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4124             (srcv->sinfo_timetolive > 0)
4125                 ) {
4126                 /* If:
4127                  *  Peer supports PR-SCTP
4128                  *  The flags is set against this send for PR-SCTP
4129                  *  And timetolive is a postive value, zero is reserved
4130                  *     to mean a reliable send for both buffer/time
4131                  *     related one.
4132                  */
4133                 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4134                         /*
4135                          * Time to live is a priority stored in tv_sec
4136                          * when doing the buffer drop thing.
4137                          */
4138                         template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4139                 } else {
4140                         struct timeval tv;
4141
4142                         SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4143                         tv.tv_sec = srcv->sinfo_timetolive / 1000;
4144                         tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4145 #ifndef __FreeBSD__
4146                         timeradd(&template->rec.data.timetodrop, &tv,
4147                             &template->rec.data.timetodrop);
4148 #else
4149                         timevaladd(&template->rec.data.timetodrop, &tv);
4150 #endif
4151                 }
4152         }
4153         if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4154                 template->rec.data.stream_seq = strq->next_sequence_sent;
4155         } else {
4156                 template->rec.data.stream_seq = 0;
4157         }
4158         template->rec.data.TSN_seq = 0; /* not yet assigned */
4159
4160         template->rec.data.stream_number = srcv->sinfo_stream;
4161         template->rec.data.payloadtype = srcv->sinfo_ppid;
4162         template->rec.data.context = srcv->sinfo_context;
4163         template->rec.data.doing_fast_retransmit = 0;
4164         template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4165
4166         if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4167                 template->whoTo = net;
4168         } else {
4169                 if (stcb->asoc.primary_destination)
4170                         template->whoTo = stcb->asoc.primary_destination;
4171                 else {
4172                         /* TSNH */
4173                         template->whoTo = net;
4174                 }
4175         }
4176         /* the actual chunk flags */
4177         if (srcv->sinfo_flags & MSG_UNORDERED) {
4178                 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4179         } else {
4180                 template->rec.data.rcv_flags = 0;
4181         }
4182         /* no flags yet, FRAGMENT_OK goes here */
4183         template->flags = 0;
4184         /* PR sctp flags */
4185         if (stcb->asoc.peer_supports_prsctp) {
4186                 if (srcv->sinfo_timetolive > 0) {
4187                         /*
4188                          * We only set the flag if timetolive (or
4189                          * priority) was set to a positive number.
4190                          * Zero is reserved specifically to be
4191                          * EXCLUDED and sent reliable.
4192                          */
4193                         if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4194                                 template->flags |= SCTP_PR_SCTP_ENABLED;
4195                         }
4196                         if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4197                                 template->flags |= SCTP_PR_SCTP_BUFFER;
4198                         }
4199                 }
4200         }
4201         template->asoc = &stcb->asoc;
4202 }
4203
4204
4205 int
4206 sctp_get_frag_point(struct sctp_tcb *stcb,
4207                     struct sctp_association *asoc)
4208 {
4209         int siz, ovh;
4210
4211         /* For endpoints that have both 6 and 4 addresses
4212          * we must reserver room for the 6 ip header, for
4213          * those that are only dealing with V4 we use
4214          * a larger frag point.
4215          */
4216         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4217                 ovh = SCTP_MED_OVERHEAD;
4218         } else {
4219                 ovh = SCTP_MED_V4_OVERHEAD;
4220         }
4221
4222         if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4223                 siz = asoc->smallest_mtu - ovh;
4224         else
4225                 siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4226 /*
4227   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4228                 /* A data chunk MUST fit in a cluster */
4229 /*              siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4230 /*      }*/
4231
4232         if (siz % 4) {
4233                 /* make it an even word boundary please */
4234                 siz -= (siz % 4);
4235         }
4236         return (siz);
4237 }
4238 extern unsigned int sctp_max_chunks_on_queue;
4239
4240 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4241
4242 static int
4243 sctp_msg_append(struct sctp_tcb *stcb,
4244                 struct sctp_nets *net,
4245                 struct mbuf *m,
4246                 struct sctp_sndrcvinfo *srcv,
4247                 int flags)
4248 {
4249         struct socket *so;
4250         struct sctp_association *asoc;
4251         struct sctp_stream_out *strq;
4252         struct sctp_tmit_chunk *chk;
4253         struct sctpchunk_listhead tmp;
4254         struct sctp_tmit_chunk template;
4255         struct mbuf *n, *mnext;
4256         struct mbuf *mm;
4257         unsigned int dataout, siz;
4258         int mbcnt = 0;
4259         int mbcnt_e = 0;
4260         int error = 0;
4261
4262         if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4263                 /* Software fault, you blew it on the call */
4264 #ifdef SCTP_DEBUG
4265                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4266                         kprintf("software error in sctp_msg_append:1\n");
4267                         kprintf("stcb:%p net:%p m:%p srcv:%p\n",
4268                                stcb, net, m, srcv);
4269                 }
4270 #endif
4271                 if (m)
4272                         sctp_m_freem(m);
4273                 return (EFAULT);
4274         }
4275         so = stcb->sctp_socket;
4276         asoc = &stcb->asoc;
4277         if (srcv->sinfo_flags & MSG_ABORT) {
4278                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4279                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4280                         /* It has to be up before we abort */
4281                         /* how big is the user initiated abort? */
4282                         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4283                                 dataout = m->m_pkthdr.len;
4284                         } else {
4285                                 /* we must count */
4286                                 dataout = 0;
4287                                 for (n = m; n; n = n->m_next) {
4288                                         dataout += n->m_len;
4289                                 }
4290                         }
4291                         M_PREPEND(m, sizeof(struct sctp_paramhdr), MB_DONTWAIT);
4292                         if (m) {
4293                                 struct sctp_paramhdr *ph;
4294                                 m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4295                                 ph = mtod(m, struct sctp_paramhdr *);
4296                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4297                                 ph->param_length = htons(m->m_len);
4298                         }
4299                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4300                         m = NULL;
4301                 } else {
4302                         /* Only free if we don't send an abort */
4303                         ;
4304                 }
4305                 goto out;
4306         }
4307         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4308             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4309             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4310             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4311                 /* got data while shutting down */
4312                 error = ECONNRESET;
4313                 goto out;
4314         }
4315
4316         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4317                 /* Invalid stream number */
4318                 error = EINVAL;
4319                 goto out;
4320         }
4321         if (asoc->strmout == NULL) {
4322                 /* huh? software error */
4323 #ifdef SCTP_DEBUG
4324                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4325                         kprintf("software error in sctp_msg_append:2\n");
4326                 }
4327 #endif
4328                 error = EFAULT;
4329                 goto out;
4330         }
4331         strq = &asoc->strmout[srcv->sinfo_stream];
4332         /* how big is it ? */
4333         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4334                 dataout = m->m_pkthdr.len;
4335         } else {
4336                 /* we must count */
4337                 dataout = 0;
4338                 for (n = m; n; n = n->m_next) {
4339                         dataout += n->m_len;
4340                 }
4341         }
4342 #ifdef SCTP_DEBUG
4343         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4344                 kprintf("Attempt to send out %d bytes\n",
4345                        dataout);
4346         }
4347 #endif
4348
4349         /* lock the socket buf */
4350         SOCKBUF_LOCK(&so->so_snd);
4351         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
4352         if (error)
4353                 goto out_locked;
4354
4355         if (dataout > so->so_snd.ssb_hiwat) {
4356                 /* It will NEVER fit */
4357                 error = EMSGSIZE;
4358                 goto release;
4359         }
4360         if ((srcv->sinfo_flags & MSG_EOF) &&
4361             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4362             (dataout == 0)
4363                 ) {
4364                 goto zap_by_it_all;
4365         }
4366         if ((so->so_snd.ssb_hiwat <
4367              (dataout + asoc->total_output_queue_size)) ||
4368             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4369             (asoc->total_output_mbuf_queue_size >
4370              so->so_snd.ssb_mbmax)
4371                 ) {
4372                 /* XXX Buffer space hunt for data to skip */
4373                 if (asoc->peer_supports_prsctp) {
4374                         sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4375                 }
4376                 while ((so->so_snd.ssb_hiwat <
4377                     (dataout + asoc->total_output_queue_size)) ||
4378                     (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4379                     (asoc->total_output_mbuf_queue_size >
4380                     so->so_snd.ssb_mbmax)) {
4381                         struct sctp_inpcb *inp;
4382                         /* Now did we free up enough room? */
4383                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
4384                                 /* Non-blocking io in place */
4385                                 error = EWOULDBLOCK;
4386                                 goto release;
4387                         }
4388                         /*
4389                          * We store off a pointer to the endpoint.
4390                          * Since on return from this we must check to
4391                          * see if an so_error is set. If so we may have
4392                          * been reset and our stcb destroyed. Returning
4393                          * an error will cause the correct error return
4394                          * through and fix this all.
4395                          */
4396                         inp = stcb->sctp_ep;
4397                         /*
4398                          * Not sure how else to do this since
4399                          * the level we suspended at is not
4400                          * known deep down where we are. I will
4401                          * drop to spl0() so that others can
4402                          * get in.
4403                          */
4404
4405                         inp->sctp_tcb_at_block = (void *)stcb;
4406                         inp->error_on_block = 0;
4407                         ssb_unlock(&so->so_snd);
4408                         error = ssb_wait(&so->so_snd);
4409                         /*
4410                          * XXX: This is ugly but I have
4411                          * recreated most of what goes on to
4412                          * block in the sb. UGHH
4413                          * May want to add the bit about being
4414                          * no longer connected.. but this then
4415                          * further dooms the UDP model NOT to
4416                          * allow this.
4417                          */
4418                         inp->sctp_tcb_at_block = 0;
4419                         if (inp->error_on_block)
4420                                 error = inp->error_on_block;
4421                         if (so->so_error)
4422                                 error = so->so_error;
4423                         if (error) {
4424                                 goto out_locked;
4425                         }
4426                         error = ssb_lock(&so->so_snd, M_WAITOK);
4427                         if (error)
4428                                 goto out_locked;
4429                         /* Otherwise we cycle back and recheck
4430                          * the space
4431                          */
4432 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4433                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4434 #else
4435                         if (so->so_state & SS_CANTSENDMORE) {
4436 #endif
4437                                 error = EPIPE;
4438                                 goto release;
4439                         }
4440                         if (so->so_error) {
4441                                 error = so->so_error;
4442                                 goto release;
4443                         }
4444                 }
4445         }
4446         /* If we have a packet header fix it if it was broke */
4447         if (m->m_flags & M_PKTHDR) {
4448                 m->m_pkthdr.len = dataout;
4449         }
4450         /* use the smallest one, user set value or
4451          * smallest mtu of the asoc
4452          */
4453         siz = sctp_get_frag_point(stcb, asoc);
4454         SOCKBUF_UNLOCK(&so->so_snd);
4455         if ((dataout) && (dataout <= siz)) {
4456                 /* Fast path */
4457                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4458                 if (chk == NULL) {
4459                         error = ENOMEM;
4460                         SOCKBUF_LOCK(&so->so_snd);
4461                         goto release;
4462                 }
4463                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4464                 chk->whoTo->ref_count++;
4465                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4466
4467                 /* no flags yet, FRAGMENT_OK goes here */
4468                 sctppcbinfo.ipi_count_chunk++;
4469                 sctppcbinfo.ipi_gencnt_chunk++;
4470                 asoc->chunks_on_out_queue++;
4471                 chk->data = m;
4472                 m = NULL;
4473                 /* Total in the MSIZE */
4474                 for (mm = chk->data; mm; mm = mm->m_next) {
4475                         mbcnt += MSIZE;
4476                         if (mm->m_flags & M_EXT) {
4477                                 mbcnt += chk->data->m_ext.ext_size;
4478                         }
4479                 }
4480                 /* fix up the send_size if it is not present */
4481                 chk->send_size = dataout;
4482                 chk->book_size = chk->send_size;
4483                 chk->mbcnt = mbcnt;
4484                 /* ok, we are commited */
4485                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4486                         /* bump the ssn if we are unordered. */
4487                         strq->next_sequence_sent++;
4488                 }
4489                 chk->data->m_nextpkt = 0;
4490                 asoc->stream_queue_cnt++;
4491                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4492                 /* now check if this stream is on the wheel */
4493                 if ((strq->next_spoke.tqe_next == NULL) &&
4494                     (strq->next_spoke.tqe_prev == NULL)) {
4495                         /* Insert it on the wheel since it is not
4496                          * on it currently
4497                          */
4498                         sctp_insert_on_wheel(asoc, strq);
4499                 }
4500         } else if ((dataout) && (dataout > siz)) {
4501                 /* Slow path */
4502                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4503                     (dataout > siz)) {
4504                         error = EMSGSIZE;
4505                         SOCKBUF_LOCK(&so->so_snd);
4506                         goto release;
4507                 }
4508                 /* setup the template */
4509                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4510
4511                 n = m;
4512                 while (dataout > siz) {
4513                         /*
4514                          * We can wait since this is called from the user
4515                          * send side
4516                          */
4517                         n->m_nextpkt = m_split(n, siz, MB_WAIT);
4518                         if (n->m_nextpkt == NULL) {
4519                                 error = EFAULT;
4520                                 SOCKBUF_LOCK(&so->so_snd);
4521                                 goto release;
4522                         }
4523                         dataout -= siz;
4524                         n = n->m_nextpkt;
4525                 }
4526                 /*
4527                  * ok, now we have a chain on m where m->m_nextpkt points to
4528                  * the next chunk and m/m->m_next chain is the piece to send.
4529                  * We must go through the chains and thread them on to
4530                  * sctp_tmit_chunk chains and place them all on the stream
4531                  * queue, breaking the m->m_nextpkt pointers as we go.
4532                  */
4533                 n = m;
4534                 TAILQ_INIT(&tmp);
4535                 while (n) {
4536                         /*
4537                          * first go through and allocate a sctp_tmit chunk
4538                          * for each chunk piece
4539                          */
4540                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4541                         if (chk == NULL) {
4542                                 /*
4543                                  * ok we must spin through and dump anything
4544                                  * we have allocated and then jump to the
4545                                  * no_membad
4546                                  */
4547                                 chk = TAILQ_FIRST(&tmp);
4548                                 while (chk) {
4549                                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4550                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4551                                         sctppcbinfo.ipi_count_chunk--;
4552                                         asoc->chunks_on_out_queue--;
4553                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4554                                                 panic("Chunk count is negative");
4555                                         }
4556                                         sctppcbinfo.ipi_gencnt_chunk++;
4557                                         chk = TAILQ_FIRST(&tmp);
4558                                 }
4559                                 error = ENOMEM;
4560                                 SOCKBUF_LOCK(&so->so_snd);
4561                                 goto release;
4562                         }
4563                         sctppcbinfo.ipi_count_chunk++;
4564                         asoc->chunks_on_out_queue++;
4565
4566                         sctppcbinfo.ipi_gencnt_chunk++;
4567                         *chk = template;
4568                         chk->whoTo->ref_count++;
4569                         chk->data = n;
4570                         /* Total in the MSIZE */
4571                         mbcnt_e = 0;
4572                         for (mm = chk->data; mm; mm = mm->m_next) {
4573                                 mbcnt_e += MSIZE;
4574                                 if (mm->m_flags & M_EXT) {
4575                                         mbcnt_e += chk->data->m_ext.ext_size;
4576                                 }
4577                         }
4578                         /* now fix the chk->send_size */
4579                         if (chk->data->m_flags & M_PKTHDR) {
4580                                 chk->send_size = chk->data->m_pkthdr.len;
4581                         } else {
4582                                 struct mbuf *nn;
4583                                 chk->send_size = 0;
4584                                 for (nn = chk->data; nn; nn = nn->m_next) {
4585                                         chk->send_size += nn->m_len;
4586                                 }
4587                         }
4588                         chk->book_size = chk->send_size;
4589                         chk->mbcnt = mbcnt_e;
4590                         mbcnt += mbcnt_e;
4591                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4592                                 asoc->sent_queue_cnt_removeable++;
4593                         }
4594                         n = n->m_nextpkt;
4595                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4596                 }
4597                 m = NULL;
4598                 /* now that we have enough space for all de-couple the
4599                  * chain of mbufs by going through our temp array
4600                  * and breaking the pointers.
4601                  */
4602                 /* ok, we are commited */
4603                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4604                         /* bump the ssn if we are unordered. */
4605                         strq->next_sequence_sent++;
4606                 }
4607                 /* Mark the first/last flags. This will
4608                  * result int a 3 for a single item on the list
4609                  */
4610                 chk = TAILQ_FIRST(&tmp);
4611                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4612                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4613                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4614                 /* now break any chains on the queue and
4615                  * move it to the streams actual queue.
4616                  */
4617                 chk = TAILQ_FIRST(&tmp);
4618                 while (chk) {
4619                         chk->data->m_nextpkt = 0;
4620                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4621                         asoc->stream_queue_cnt++;
4622                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4623                         chk = TAILQ_FIRST(&tmp);
4624                 }
4625                 /* now check if this stream is on the wheel */
4626                 if ((strq->next_spoke.tqe_next == NULL) &&
4627                     (strq->next_spoke.tqe_prev == NULL)) {
4628                         /* Insert it on the wheel since it is not
4629                          * on it currently
4630                          */
4631                         sctp_insert_on_wheel(asoc, strq);
4632                 }
4633         }
4634         SOCKBUF_LOCK(&so->so_snd);
4635         /* has a SHUTDOWN been (also) requested by the user on this asoc? */
4636 zap_by_it_all:
4637
4638         if ((srcv->sinfo_flags & MSG_EOF) &&
4639             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4640
4641                 int some_on_streamwheel = 0;
4642
4643                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4644                         /* Check to see if some data queued */
4645                         struct sctp_stream_out *outs;
4646                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4647                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
4648                                         some_on_streamwheel = 1;
4649                                         break;
4650                                 }
4651                         }
4652                 }
4653
4654                 if (TAILQ_EMPTY(&asoc->send_queue) &&
4655                     TAILQ_EMPTY(&asoc->sent_queue) &&
4656                     (some_on_streamwheel == 0)) {
4657                         /* there is nothing queued to send, so I'm done... */
4658                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4659                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4660                                 /* only send SHUTDOWN the first time through */
4661 #ifdef SCTP_DEBUG
4662                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4663                                         kprintf("%s:%d sends a shutdown\n",
4664                                                __FILE__,
4665                                                __LINE__
4666                                                 );
4667                                 }
4668 #endif
4669                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4670                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4671                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4672                                                  asoc->primary_destination);
4673                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4674                                                  asoc->primary_destination);
4675                         }
4676                 } else {
4677                         /*
4678                          * we still got (or just got) data to send, so set
4679                          * SHUTDOWN_PENDING
4680                          */
4681                         /*
4682                          * XXX sockets draft says that MSG_EOF should be sent
4683                          * with no data.  currently, we will allow user data
4684                          * to be sent first and move to SHUTDOWN-PENDING
4685                          */
4686                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4687                 }
4688         }
4689 #ifdef SCTP_MBCNT_LOGGING
4690         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4691                        asoc->total_output_queue_size,
4692                        dataout,
4693                        asoc->total_output_mbuf_queue_size,
4694                        mbcnt);
4695 #endif
4696         asoc->total_output_queue_size += dataout;
4697         asoc->total_output_mbuf_queue_size += mbcnt;
4698         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4699             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4700                 so->so_snd.ssb_cc += dataout;
4701                 so->so_snd.ssb_mbcnt += mbcnt;
4702         }
4703
4704 #ifdef SCTP_DEBUG
4705         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4706                 kprintf("++total out:%d total_mbuf_out:%d\n",
4707                        (int)asoc->total_output_queue_size,
4708                        (int)asoc->total_output_mbuf_queue_size);
4709         }
4710 #endif
4711
4712 release:
4713         ssb_unlock(&so->so_snd);
4714 out_locked:
4715         SOCKBUF_UNLOCK(&so->so_snd);
4716 out:
4717         if (m && m->m_nextpkt) {
4718                 n = m;
4719                 while (n) {
4720                         mnext = n->m_nextpkt;
4721                         n->m_nextpkt = NULL;
4722                         sctp_m_freem(n);
4723                         n = mnext;
4724                 }
4725         } else if (m)
4726                 sctp_m_freem(m);
4727
4728         return (error);
4729 }
4730
4731 static struct mbuf *
4732 sctp_copy_mbufchain(struct mbuf *clonechain,
4733                     struct mbuf *outchain)
4734 {
4735         struct mbuf *appendchain;
4736 #if defined(__FreeBSD__) || defined(__NetBSD__)
4737         /* Supposedly m_copypacket is an optimization, use it if we can */
4738         if (clonechain->m_flags & M_PKTHDR) {
4739                 appendchain = m_copypacket(clonechain, MB_DONTWAIT);
4740                 sctp_pegs[SCTP_CACHED_SRC]++;
4741         } else
4742                 appendchain = m_copy(clonechain, 0, M_COPYALL);
4743 #elif defined(__APPLE__)
4744         appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, MB_DONTWAIT);
4745 #else
4746         appendchain = m_copy(clonechain, 0, M_COPYALL);
4747 #endif
4748
4749         if (appendchain == NULL) {
4750                 /* error */
4751                 if (outchain)
4752                         sctp_m_freem(outchain);
4753                 return (NULL);
4754         }
4755         if (outchain) {
4756                 /* tack on to the end */
4757                 struct mbuf *m;
4758                 m = outchain;
4759                 while (m) {
4760                         if (m->m_next == NULL) {
4761                                 m->m_next = appendchain;
4762                                 break;
4763                         }
4764                         m = m->m_next;
4765                 }
4766                 if (outchain->m_flags & M_PKTHDR) {
4767                         int append_tot;
4768                         struct mbuf *t;
4769                         t = appendchain;
4770                         append_tot = 0;
4771                         while (t) {
4772                                 append_tot += t->m_len;
4773                                 t = t->m_next;
4774                         }
4775                         outchain->m_pkthdr.len += append_tot;
4776                 }
4777                 return (outchain);
4778         } else {
4779                 return (appendchain);
4780         }
4781 }
4782
4783 static void
4784 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4785 {
4786         struct sctp_copy_all *ca;
4787         struct mbuf *m;
4788         int ret;
4789
4790         ca = (struct sctp_copy_all *)ptr;
4791         if (ca->m == NULL) {
4792                 return;
4793         }
4794         if (ca->inp != inp) {
4795                 /* TSNH */
4796                 return;
4797         }
4798         m = sctp_copy_mbufchain(ca->m, NULL);
4799         if (m == NULL) {
4800                 /* can't copy so we are done */
4801                 ca->cnt_failed++;
4802                 return;
4803         }
4804         ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
4805                               &ca->sndrcv, MSG_FNONBLOCKING);
4806         if (ret) {
4807                 ca->cnt_failed++;
4808         } else {
4809                 ca->cnt_sent++;
4810         }
4811 }
4812
4813 static void
4814 sctp_sendall_completes(void *ptr, u_int32_t val)
4815 {
4816         struct sctp_copy_all *ca;
4817         ca = (struct sctp_copy_all *)ptr;
4818         /* Do a notify here?
4819          * Kacheong suggests that the notify
4820          * be done at the send time.. so you would
4821          * push up a notification if any send failed.
4822          * Don't know if this is feasable since the
4823          * only failures we have is "memory" related and
4824          * if you cannot get an mbuf to send the data
4825          * you surely can't get an mbuf to send up
4826          * to notify the user you can't send the data :->
4827          */
4828
4829         /* now free everything */
4830         m_freem(ca->m);
4831         kfree(ca, M_PCB);
4832 }
4833
4834
4835 #define MC_ALIGN(m, len) do {                                           \
4836         (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);                \
4837 } while (0)
4838
4839
4840
4841 static struct mbuf *
4842 sctp_copy_out_all(struct uio *uio, int len)
4843 {
4844         struct mbuf *ret, *at;
4845         int left, willcpy, cancpy, error;
4846
4847         MGETHDR(ret, MB_WAIT, MT_HEADER);
4848         if (ret == NULL) {
4849                 /* TSNH */
4850                 return (NULL);
4851         }
4852         left = len;
4853         ret->m_len = 0;
4854         ret->m_pkthdr.len = len;
4855         MCLGET(ret, MB_WAIT);
4856         if (ret == NULL) {
4857                 return (NULL);
4858         }
4859         if ((ret->m_flags & M_EXT) == 0) {
4860                 m_freem (ret);
4861                 return (NULL);
4862         }
4863         cancpy = M_TRAILINGSPACE(ret);
4864         willcpy = min(cancpy, left);
4865         at = ret;
4866         while (left > 0) {
4867                 /* Align data to the end */
4868                 MC_ALIGN(at, willcpy);
4869                 error = uiomove(mtod(at, caddr_t), willcpy, uio);
4870                 if (error) {
4871                 err_out_now:
4872                         m_freem(ret);
4873                         return (NULL);
4874                 }
4875                 at->m_len = willcpy;
4876                 at->m_nextpkt = at->m_next = 0;
4877                 left -= willcpy;
4878                 if (left > 0) {
4879                         MGET(at->m_next, MB_WAIT, MT_DATA);
4880                         if (at->m_next == NULL) {
4881                                 goto err_out_now;
4882                         }
4883                         at = at->m_next;
4884                         at->m_len = 0;
4885                         MCLGET(at, MB_WAIT);
4886                         if (at == NULL) {
4887                                 goto err_out_now;
4888                         }
4889                         if ((at->m_flags & M_EXT) == 0) {
4890                                 goto err_out_now;
4891                         }
4892                         cancpy = M_TRAILINGSPACE(at);
4893                         willcpy = min(cancpy, left);
4894                 }
4895         }
4896         return (ret);
4897 }
4898
4899 static int
4900 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4901 {
4902         int ret;
4903         struct sctp_copy_all *ca;
4904         ca = kmalloc(sizeof(struct sctp_copy_all), M_PCB, M_NOWAIT);
4905         if (ca == NULL) {
4906                 m_freem(m);
4907                 return (ENOMEM);
4908         }
4909         memset (ca, 0, sizeof(struct sctp_copy_all));
4910
4911         ca->inp = inp;
4912         ca->sndrcv = *srcv;
4913         /* take off the sendall flag, it would
4914          * be bad if we failed to do this  :-0
4915          */
4916         ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4917
4918         /* get length and mbuf chain */
4919         if (uio) {
4920                 ca->sndlen = uio->uio_resid;
4921                 ca->m = sctp_copy_out_all(uio, ca->sndlen);
4922                 if (ca->m == NULL) {
4923                         kfree(ca, M_PCB);
4924                         return (ENOMEM);
4925                 }
4926         } else {
4927                 if ((m->m_flags & M_PKTHDR) == 0) {
4928                         ca->sndlen = 0;
4929                         while(m) {
4930                                 ca->sndlen += m->m_len;
4931                                 m = m->m_next;
4932                         }
4933                 } else {
4934                         ca->sndlen = m->m_pkthdr.len;
4935                 }
4936                 ca->m = m;
4937         }
4938
4939         ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4940                                      (void *)ca, 0, sctp_sendall_completes, inp);
4941         if (ret) {
4942 #ifdef SCTP_DEBUG
4943                 kprintf("Failed to initate iterator to takeover associations\n");
4944 #endif
4945                 kfree(ca, M_PCB);
4946                 return (EFAULT);
4947
4948         }
4949         return (0);
4950 }
4951
4952
4953 void
4954 sctp_toss_old_cookies(struct sctp_association *asoc)
4955 {
4956         struct sctp_tmit_chunk *chk, *nchk;
4957         chk = TAILQ_FIRST(&asoc->control_send_queue);
4958         while (chk) {
4959                 nchk = TAILQ_NEXT(chk, sctp_next);
4960                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4961                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4962                         if (chk->data) {
4963                                 sctp_m_freem(chk->data);
4964                                 chk->data = NULL;
4965                         }
4966                         asoc->ctrl_queue_cnt--;
4967                         if (chk->whoTo)
4968                                 sctp_free_remote_addr(chk->whoTo);
4969                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4970                         sctppcbinfo.ipi_count_chunk--;
4971                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4972                                 panic("Chunk count is negative");
4973                         }
4974                         sctppcbinfo.ipi_gencnt_chunk++;
4975                 }
4976                 chk = nchk;
4977         }
4978 }
4979
4980 void
4981 sctp_toss_old_asconf(struct sctp_tcb *stcb)
4982 {
4983         struct sctp_association *asoc;
4984         struct sctp_tmit_chunk *chk, *chk_tmp;
4985
4986         asoc = &stcb->asoc;
4987         for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
4988              chk = chk_tmp) {
4989                 /* get next chk */
4990                 chk_tmp = TAILQ_NEXT(chk, sctp_next);
4991                 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */
4992                 if (chk->rec.chunk_id == SCTP_ASCONF) {
4993                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4994                         if (chk->data) {
4995                                 sctp_m_freem(chk->data);
4996                                 chk->data = NULL;
4997                         }
4998                         asoc->ctrl_queue_cnt--;
4999                         if (chk->whoTo)
5000                                 sctp_free_remote_addr(chk->whoTo);
5001                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5002                         sctppcbinfo.ipi_count_chunk--;
5003                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5004                                 panic("Chunk count is negative");
5005                         }
5006                         sctppcbinfo.ipi_gencnt_chunk++;
5007                 }
5008         }
5009 }
5010
5011
5012 static void
5013 sctp_clean_up_datalist(struct sctp_tcb *stcb,
5014                        struct sctp_association *asoc,
5015                        struct sctp_tmit_chunk **data_list,
5016                        int bundle_at,
5017                        struct sctp_nets *net)
5018 {
5019         int i;
5020         for (i = 0; i < bundle_at; i++) {
5021                 /* off of the send queue */
5022                 if (i) {
5023                         /* Any chunk NOT 0 you zap the time
5024                          * chunk 0 gets zapped or set based on
5025                          * if a RTO measurment is needed.
5026                          */
5027                         data_list[i]->do_rtt = 0;
5028                 }
5029                 /* record time */
5030                 data_list[i]->sent_rcv_time = net->last_sent_time;
5031                 TAILQ_REMOVE(&asoc->send_queue,
5032                              data_list[i],
5033                              sctp_next);
5034                 /* on to the sent queue */
5035                 TAILQ_INSERT_TAIL(&asoc->sent_queue,
5036                                   data_list[i],
5037                                   sctp_next);
5038                 /* This does not lower until the cum-ack passes it */
5039                 asoc->sent_queue_cnt++;
5040                 asoc->send_queue_cnt--;
5041                 if ((asoc->peers_rwnd <= 0) &&
5042                     (asoc->total_flight == 0) &&
5043                     (bundle_at == 1)) {
5044                         /* Mark the chunk as being a window probe */
5045 #ifdef SCTP_DEBUG
5046                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
5047                                 kprintf("WINDOW PROBE SET\n");
5048                         }
5049 #endif
5050                         sctp_pegs[SCTP_WINDOW_PROBES]++;
5051                         data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
5052                 } else {
5053                         data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
5054                 }
5055 #ifdef SCTP_AUDITING_ENABLED
5056                 sctp_audit_log(0xC2, 3);
5057 #endif
5058                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
5059                 data_list[i]->snd_count = 1;
5060                 net->flight_size += data_list[i]->book_size;
5061                 asoc->total_flight += data_list[i]->book_size;
5062                 asoc->total_flight_count++;
5063 #ifdef SCTP_LOG_RWND
5064                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
5065                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
5066 #endif
5067                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
5068                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
5069                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5070                         /* SWS sender side engages */
5071                         asoc->peers_rwnd = 0;
5072                 }
5073         }
5074 }
5075
5076 static void
5077 sctp_clean_up_ctl(struct sctp_association *asoc)
5078 {
5079         struct sctp_tmit_chunk *chk, *nchk;
5080         for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5081             chk; chk = nchk) {
5082                 nchk = TAILQ_NEXT(chk, sctp_next);
5083                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5084                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5085                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5086                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5087                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5088                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5089                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5090                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5091                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5092                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5093                         /* Stray chunks must be cleaned up */
5094                 clean_up_anyway:
5095                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5096                         if (chk->data) {
5097                                 sctp_m_freem(chk->data);
5098                                 chk->data = NULL;
5099                         }
5100                         asoc->ctrl_queue_cnt--;
5101                         sctp_free_remote_addr(chk->whoTo);
5102                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5103                         sctppcbinfo.ipi_count_chunk--;
5104                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5105                                 panic("Chunk count is negative");
5106                         }
5107                         sctppcbinfo.ipi_gencnt_chunk++;
5108                 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
5109                         struct sctp_stream_reset_req *strreq;
5110                         /* special handling, we must look into the param */
5111                         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
5112                         if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5113                                 goto clean_up_anyway;
5114                         }
5115                 }
5116         }
5117 }
5118
5119 static int
5120 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5121                       struct sctp_stream_out *strq)
5122 {
5123         /* Move from the stream to the send_queue keeping track of the total */
5124         struct sctp_association *asoc;
5125         int tot_moved = 0;
5126         int failed = 0;
5127         int padval;
5128         struct sctp_tmit_chunk *chk, *nchk;
5129         struct sctp_data_chunk *dchkh;
5130         struct sctpchunk_listhead tmp;
5131         struct mbuf *orig;
5132
5133         asoc = &stcb->asoc;
5134         TAILQ_INIT(&tmp);
5135         chk = TAILQ_FIRST(&strq->outqueue);
5136         while (chk) {
5137                 nchk = TAILQ_NEXT(chk, sctp_next);
5138                 /* now put in the chunk header */
5139                 orig = chk->data;
5140                 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), MB_DONTWAIT);
5141                 if (chk->data == NULL) {
5142                         /* HELP */
5143                         failed++;
5144                         break;
5145                 }
5146                 if (orig != chk->data) {
5147                         /* A new mbuf was added, account for it */
5148                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5149                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5150                                 stcb->sctp_socket->so_snd.ssb_mbcnt += MSIZE;
5151                         }
5152 #ifdef SCTP_MBCNT_LOGGING
5153                         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5154                                        asoc->total_output_queue_size,
5155                                        0,
5156                                        asoc->total_output_mbuf_queue_size,
5157                                        MSIZE);
5158 #endif
5159                         stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5160                         chk->mbcnt += MSIZE;
5161                 }
5162                 chk->send_size += sizeof(struct sctp_data_chunk);
5163                 /* This should NOT have to do anything, but
5164                  * I would rather be cautious
5165                  */
5166                 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5167                         m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5168                         if (chk->data == NULL) {
5169                                 failed++;
5170                                 break;
5171                         }
5172                 }
5173                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5174                 dchkh->ch.chunk_length = htons(chk->send_size);
5175                 /* Chunks must be padded to even word boundary */
5176                 padval = chk->send_size % 4;
5177                 if (padval) {
5178                         /* For fragmented messages this should not
5179                          * run except possibly on the last chunk
5180                          */
5181                         if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5182                                 /* we are in big big trouble no mbufs :< */
5183                                 failed++;
5184                                 break;
5185                         }
5186                         chk->send_size += (4 - padval);
5187                 }
5188                 /* pull from stream queue */
5189                 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5190                 asoc->stream_queue_cnt--;
5191                 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5192                 /* add it in to the size of moved chunks */
5193                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5194                         /* we pull only one message */
5195                         break;
5196                 }
5197                 chk = nchk;
5198         }
5199         if (failed) {
5200                 /* Gak, we just lost the user message */
5201                 chk = TAILQ_FIRST(&tmp);
5202                 while (chk) {
5203                         nchk = TAILQ_NEXT(chk, sctp_next);
5204                         TAILQ_REMOVE(&tmp, chk, sctp_next);
5205
5206                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5207                                         (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5208                                         chk);
5209
5210                         if (chk->data) {
5211                                 sctp_m_freem(chk->data);
5212                                 chk->data = NULL;
5213                         }
5214                         if (chk->whoTo) {
5215                                 sctp_free_remote_addr(chk->whoTo);
5216                                 chk->whoTo = NULL;
5217                         }
5218                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5219                         sctppcbinfo.ipi_count_chunk--;
5220                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5221                                 panic("Chunk count is negative");
5222                         }
5223                         sctppcbinfo.ipi_gencnt_chunk++;
5224                         chk = nchk;
5225                 }
5226                 return (0);
5227         }
5228         /* now pull them off of temp wheel */
5229         chk = TAILQ_FIRST(&tmp);
5230         while (chk) {
5231                 nchk = TAILQ_NEXT(chk, sctp_next);
5232                 /* insert on send_queue */
5233                 TAILQ_REMOVE(&tmp, chk, sctp_next);
5234                 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5235                 asoc->send_queue_cnt++;
5236                 /* assign TSN */
5237                 chk->rec.data.TSN_seq = asoc->sending_seq++;
5238
5239                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5240                 /* Put the rest of the things in place now. Size
5241                  * was done earlier in previous loop prior to
5242                  * padding.
5243                  */
5244                 dchkh->ch.chunk_type = SCTP_DATA;
5245                 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5246                 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5247                 dchkh->dp.stream_id = htons(strq->stream_no);
5248                 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5249                 dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5250                 /* total count moved */
5251                 tot_moved += chk->send_size;
5252                 chk = nchk;
5253         }
5254         return (tot_moved);
5255 }
5256
5257 static void
5258 sctp_fill_outqueue(struct sctp_tcb *stcb,
5259                    struct sctp_nets *net)
5260 {
5261         struct sctp_association *asoc;
5262         struct sctp_tmit_chunk *chk;
5263         struct sctp_stream_out *strq, *strqn;
5264         int mtu_fromwheel, goal_mtu;
5265         unsigned int moved, seenend, cnt_mvd=0;
5266
5267         asoc = &stcb->asoc;
5268         /* Attempt to move at least 1 MTU's worth
5269          * onto the wheel for each destination address
5270          */
5271         goal_mtu = net->cwnd - net->flight_size;
5272         if ((unsigned int)goal_mtu < net->mtu) {
5273                 goal_mtu = net->mtu;
5274         }
5275         if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5276                 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5277         }
5278         seenend = moved = mtu_fromwheel = 0;
5279         if (asoc->last_out_stream == NULL) {
5280                 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5281                 if (asoc->last_out_stream == NULL) {
5282                         /* huh nothing on the wheel, TSNH */
5283                         return;
5284                 }
5285                 goto done_it;
5286         }
5287         strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5288  done_it:
5289         if (strq == NULL) {
5290                 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5291         }
5292         while (mtu_fromwheel < goal_mtu) {
5293                 if (strq == NULL) {
5294                         if (seenend == 0) {
5295                                 seenend = 1;
5296                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5297                         } else if ((moved == 0) && (seenend)) {
5298                                 /* none left on the wheel */
5299                                 sctp_pegs[SCTP_MOVED_NLEF]++;
5300                                 return;
5301                         } else if (moved) {
5302                                 /*
5303                                  * clear the flags and rotate back through
5304                                  * again
5305                                  */
5306                                 moved = 0;
5307                                 seenend = 0;
5308                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5309                         }
5310                         if (strq == NULL)
5311                                 break;
5312                         continue;
5313                 }
5314                 strqn = TAILQ_NEXT(strq, next_spoke);
5315                 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5316                         /* none left on this queue, prune a spoke?  */
5317                         sctp_remove_from_wheel(asoc, strq);
5318                         if (strq == asoc->last_out_stream) {
5319                             /* the last one we used went off the wheel */
5320                             asoc->last_out_stream = NULL;
5321                         }
5322                         strq = strqn;
5323                         continue;
5324                 }
5325                 if (chk->whoTo != net) {
5326                         /* Skip this stream, first one on stream
5327                          * does not head to our current destination.
5328                          */
5329                         strq = strqn;
5330                         continue;
5331                 }
5332                 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5333                 cnt_mvd++;
5334                 moved++;
5335                 asoc->last_out_stream = strq;
5336                 strq = strqn;
5337         }
5338         sctp_pegs[SCTP_MOVED_MAX]++;
5339 #ifdef SCTP_DEBUG
5340         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5341                 kprintf("Ok we moved %d chunks to send queue\n",
5342                        moved);
5343         }
5344 #endif
5345         if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5346                 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5347         }
5348 }
5349
5350 void
5351 sctp_fix_ecn_echo(struct sctp_association *asoc)
5352 {
5353         struct sctp_tmit_chunk *chk;
5354         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5355                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5356                         chk->sent = SCTP_DATAGRAM_UNSENT;
5357                 }
5358         }
5359 }
5360
5361 static void
5362 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5363                     struct sctp_association *asoc,
5364                     struct sctp_nets *net)
5365 {
5366         struct sctp_tmit_chunk *chk;
5367         struct sctp_nets *a_net;
5368         a_net = sctp_find_alternate_net(stcb, net);
5369         if ((a_net != net) &&
5370             ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5371                 /*
5372                  * We only proceed if a valid alternate is found that is
5373                  * not this one and is reachable. Here we must move all
5374                  * chunks queued in the send queue off of the destination
5375                  * address to our alternate.
5376                  */
5377                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5378                         if (chk->whoTo == net) {
5379                                 /* Move the chunk to our alternate */
5380                                 sctp_free_remote_addr(chk->whoTo);
5381                                 chk->whoTo = a_net;
5382                                 a_net->ref_count++;
5383                         }
5384                 }
5385         }
5386 }
5387
5388 static int sctp_from_user_send=0;
5389
5390 static int
5391 sctp_med_chunk_output(struct sctp_inpcb *inp,
5392                       struct sctp_tcb *stcb,
5393                       struct sctp_association *asoc,
5394                       int *num_out,
5395                       int *reason_code,
5396                       int control_only, int *cwnd_full, int from_where,
5397                       struct timeval *now, int *now_filled)
5398 {
5399         /*
5400          * Ok this is the generic chunk service queue.
5401          * we must do the following:
5402          *  - Service the stream queue that is next, moving any message
5403          *    (note I must get a complete message i.e. FIRST/MIDDLE and
5404          *    LAST to the out queue in one pass) and assigning TSN's
5405          *  - Check to see if the cwnd/rwnd allows any output, if so we
5406          *    go ahead and fomulate and send the low level chunks. Making
5407          *    sure to combine any control in the control chunk queue also.
5408          */
5409         struct sctp_nets *net;
5410         struct mbuf *outchain;
5411         struct sctp_tmit_chunk *chk, *nchk;
5412         struct sctphdr *shdr;
5413         /* temp arrays for unlinking */
5414         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5415         int no_fragmentflg, error;
5416         int one_chunk, hbflag;
5417         int asconf, cookie, no_out_cnt;
5418         int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5419         unsigned int mtu, r_mtu, omtu;
5420         *num_out = 0;
5421         cwnd_full_ind = 0;
5422         ctl_cnt = no_out_cnt = asconf = cookie = 0;
5423         /*
5424          * First lets prime the pump. For each destination, if there
5425          * is room in the flight size, attempt to pull an MTU's worth
5426          * out of the stream queues into the general send_queue
5427          */
5428 #ifdef SCTP_AUDITING_ENABLED
5429         sctp_audit_log(0xC2, 2);
5430 #endif
5431 #ifdef SCTP_DEBUG
5432         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5433                 kprintf("***********************\n");
5434         }
5435 #endif
5436         hbflag = 0;
5437         if (control_only)
5438                 no_data_chunks = 1;
5439         else
5440                 no_data_chunks = 0;
5441
5442         /* Nothing to possible to send? */
5443         if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5444             TAILQ_EMPTY(&asoc->send_queue) &&
5445             TAILQ_EMPTY(&asoc->out_wheel)) {
5446 #ifdef SCTP_DEBUG
5447                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5448                         kprintf("All wheels empty\n");
5449                 }
5450 #endif
5451                 return (0);
5452         }
5453         if (asoc->peers_rwnd <= 0) {
5454                 /* No room in peers rwnd */
5455                 *cwnd_full = 1;
5456                 *reason_code = 1;
5457                 if (asoc->total_flight > 0) {
5458                         /* we are allowed one chunk in flight */
5459                         no_data_chunks = 1;
5460                         sctp_pegs[SCTP_RWND_BLOCKED]++;
5461                 }
5462         }
5463 #ifdef SCTP_DEBUG
5464         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5465                 kprintf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5466                        no_data_chunks,
5467                        (int)asoc->total_flight, (int)asoc->peers_rwnd);
5468         }
5469 #endif
5470         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5471 #ifdef SCTP_DEBUG
5472                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5473                         kprintf("net:%p fs:%d  cwnd:%d\n",
5474                                net, net->flight_size, net->cwnd);
5475                 }
5476 #endif
5477                 if (net->flight_size >= net->cwnd) {
5478                         /* skip this network, no room */
5479                         cwnd_full_ind++;
5480 #ifdef SCTP_DEBUG
5481                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5482                                 kprintf("Ok skip fillup->fs:%d > cwnd:%d\n",
5483                                        net->flight_size,
5484                                        net->cwnd);
5485                         }
5486 #endif
5487                         sctp_pegs[SCTP_CWND_NOFILL]++;
5488                         continue;
5489                 }
5490                 /*
5491                  * spin through the stream queues moving one message and
5492                  * assign TSN's as appropriate.
5493                  */
5494                 sctp_fill_outqueue(stcb, net);
5495         }
5496         *cwnd_full = cwnd_full_ind;
5497         /* now service each destination and send out what we can for it */
5498 #ifdef SCTP_DEBUG
5499         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5500                 int chk_cnt = 0;
5501                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5502                         chk_cnt++;
5503                 }
5504                 kprintf("We have %d chunks on the send_queue\n", chk_cnt);
5505                 chk_cnt = 0;
5506                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5507                         chk_cnt++;
5508                 }
5509                 kprintf("We have %d chunks on the sent_queue\n", chk_cnt);
5510                 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5511                         chk_cnt++;
5512                 }
5513                 kprintf("We have %d chunks on the control_queue\n", chk_cnt);
5514         }
5515 #endif
5516         /* If we have data to send, and DSACK is running, stop it
5517          * and build a SACK to dump on to bundle with output. This
5518          * actually MAY make it so the bundling does not occur if
5519          * the SACK is big but I think this is ok because basic SACK
5520          * space is pre-reserved in our fragmentation size choice.
5521          */
5522         if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5523             (no_data_chunks == 0)) {
5524                 /* We will be sending something */
5525                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5526                         /* Yep a callout is pending */
5527                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5528                                         stcb->sctp_ep,
5529                                         stcb, NULL);
5530                         sctp_send_sack(stcb);
5531                 }
5532         }
5533         /* Nothing to send? */
5534         if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5535             (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5536                 return (0);
5537         }
5538         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5539                 /* how much can we send? */
5540                 if (net->ref_count < 2) {
5541                         /* Ref-count of 1 so we cannot have data or control
5542                          * queued to this address. Skip it.
5543                          */
5544                         continue;
5545                 }
5546                 ctl_cnt = bundle_at = 0;
5547                 outchain = NULL;
5548                 no_fragmentflg = 1;
5549                 one_chunk = 0;
5550
5551                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5552                         mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5553                 } else {
5554                         mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5555                 }
5556                 if (mtu > asoc->peers_rwnd) {
5557                         if (asoc->total_flight > 0) {
5558                                 /* We have a packet in flight somewhere */
5559                                 r_mtu = asoc->peers_rwnd;
5560                         } else {
5561                                 /* We are always allowed to send one MTU out */
5562                                 one_chunk = 1;
5563                                 r_mtu = mtu;
5564                         }
5565                 } else {
5566                         r_mtu = mtu;
5567                 }
5568 #ifdef SCTP_DEBUG
5569                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5570                         kprintf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5571                                r_mtu, mtu, net, one_chunk);
5572                 }
5573 #endif
5574                 /************************/
5575                 /* Control transmission */
5576                 /************************/
5577                 /* Now first lets go through the control queue */
5578                 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5579                      chk; chk = nchk) {
5580                         nchk = TAILQ_NEXT(chk, sctp_next);
5581                         if (chk->whoTo != net) {
5582                                 /*
5583                                  * No, not sent to the network we are
5584                                  * looking at
5585                                  */
5586                                 continue;
5587                         }
5588                         if (chk->data == NULL) {
5589                                 continue;
5590                         }
5591                         if ((chk->data->m_flags & M_PKTHDR) == 0) {
5592                                 /*
5593                                  * NOTE: the chk queue MUST have the PKTHDR
5594                                  * flag set on it with a total in the
5595                                  * m_pkthdr.len field!! else the chunk will
5596                                  * ALWAYS be skipped
5597                                  */
5598                                 continue;
5599                         }
5600                         if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5601                                 /*
5602                                  * It must be unsent. Cookies and ASCONF's
5603                                  * hang around but there timers will force
5604                                  * when marked for resend.
5605                                  */
5606                                 continue;
5607                         }
5608                         /* Here we do NOT factor the r_mtu */
5609                         if ((chk->data->m_pkthdr.len < (int)mtu) ||
5610                             (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5611                                 /*
5612                                  * We probably should glom the mbuf chain from
5613                                  * the chk->data for control but the problem
5614                                  * is it becomes yet one more level of
5615                                  * tracking to do if for some reason output
5616                                  * fails. Then I have got to reconstruct the
5617                                  * merged control chain.. el yucko.. for now
5618                                  * we take the easy way and do the copy
5619                                  */
5620                                 outchain = sctp_copy_mbufchain(chk->data,
5621                                                                outchain);
5622                                 if (outchain == NULL) {
5623                                         return (ENOMEM);
5624                                 }
5625                                 /* update our MTU size */
5626                                 mtu -= chk->data->m_pkthdr.len;
5627                                 if (mtu < 0) {
5628                                         mtu = 0;
5629                                 }
5630                                 /* Do clear IP_DF ? */
5631                                 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5632                                         no_fragmentflg = 0;
5633                                 }
5634                                 /* Mark things to be removed, if needed */
5635                                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5636                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5637                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5638                                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5639                                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5640                                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5641                                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5642                                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5643                                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5644                                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5645
5646                                         if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5647                                                 hbflag = 1;
5648                                         /* remove these chunks at the end */
5649                                         if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5650                                                 /* turn off the timer */
5651                                                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5652                                                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5653                                                                         inp, stcb, net);
5654                                                 }
5655                                         }
5656                                         ctl_cnt++;
5657                                 } else {
5658                                         /*
5659                                          * Other chunks, since they have
5660                                          * timers running (i.e. COOKIE or
5661                                          * ASCONF) we just "trust" that it
5662                                          * gets sent or retransmitted.
5663                                          */
5664                                         ctl_cnt++;
5665                                         if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5666                                                 cookie = 1;
5667                                                 no_out_cnt = 1;
5668                                         } else if (chk->rec.chunk_id == SCTP_ASCONF) {
5669                                                 /*
5670                                                  * set hb flag since we can use
5671                                                  * these for RTO
5672                                                  */
5673                                                 hbflag = 1;
5674                                                 asconf = 1;
5675                                         }
5676                                         chk->sent = SCTP_DATAGRAM_SENT;
5677                                         chk->snd_count++;
5678                                 }
5679                                 if (mtu == 0) {
5680                                         /*
5681                                          * Ok we are out of room but we can
5682                                          * output without effecting the flight
5683                                          * size since this little guy is a
5684                                          * control only packet.
5685                                          */
5686                                         if (asconf) {
5687                                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5688                                                 asconf = 0;
5689                                         }
5690                                         if (cookie) {
5691                                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5692                                                 cookie = 0;
5693                                         }
5694                                         if (outchain->m_len == 0) {
5695                                                 /*
5696                                                  * Special case for when you
5697                                                  * get a 0 len mbuf at the
5698                                                  * head due to the lack of a
5699                                                  * MHDR at the beginning.
5700                                                  */
5701                                                 outchain->m_len = sizeof(struct sctphdr);
5702                                         } else {
5703                                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5704                                                 if (outchain == NULL) {
5705                                                         /* no memory */
5706                                                         error = ENOBUFS;
5707                                                         goto error_out_again;
5708                                                 }
5709                                         }
5710                                         shdr = mtod(outchain, struct sctphdr *);
5711                                         shdr->src_port = inp->sctp_lport;
5712                                         shdr->dest_port = stcb->rport;
5713                                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5714                                         shdr->checksum = 0;
5715
5716                                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5717                                                                                 (struct sockaddr *)&net->ro._l_addr,
5718                                                                                 outchain,
5719                                                                                 no_fragmentflg, 0, NULL, asconf))) {
5720                                                 if (error == ENOBUFS) {
5721                                                         asoc->ifp_had_enobuf = 1;
5722                                                 }
5723                                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5724                                                 if (from_where == 0) {
5725                                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5726                                                 }
5727                                         error_out_again:
5728 #ifdef SCTP_DEBUG
5729                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5730                                                         kprintf("Gak got ctrl error %d\n", error);
5731                                                 }
5732 #endif
5733                                                 /* error, could not output */
5734                                                 if (hbflag) {
5735 #ifdef SCTP_DEBUG
5736                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5737                                                                 kprintf("Update HB anyway\n");
5738                                                         }
5739 #endif
5740                                                         if (*now_filled == 0) {
5741                                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5742                                                                 *now_filled = 1;
5743                                                                 *now = net->last_sent_time;
5744                                                         } else {
5745                                                                 net->last_sent_time = *now;
5746                                                         }
5747                                                         hbflag = 0;
5748                                                 }
5749                                                 if (error == EHOSTUNREACH) {
5750                                                         /*
5751                                                          * Destination went
5752                                                          * unreachable during
5753                                                          * this send
5754                                                          */
5755 #ifdef SCTP_DEBUG
5756                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5757                                                                 kprintf("Moving data to an alternate\n");
5758                                                         }
5759 #endif
5760                                                         sctp_move_to_an_alt(stcb, asoc, net);
5761                                                 }
5762                                                 sctp_clean_up_ctl (asoc);
5763                                                 return (error);
5764                                         } else
5765                                                 asoc->ifp_had_enobuf = 0;
5766                                         /* Only HB or ASCONF advances time */
5767                                         if (hbflag) {
5768                                                 if (*now_filled == 0) {
5769                                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5770                                                         *now_filled = 1;
5771                                                         *now = net->last_sent_time;
5772                                                 } else {
5773                                                         net->last_sent_time = *now;
5774                                                 }
5775                                                 hbflag = 0;
5776                                         }
5777                                         /*
5778                                          * increase the number we sent, if a
5779                                          * cookie is sent we don't tell them
5780                                          * any was sent out.
5781                                          */
5782                                         if (!no_out_cnt)
5783                                                 *num_out +=  ctl_cnt;
5784                                         /* recalc a clean slate and setup */
5785                                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5786                                                 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5787                                         } else {
5788                                                 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5789                                         }
5790                                         no_fragmentflg = 1;
5791                                 }
5792                         }
5793                 }
5794                 /*********************/
5795                 /* Data transmission */
5796                 /*********************/
5797                 /* now lets add any data within the MTU constraints */
5798                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5799                         omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5800                 } else {
5801                         omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5802                 }
5803
5804 #ifdef SCTP_DEBUG
5805                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5806                         kprintf("Now to data transmission\n");
5807                 }
5808 #endif
5809
5810                 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5811                     (cookie)) {
5812                         for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5813                                 if (no_data_chunks) {
5814                                         /* let only control go out */
5815 #ifdef SCTP_DEBUG
5816                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5817                                                 kprintf("Either nothing to send or we are full\n");
5818                                         }
5819 #endif
5820                                         break;
5821                                 }
5822                                 if (net->flight_size >= net->cwnd) {
5823                                         /* skip this net, no room for data */
5824 #ifdef SCTP_DEBUG
5825                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5826                                                 kprintf("fs:%d > cwnd:%d\n",
5827                                                        net->flight_size, net->cwnd);
5828                                         }
5829 #endif
5830                                         sctp_pegs[SCTP_CWND_BLOCKED]++;
5831                                         *reason_code = 2;
5832                                         break;
5833                                 }
5834                                 nchk = TAILQ_NEXT(chk, sctp_next);
5835                                 if (chk->whoTo != net) {
5836                                         /* No, not sent to this net */
5837 #ifdef SCTP_DEBUG
5838                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5839                                                 kprintf("chk->whoTo:%p not %p\n",
5840                                                        chk->whoTo, net);
5841
5842                                         }
5843 #endif
5844                                         continue;
5845                                 }
5846 #ifdef SCTP_DEBUG
5847                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5848                                         kprintf("Can we pick up a chunk?\n");
5849                                 }
5850 #endif
5851                                 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5852                                         /* strange, we have a chunk that is to bit
5853                                          * for its destination and yet no fragment ok flag.
5854                                          * Something went wrong when the PMTU changed...we did
5855                                          * not mark this chunk for some reason?? I will
5856                                          * fix it here by letting IP fragment it for now and
5857                                          * printing a warning. This really should not happen ...
5858                                          */
5859 /*#ifdef SCTP_DEBUG*/
5860                                         kprintf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5861                                                chk->send_size, mtu);
5862 /*#endif*/
5863                                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5864                                 }
5865
5866                                 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5867                                     ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5868                                         /* ok we will add this one */
5869 #ifdef SCTP_DEBUG
5870                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5871                                                 kprintf("Picking up the chunk\n");
5872                                         }
5873 #endif
5874                                         outchain = sctp_copy_mbufchain(chk->data, outchain);
5875                                         if (outchain == NULL) {
5876 #ifdef SCTP_DEBUG
5877                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5878                                                         kprintf("Gakk no memory\n");
5879                                                 }
5880 #endif
5881                                                 if (!callout_pending(&net->rxt_timer.timer)) {
5882                                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5883                                                 }
5884                                                 return (ENOMEM);
5885                                         }
5886                                         /* upate our MTU size */
5887                                         /* Do clear IP_DF ? */
5888                                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5889                                                 no_fragmentflg = 0;
5890                                         }
5891                                         mtu -= chk->send_size;
5892                                         r_mtu -= chk->send_size;
5893                                         data_list[bundle_at++] = chk;
5894                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5895                                                 mtu = 0;
5896                                                 break;
5897                                         }
5898                                         if (mtu <= 0) {
5899                                                 mtu = 0;
5900                                                 break;
5901                                         }
5902                                         if ((r_mtu <= 0) || one_chunk) {
5903                                                 r_mtu = 0;
5904                                                 break;
5905                                         }
5906                                 } else {
5907                                         /*
5908                                          * Must be sent in order of the TSN's
5909                                          * (on a network)
5910                                          */
5911 #ifdef SCTP_DEBUG
5912                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5913                                                 kprintf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5914                                                        chk->send_size, mtu, r_mtu);
5915                                         }
5916 #endif
5917
5918                                         break;
5919                                 }
5920                         }/* for () */
5921                 } /* if asoc.state OPEN */
5922                 /* Is there something to send for this destination? */
5923 #ifdef SCTP_DEBUG
5924                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5925                         kprintf("ok now is chain assembled? %p\n",
5926                                outchain);
5927                 }
5928 #endif
5929
5930                 if (outchain) {
5931                         /* We may need to start a control timer or two */
5932                         if (asconf) {
5933                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5934                                 asconf = 0;
5935                         }
5936                         if (cookie) {
5937                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5938                                 cookie = 0;
5939                         }
5940                         /* must start a send timer if data is being sent */
5941                         if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5942                                 /* no timer running on this destination
5943                                  * restart it.
5944                                  */
5945 #ifdef SCTP_DEBUG
5946                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5947                                         kprintf("ok lets start a send timer .. we will transmit %p\n",
5948                                                outchain);
5949                                 }
5950 #endif
5951                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5952                         }
5953                         /* Now send it, if there is anything to send :> */
5954                         if ((outchain->m_flags & M_PKTHDR) == 0) {
5955                                 struct mbuf *t;
5956
5957                                 MGETHDR(t, MB_DONTWAIT, MT_HEADER);
5958                                 if (t == NULL) {
5959                                         sctp_m_freem(outchain);
5960                                         return (ENOMEM);
5961                                 }
5962                                 t->m_next = outchain;
5963                                 t->m_pkthdr.len = 0;
5964                                 t->m_pkthdr.rcvif = 0;
5965                                 t->m_len = 0;
5966
5967                                 outchain = t;
5968                                 while (t) {
5969                                         outchain->m_pkthdr.len += t->m_len;
5970                                         t = t->m_next;
5971                                 }
5972                         }
5973                         if (outchain->m_len == 0) {
5974                                 /* Special case for when you get a 0 len
5975                                  * mbuf at the head due to the lack
5976                                  * of a MHDR at the beginning.
5977                                  */
5978                                 MH_ALIGN(outchain, sizeof(struct sctphdr));
5979                                 outchain->m_len = sizeof(struct sctphdr);
5980                         } else {
5981                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5982                                 if (outchain == NULL) {
5983                                         /* out of mbufs */
5984                                         error = ENOBUFS;
5985                                         goto errored_send;
5986                                 }
5987                         }
5988                         shdr = mtod(outchain, struct sctphdr *);
5989                         shdr->src_port = inp->sctp_lport;
5990                         shdr->dest_port = stcb->rport;
5991                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5992                         shdr->checksum = 0;
5993                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5994                                                                 (struct sockaddr *)&net->ro._l_addr,
5995                                                                 outchain,
5996                                                                 no_fragmentflg, bundle_at, data_list[0], asconf))) {
5997                                 /* error, we could not output */
5998                                 if (error == ENOBUFS) {
5999                                         asoc->ifp_had_enobuf = 1;
6000                                 }
6001                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6002                                 if (from_where == 0) {
6003                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
6004                                 }
6005
6006                         errored_send:
6007 #ifdef SCTP_DEBUG
6008                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6009                                         kprintf("Gak send error %d\n", error);
6010                                 }
6011 #endif
6012                                 if (hbflag) {
6013 #ifdef SCTP_DEBUG
6014                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6015                                                 kprintf("Update HB time anyway\n");
6016                                         }
6017 #endif
6018                                         if (*now_filled == 0) {
6019                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6020                                                 *now_filled = 1;
6021                                                 *now = net->last_sent_time;
6022                                         } else {
6023                                                 net->last_sent_time = *now;
6024                                         }
6025                                         hbflag = 0;
6026                                 }
6027                                 if (error == EHOSTUNREACH) {
6028                                         /*
6029                                          * Destination went unreachable during
6030                                          * this send
6031                                          */
6032 #ifdef SCTP_DEBUG
6033                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6034                                                 kprintf("Calling the movement routine\n");
6035                                         }
6036 #endif
6037                                         sctp_move_to_an_alt(stcb, asoc, net);
6038                                 }
6039                                 sctp_clean_up_ctl (asoc);
6040                                 return (error);
6041                         } else {
6042                                 asoc->ifp_had_enobuf = 0;
6043                         }
6044                         if (bundle_at || hbflag) {
6045                                 /* For data/asconf and hb set time */
6046                                 if (*now_filled == 0) {
6047                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6048                                         *now_filled = 1;
6049                                         *now = net->last_sent_time;
6050                                 } else {
6051                                         net->last_sent_time = *now;
6052                                 }
6053                         }
6054
6055                         if (!no_out_cnt) {
6056                                 *num_out += (ctl_cnt + bundle_at);
6057                         }
6058                         if (bundle_at) {
6059                                 if (!net->rto_pending) {
6060                                         /* setup for a RTO measurement */
6061                                         net->rto_pending = 1;
6062                                         data_list[0]->do_rtt = 1;
6063                                 } else {
6064                                         data_list[0]->do_rtt = 0;
6065                                 }
6066                                 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
6067                                 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
6068                         }
6069                         if (one_chunk) {
6070                                 break;
6071                         }
6072                 }
6073         }
6074         /* At the end there should be no NON timed
6075          * chunks hanging on this queue.
6076          */
6077         if ((*num_out == 0) && (*reason_code == 0)) {
6078                 *reason_code = 3;
6079         }
6080         sctp_clean_up_ctl (asoc);
6081         return (0);
6082 }
6083
6084 void
6085 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
6086 {
6087         /* Prepend a OPERATIONAL_ERROR chunk header
6088          * and put on the end of the control chunk queue.
6089          */
6090         /* Sender had better have gotten a MGETHDR or else
6091          * the control chunk will be forever skipped
6092          */
6093         struct sctp_chunkhdr *hdr;
6094         struct sctp_tmit_chunk *chk;
6095         struct mbuf *mat;
6096
6097         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6098         if (chk == NULL) {
6099                 /* no memory */
6100                 sctp_m_freem(op_err);
6101                 return;
6102         }
6103         sctppcbinfo.ipi_count_chunk++;
6104         sctppcbinfo.ipi_gencnt_chunk++;
6105         M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), MB_DONTWAIT);
6106         if (op_err == NULL) {
6107                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6108                 sctppcbinfo.ipi_count_chunk--;
6109                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6110                         panic("Chunk count is negative");
6111                 }
6112                 sctppcbinfo.ipi_gencnt_chunk++;
6113                 return;
6114         }
6115         chk->send_size = 0;
6116         mat = op_err;
6117         while (mat != NULL) {
6118                 chk->send_size += mat->m_len;
6119                 mat = mat->m_next;
6120         }
6121         chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6122         chk->sent = SCTP_DATAGRAM_UNSENT;
6123         chk->snd_count = 0;
6124         chk->flags = 0;
6125         chk->asoc = &stcb->asoc;
6126         chk->data = op_err;
6127         chk->whoTo = chk->asoc->primary_destination;
6128         chk->whoTo->ref_count++;
6129         hdr = mtod(op_err, struct sctp_chunkhdr *);
6130         hdr->chunk_type = SCTP_OPERATION_ERROR;
6131         hdr->chunk_flags = 0;
6132         hdr->chunk_length = htons(chk->send_size);
6133         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6134                           chk,
6135                           sctp_next);
6136         chk->asoc->ctrl_queue_cnt++;
6137 }
6138
6139 int
6140 sctp_send_cookie_echo(struct mbuf *m,
6141                       int offset,
6142                       struct sctp_tcb *stcb,
6143                       struct sctp_nets *net)
6144 {
6145         /*
6146          * pull out the cookie and put it at the front of the control
6147          * chunk queue.
6148          */
6149         int at;
6150         struct mbuf *cookie, *mat;
6151         struct sctp_paramhdr parm, *phdr;
6152         struct sctp_chunkhdr *hdr;
6153         struct sctp_tmit_chunk *chk;
6154         uint16_t ptype, plen;
6155         /* First find the cookie in the param area */
6156         cookie = NULL;
6157         at = offset + sizeof(struct sctp_init_chunk);
6158
6159         do {
6160                 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6161                 if (phdr == NULL) {
6162                         return (-3);
6163                 }
6164                 ptype = ntohs(phdr->param_type);
6165                 plen = ntohs(phdr->param_length);
6166                 if (ptype == SCTP_STATE_COOKIE) {
6167                         int pad;
6168                         /* found the cookie */
6169                         if ((pad = (plen % 4))) {
6170                                 plen += 4 - pad;
6171                         }
6172                         cookie = sctp_m_copym(m, at, plen, MB_DONTWAIT);
6173                         if (cookie == NULL) {
6174                                 /* No memory */
6175                                 return (-2);
6176                         }
6177                         break;
6178                 }
6179                 at += SCTP_SIZE32(plen);
6180         } while (phdr);
6181         if (cookie == NULL) {
6182                 /* Did not find the cookie */
6183                 return (-3);
6184         }
6185         /* ok, we got the cookie lets change it into a cookie echo chunk */
6186
6187         /* first the change from param to cookie */
6188         hdr = mtod(cookie, struct sctp_chunkhdr *);
6189         hdr->chunk_type = SCTP_COOKIE_ECHO;
6190         hdr->chunk_flags = 0;
6191         /* now we MUST have a PKTHDR on it */
6192         if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6193                 /* we hope this happens rarely */
6194                 MGETHDR(mat, MB_DONTWAIT, MT_HEADER);
6195                 if (mat == NULL) {
6196                         sctp_m_freem(cookie);
6197                         return (-4);
6198                 }
6199                 mat->m_len = 0;
6200                 mat->m_pkthdr.rcvif = 0;
6201                 mat->m_next = cookie;
6202                 cookie = mat;
6203         }
6204         cookie->m_pkthdr.len = plen;
6205         /* get the chunk stuff now and place it in the FRONT of the queue */
6206         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6207         if (chk == NULL) {
6208                 /* no memory */
6209                 sctp_m_freem(cookie);
6210                 return (-5);
6211         }
6212         sctppcbinfo.ipi_count_chunk++;
6213         sctppcbinfo.ipi_gencnt_chunk++;
6214         chk->send_size = cookie->m_pkthdr.len;
6215         chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6216         chk->sent = SCTP_DATAGRAM_UNSENT;
6217         chk->snd_count = 0;
6218         chk->flags = 0;
6219         chk->asoc = &stcb->asoc;
6220         chk->data = cookie;
6221         chk->whoTo = chk->asoc->primary_destination;
6222         chk->whoTo->ref_count++;
6223         TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6224         chk->asoc->ctrl_queue_cnt++;
6225         return (0);
6226 }
6227
6228 void
6229 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6230                         struct mbuf *m,
6231                         int offset,
6232                         int chk_length,
6233                         struct sctp_nets *net)
6234 {
6235         /* take a HB request and make it into a
6236          * HB ack and send it.
6237          */
6238         struct mbuf *outchain;
6239         struct sctp_chunkhdr *chdr;
6240         struct sctp_tmit_chunk *chk;
6241
6242
6243         if (net == NULL)
6244                 /* must have a net pointer */
6245                 return;
6246
6247         outchain = sctp_m_copym(m, offset, chk_length, MB_DONTWAIT);
6248         if (outchain == NULL) {
6249                 /* gak out of memory */
6250                 return;
6251         }
6252         chdr = mtod(outchain, struct sctp_chunkhdr *);
6253         chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6254         chdr->chunk_flags = 0;
6255         if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6256                 /* should not happen but we are cautious. */
6257                 struct mbuf *tmp;
6258                 MGETHDR(tmp, MB_DONTWAIT, MT_HEADER);
6259                 if (tmp == NULL) {
6260                         return;
6261                 }
6262                 tmp->m_len = 0;
6263                 tmp->m_pkthdr.rcvif = 0;
6264                 tmp->m_next = outchain;
6265                 outchain = tmp;
6266         }
6267         outchain->m_pkthdr.len = chk_length;
6268         if (chk_length % 4) {
6269                 /* need pad */
6270                 u_int32_t cpthis=0;
6271                 int padlen;
6272                 padlen = 4 - (outchain->m_pkthdr.len % 4);
6273                 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (caddr_t)&cpthis);
6274         }
6275         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6276         if (chk == NULL) {
6277                 /* no memory */
6278                 sctp_m_freem(outchain);
6279                 return ;
6280         }
6281         sctppcbinfo.ipi_count_chunk++;
6282         sctppcbinfo.ipi_gencnt_chunk++;
6283
6284         chk->send_size = chk_length;
6285         chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6286         chk->sent = SCTP_DATAGRAM_UNSENT;
6287         chk->snd_count = 0;
6288         chk->flags = 0;
6289         chk->asoc = &stcb->asoc;
6290         chk->data = outchain;
6291         chk->whoTo = net;
6292         chk->whoTo->ref_count++;
6293         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6294         chk->asoc->ctrl_queue_cnt++;
6295 }
6296
6297 int
6298 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6299         /* formulate and queue a cookie-ack back to sender */
6300         struct mbuf *cookie_ack;
6301         struct sctp_chunkhdr *hdr;
6302         struct sctp_tmit_chunk *chk;
6303
6304         cookie_ack = NULL;
6305         MGETHDR(cookie_ack, MB_DONTWAIT, MT_HEADER);
6306         if (cookie_ack == NULL) {
6307                 /* no mbuf's */
6308                 return (-1);
6309         }
6310         cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6311         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6312         if (chk == NULL) {
6313                 /* no memory */
6314                 sctp_m_freem(cookie_ack);
6315                 return (-1);
6316         }
6317         sctppcbinfo.ipi_count_chunk++;
6318         sctppcbinfo.ipi_gencnt_chunk++;
6319
6320         chk->send_size = sizeof(struct sctp_chunkhdr);
6321         chk->rec.chunk_id = SCTP_COOKIE_ACK;
6322         chk->sent = SCTP_DATAGRAM_UNSENT;
6323         chk->snd_count = 0;
6324         chk->flags = 0;
6325         chk->asoc = &stcb->asoc;
6326         chk->data = cookie_ack;
6327         if (chk->asoc->last_control_chunk_from != NULL) {
6328                 chk->whoTo = chk->asoc->last_control_chunk_from;
6329         } else {
6330                 chk->whoTo = chk->asoc->primary_destination;
6331         }
6332         chk->whoTo->ref_count++;
6333         hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6334         hdr->chunk_type = SCTP_COOKIE_ACK;
6335         hdr->chunk_flags = 0;
6336         hdr->chunk_length = htons(chk->send_size);
6337         cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6338         cookie_ack->m_pkthdr.rcvif = 0;
6339         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6340         chk->asoc->ctrl_queue_cnt++;
6341         return (0);
6342 }
6343
6344
6345 int
6346 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6347 {
6348         /* formulate and queue a SHUTDOWN-ACK back to the sender */
6349         struct mbuf *m_shutdown_ack;
6350         struct sctp_shutdown_ack_chunk *ack_cp;
6351         struct sctp_tmit_chunk *chk;
6352
6353         m_shutdown_ack = NULL;
6354         MGETHDR(m_shutdown_ack, MB_DONTWAIT, MT_HEADER);
6355         if (m_shutdown_ack == NULL) {
6356                 /* no mbuf's */
6357                 return (-1);
6358         }
6359         m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6360         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6361         if (chk == NULL) {
6362                 /* no memory */
6363                 sctp_m_freem(m_shutdown_ack);
6364                 return (-1);
6365         }
6366         sctppcbinfo.ipi_count_chunk++;
6367         sctppcbinfo.ipi_gencnt_chunk++;
6368
6369         chk->send_size = sizeof(struct sctp_chunkhdr);
6370         chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6371         chk->sent = SCTP_DATAGRAM_UNSENT;
6372         chk->snd_count = 0;
6373         chk->flags = 0;
6374         chk->asoc = &stcb->asoc;
6375         chk->data = m_shutdown_ack;
6376         chk->whoTo = net;
6377         net->ref_count++;
6378
6379         ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6380         ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6381         ack_cp->ch.chunk_flags = 0;
6382         ack_cp->ch.chunk_length = htons(chk->send_size);
6383         m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6384         m_shutdown_ack->m_pkthdr.rcvif = 0;
6385         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6386         chk->asoc->ctrl_queue_cnt++;
6387         return (0);
6388 }
6389
6390 int
6391 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6392 {
6393         /* formulate and queue a SHUTDOWN to the sender */
6394         struct mbuf *m_shutdown;
6395         struct sctp_shutdown_chunk *shutdown_cp;
6396         struct sctp_tmit_chunk *chk;
6397
6398         m_shutdown = NULL;
6399         MGETHDR(m_shutdown, MB_DONTWAIT, MT_HEADER);
6400         if (m_shutdown == NULL) {
6401                 /* no mbuf's */
6402                 return (-1);
6403         }
6404         m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6405         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6406         if (chk == NULL) {
6407                 /* no memory */
6408                 sctp_m_freem(m_shutdown);
6409                 return (-1);
6410         }
6411         sctppcbinfo.ipi_count_chunk++;
6412         sctppcbinfo.ipi_gencnt_chunk++;
6413
6414         chk->send_size = sizeof(struct sctp_shutdown_chunk);
6415         chk->rec.chunk_id = SCTP_SHUTDOWN;
6416         chk->sent = SCTP_DATAGRAM_UNSENT;
6417         chk->snd_count = 0;
6418         chk->flags = 0;
6419         chk->asoc = &stcb->asoc;
6420         chk->data = m_shutdown;
6421         chk->whoTo = net;
6422         net->ref_count++;
6423
6424         shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6425         shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6426         shutdown_cp->ch.chunk_flags = 0;
6427         shutdown_cp->ch.chunk_length = htons(chk->send_size);
6428         shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6429         m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6430         m_shutdown->m_pkthdr.rcvif = 0;
6431         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6432         chk->asoc->ctrl_queue_cnt++;
6433
6434         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6435             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6436                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
6437                 soisdisconnecting(stcb->sctp_ep->sctp_socket);
6438         }
6439         return (0);
6440 }
6441
6442 int
6443 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6444 {
6445         /*
6446          * formulate and queue an ASCONF to the peer
6447          * ASCONF parameters should be queued on the assoc queue
6448          */
6449         struct sctp_tmit_chunk *chk;
6450         struct mbuf *m_asconf;
6451
6452         /* compose an ASCONF chunk, maximum length is PMTU */
6453         m_asconf = sctp_compose_asconf(stcb);
6454         if (m_asconf == NULL) {
6455                 return (-1);
6456         }
6457         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6458         if (chk == NULL) {
6459                 /* no memory */
6460                 sctp_m_freem(m_asconf);
6461                 return (-1);
6462         }
6463         sctppcbinfo.ipi_count_chunk++;
6464         sctppcbinfo.ipi_gencnt_chunk++;
6465
6466         chk->data = m_asconf;
6467         chk->send_size = m_asconf->m_pkthdr.len;
6468         chk->rec.chunk_id = SCTP_ASCONF;
6469         chk->sent = SCTP_DATAGRAM_UNSENT;
6470         chk->snd_count = 0;
6471         chk->flags = 0;
6472         chk->asoc = &stcb->asoc;
6473         chk->whoTo = chk->asoc->primary_destination;
6474         chk->whoTo->ref_count++;
6475         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6476         chk->asoc->ctrl_queue_cnt++;
6477         return (0);
6478 }
6479
6480 int
6481 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6482 {
6483         /*
6484          * formulate and queue a asconf-ack back to sender
6485          * the asconf-ack must be stored in the tcb
6486          */
6487         struct sctp_tmit_chunk *chk;
6488         struct mbuf *m_ack;
6489
6490         /* is there a asconf-ack mbuf chain to send? */
6491         if (stcb->asoc.last_asconf_ack_sent == NULL) {
6492                 return (-1);
6493         }
6494
6495         /* copy the asconf_ack */
6496 #if defined(__FreeBSD__) || defined(__NetBSD__)
6497         /* Supposedly the m_copypacket is a optimzation,
6498          * use it if we can.
6499          */
6500         if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6501                 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, MB_DONTWAIT);
6502                 sctp_pegs[SCTP_CACHED_SRC]++;
6503         } else
6504                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6505 #else
6506                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6507 #endif
6508         if (m_ack == NULL) {
6509                 /* couldn't copy it */
6510
6511                 return (-1);
6512         }
6513         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6514         if (chk == NULL) {
6515                 /* no memory */
6516                 if (m_ack)
6517                         sctp_m_freem(m_ack);
6518                 return (-1);
6519         }
6520         sctppcbinfo.ipi_count_chunk++;
6521         sctppcbinfo.ipi_gencnt_chunk++;
6522
6523         /* figure out where it goes to */
6524         if (retrans) {
6525                 /* we're doing a retransmission */
6526                 if (stcb->asoc.used_alt_asconfack > 2) {
6527                         /* tried alternate nets already, go back */
6528                         chk->whoTo = NULL;
6529                 } else {
6530                         /* need to try and alternate net */
6531                         chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6532                         stcb->asoc.used_alt_asconfack++;
6533                 }
6534                 if (chk->whoTo == NULL) {
6535                         /* no alternate */
6536                         if (stcb->asoc.last_control_chunk_from == NULL)
6537                                 chk->whoTo = stcb->asoc.primary_destination;
6538                         else
6539                                 chk->whoTo = stcb->asoc.last_control_chunk_from;
6540                         stcb->asoc.used_alt_asconfack = 0;
6541                 }
6542         } else {
6543                 /* normal case */
6544                 if (stcb->asoc.last_control_chunk_from == NULL)
6545                         chk->whoTo = stcb->asoc.primary_destination;
6546                 else
6547                         chk->whoTo = stcb->asoc.last_control_chunk_from;
6548                 stcb->asoc.used_alt_asconfack = 0;
6549         }
6550         chk->data = m_ack;
6551         chk->send_size = m_ack->m_pkthdr.len;
6552         chk->rec.chunk_id = SCTP_ASCONF_ACK;
6553         chk->sent = SCTP_DATAGRAM_UNSENT;
6554         chk->snd_count = 0;
6555         chk->flags = 0;
6556         chk->asoc = &stcb->asoc;
6557         chk->whoTo->ref_count++;
6558         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6559         chk->asoc->ctrl_queue_cnt++;
6560         return (0);
6561 }
6562
6563
6564 static int
6565 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6566                           struct sctp_tcb *stcb,
6567                           struct sctp_association *asoc,
6568                           int *cnt_out, struct timeval *now, int *now_filled)
6569 {
6570         /*
6571          * send out one MTU of retransmission.
6572          * If fast_retransmit is happening we ignore the cwnd.
6573          * Otherwise we obey the cwnd and rwnd.
6574          * For a Cookie or Asconf in the control chunk queue we retransmit
6575          * them by themselves.
6576          *
6577          * For data chunks we will pick out the lowest TSN's in the
6578          * sent_queue marked for resend and bundle them all together
6579          * (up to a MTU of destination). The address to send to should
6580          * have been selected/changed where the retransmission was
6581          * marked (i.e. in FR or t3-timeout routines).
6582          */
6583         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6584         struct sctp_tmit_chunk *chk, *fwd;
6585         struct mbuf *m;
6586         struct sctphdr *shdr;
6587         int asconf;
6588         struct sctp_nets *net;
6589         int no_fragmentflg, bundle_at, cnt_thru;
6590         unsigned int mtu;
6591         int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6592
6593         tmr_started = ctl_cnt = bundle_at =  error = 0;
6594         no_fragmentflg = 1;
6595         asconf = 0;
6596         fwd_tsn = 0;
6597         *cnt_out = 0;
6598         fwd = NULL;
6599         m = NULL;
6600 #ifdef SCTP_AUDITING_ENABLED
6601         sctp_audit_log(0xC3, 1);
6602 #endif
6603         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6604 #ifdef SCTP_DEBUG
6605                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6606                         kprintf("SCTP hits empty queue with cnt set to %d?\n",
6607                                asoc->sent_queue_retran_cnt);
6608                 }
6609 #endif
6610                 asoc->sent_queue_cnt = 0;
6611                 asoc->sent_queue_cnt_removeable = 0;
6612         }
6613         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6614                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6615                         /* we only worry about things marked for resend */
6616                         continue;
6617                 }
6618                 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6619                     (chk->rec.chunk_id == SCTP_ASCONF) ||
6620                     (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6621                     (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6622                         if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6623                                 /* For stream reset we only retran the request
6624                                  * not the response.
6625                                  */
6626                                 struct sctp_stream_reset_req *strreq;
6627                                 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6628                                 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6629                                         continue;
6630                                 }
6631                         }
6632                         ctl_cnt++;
6633                         if (chk->rec.chunk_id == SCTP_ASCONF) {
6634                                 no_fragmentflg = 1;
6635                                 asconf = 1;
6636                         }
6637                         if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6638                                 fwd_tsn = 1;
6639                                 fwd = chk;
6640                         }
6641                         m = sctp_copy_mbufchain(chk->data, m);
6642                         break;
6643                 }
6644         }
6645         one_chunk = 0;
6646         cnt_thru = 0;
6647         /* do we have control chunks to retransmit? */
6648         if (m != NULL) {
6649                 /* Start a timer no matter if we suceed or fail */
6650                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6651                         sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6652                 } else if (chk->rec.chunk_id == SCTP_ASCONF)
6653                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6654
6655                 if (m->m_len == 0) {
6656                         /* Special case for when you get a 0 len
6657                          * mbuf at the head due to the lack
6658                          * of a MHDR at the beginning.
6659                          */
6660                         m->m_len = sizeof(struct sctphdr);
6661                 } else {
6662                         M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6663                         if (m == NULL) {
6664                                 return (ENOBUFS);
6665                         }
6666                 }
6667                 shdr = mtod(m, struct sctphdr *);
6668                 shdr->src_port = inp->sctp_lport;
6669                 shdr->dest_port = stcb->rport;
6670                 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6671                 shdr->checksum = 0;
6672                 chk->snd_count++;               /* update our count */
6673
6674                 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6675                     (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
6676                     no_fragmentflg, 0, NULL, asconf))) {
6677                         sctp_pegs[SCTP_DATA_OUT_ERR]++;
6678                         return (error);
6679                 }
6680                 /*
6681                  *We don't want to mark the net->sent time here since this
6682                  * we use this for HB and retrans cannot measure RTT
6683                  */
6684                 /*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6685                 *cnt_out += 1;
6686                 chk->sent = SCTP_DATAGRAM_SENT;
6687                 asoc->sent_queue_retran_cnt--;
6688                 if (asoc->sent_queue_retran_cnt < 0) {
6689                     asoc->sent_queue_retran_cnt = 0;
6690                 }
6691                 if (fwd_tsn == 0) {
6692                         return (0);
6693                 } else {
6694                         /* Clean up the fwd-tsn list */
6695                         sctp_clean_up_ctl (asoc);
6696                         return (0);
6697                 }
6698         }
6699         /* Ok, it is just data retransmission we need to do or
6700          * that and a fwd-tsn with it all.
6701          */
6702         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6703                 return (-1);
6704         }
6705 #ifdef SCTP_DEBUG
6706         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6707                 kprintf("Normal chunk retransmission cnt:%d\n",
6708                        asoc->sent_queue_retran_cnt);
6709         }
6710 #endif
6711         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6712             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6713                 /* not yet open, resend the cookie and that is it */
6714                 return (1);
6715         }
6716
6717
6718 #ifdef SCTP_AUDITING_ENABLED
6719         sctp_auditing(20, inp, stcb, NULL);
6720 #endif
6721         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6722                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6723                         /* No, not sent to this net or not ready for rtx */
6724                         continue;
6725
6726                 }
6727                 /* pick up the net */
6728                 net = chk->whoTo;
6729                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6730                         mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6731                 } else {
6732                         mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6733                 }
6734
6735                 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6736                         /* No room in peers rwnd */
6737                         uint32_t tsn;
6738                         tsn = asoc->last_acked_seq + 1;
6739                         if (tsn == chk->rec.data.TSN_seq) {
6740                                 /* we make a special exception for this case.
6741                                  * The peer has no rwnd but is missing the
6742                                  * lowest chunk.. which is probably what is
6743                                  * holding up the rwnd.
6744                                  */
6745                                 goto one_chunk_around;
6746                         }
6747 #ifdef SCTP_DEBUG
6748                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6749                                 kprintf("blocked-peers_rwnd:%d tf:%d\n",
6750                                        (int)asoc->peers_rwnd,
6751                                        (int)asoc->total_flight);
6752                         }
6753 #endif
6754                         sctp_pegs[SCTP_RWND_BLOCKED]++;
6755                         return (1);
6756                 }
6757         one_chunk_around:
6758                 if (asoc->peers_rwnd < mtu) {
6759                         one_chunk = 1;
6760                 }
6761 #ifdef SCTP_AUDITING_ENABLED
6762                 sctp_audit_log(0xC3, 2);
6763 #endif
6764                 bundle_at = 0;
6765                 m = NULL;
6766                 net->fast_retran_ip = 0;
6767                 if (chk->rec.data.doing_fast_retransmit == 0) {
6768                         /* if no FR in progress skip destination that
6769                          * have flight_size > cwnd.
6770                          */
6771                         if (net->flight_size >= net->cwnd) {
6772                                 sctp_pegs[SCTP_CWND_BLOCKED]++;
6773                                 continue;
6774                         }
6775                 } else {
6776                         /* Mark the destination net to have FR recovery
6777                          * limits put on it.
6778                          */
6779                         net->fast_retran_ip = 1;
6780                 }
6781
6782                 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6783                         /* ok we will add this one */
6784                         m = sctp_copy_mbufchain(chk->data, m);
6785                         if (m == NULL) {
6786                                 return (ENOMEM);
6787                         }
6788                         /* upate our MTU size */
6789                         /* Do clear IP_DF ? */
6790                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6791                                 no_fragmentflg = 0;
6792                         }
6793                         mtu -= chk->send_size;
6794                         data_list[bundle_at++] = chk;
6795                         if (one_chunk && (asoc->total_flight <= 0)) {
6796                                 sctp_pegs[SCTP_WINDOW_PROBES]++;
6797                                 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6798                         }
6799                 }
6800                 if (one_chunk == 0) {
6801                         /* now are there anymore forward from chk to pick up?*/
6802                         fwd = TAILQ_NEXT(chk, sctp_next);
6803                         while (fwd) {
6804                                 if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6805                                         /* Nope, not for retran */
6806                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6807                                         continue;
6808                                 }
6809                                 if (fwd->whoTo != net) {
6810                                         /* Nope, not the net in question */
6811                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6812                                         continue;
6813                                 }
6814                                 if (fwd->send_size <= mtu) {
6815                                         m = sctp_copy_mbufchain(fwd->data, m);
6816                                         if (m == NULL) {
6817                                                 return (ENOMEM);
6818                                         }
6819                                         /* upate our MTU size */
6820                                         /* Do clear IP_DF ? */
6821                                         if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6822                                                 no_fragmentflg = 0;
6823                                         }
6824                                         mtu -= fwd->send_size;
6825                                         data_list[bundle_at++] = fwd;
6826                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6827                                                 break;
6828                                         }
6829                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6830                                 } else {
6831                                         /* can't fit so we are done */
6832                                         break;
6833                                 }
6834                         }
6835                 }
6836                 /* Is there something to send for this destination? */
6837                 if (m) {
6838                         /* No matter if we fail/or suceed we should
6839                          * start a timer. A failure is like a lost
6840                          * IP packet :-)
6841                          */
6842                         if (!callout_pending(&net->rxt_timer.timer)) {
6843                                 /* no timer running on this destination
6844                                  * restart it.
6845                                  */
6846                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6847                                 tmr_started = 1;
6848                         }
6849                         if (m->m_len == 0) {
6850                                 /* Special case for when you get a 0 len
6851                                  * mbuf at the head due to the lack
6852                                  * of a MHDR at the beginning.
6853                                  */
6854                                 m->m_len = sizeof(struct sctphdr);
6855                         } else {
6856                                 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6857                                 if (m == NULL) {
6858                                         return (ENOBUFS);
6859                                 }
6860                         }
6861                         shdr = mtod(m, struct sctphdr *);
6862                         shdr->src_port = inp->sctp_lport;
6863                         shdr->dest_port = stcb->rport;
6864                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6865                         shdr->checksum = 0;
6866
6867                         /* Now lets send it, if there is anything to send :> */
6868                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6869                                                                (struct sockaddr *)&net->ro._l_addr,
6870                                                                m,
6871                                                                no_fragmentflg, 0, NULL, asconf))) {
6872                                 /* error, we could not output */
6873                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6874                                 return (error);
6875                         }
6876                         /* For HB's */
6877                         /*
6878                          * We don't want to mark the net->sent time here since
6879                          * this we use this for HB and retrans cannot measure
6880                          * RTT
6881                          */
6882                         /*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6883
6884                         /* For auto-close */
6885                         cnt_thru++;
6886                         if (*now_filled == 0) {
6887                                 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6888                                 *now = asoc->time_last_sent;
6889                                 *now_filled = 1;
6890                         } else {
6891                                 asoc->time_last_sent = *now;
6892                         }
6893                         *cnt_out += bundle_at;
6894 #ifdef SCTP_AUDITING_ENABLED
6895                         sctp_audit_log(0xC4, bundle_at);
6896 #endif
6897                         for (i = 0; i < bundle_at; i++) {
6898                                 sctp_pegs[SCTP_RETRANTSN_SENT]++;
6899                                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
6900                                 data_list[i]->snd_count++;
6901                                 asoc->sent_queue_retran_cnt--;
6902                                 /* record the time */
6903                                 data_list[i]->sent_rcv_time = asoc->time_last_sent;
6904                                 if (asoc->sent_queue_retran_cnt < 0) {
6905                                     asoc->sent_queue_retran_cnt = 0;
6906                                 }
6907                                 net->flight_size += data_list[i]->book_size;
6908                                 asoc->total_flight += data_list[i]->book_size;
6909                                 asoc->total_flight_count++;
6910
6911 #ifdef SCTP_LOG_RWND
6912                                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6913                                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6914 #endif
6915                                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6916                                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6917                                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6918                                         /* SWS sender side engages */
6919                                         asoc->peers_rwnd = 0;
6920                                 }
6921
6922                                 if ((i == 0) &&
6923                                     (data_list[i]->rec.data.doing_fast_retransmit)) {
6924                                         sctp_pegs[SCTP_FAST_RETRAN]++;
6925                                         if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6926                                             (tmr_started == 0)) {
6927                                                 /*
6928                                                  * ok we just fast-retrans'd
6929                                                  * the lowest TSN, i.e the
6930                                                  * first on the list. In this
6931                                                  * case we want to give some
6932                                                  * more time to get a SACK
6933                                                  * back without a t3-expiring.
6934                                                  */
6935                                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6936                                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6937                                         }
6938                                 }
6939                         }
6940 #ifdef SCTP_AUDITING_ENABLED
6941                         sctp_auditing(21, inp, stcb, NULL);
6942 #endif
6943                 } else {
6944                         /* None will fit */
6945                         return (1);
6946                 }
6947                 if (asoc->sent_queue_retran_cnt <= 0) {
6948                         /* all done we have no more to retran */
6949                         asoc->sent_queue_retran_cnt = 0;
6950                         break;
6951                 }
6952                 if (one_chunk) {
6953                         /* No more room in rwnd */
6954                         return (1);
6955                 }
6956                 /* stop the for loop here. we sent out a packet */
6957                 break;
6958         }
6959         return (0);
6960 }
6961
6962
6963 static int
6964 sctp_timer_validation(struct sctp_inpcb *inp,
6965                       struct sctp_tcb *stcb,
6966                       struct sctp_association *asoc,
6967                       int ret)
6968 {
6969         struct sctp_nets *net;
6970         /* Validate that a timer is running somewhere */
6971         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6972                 if (callout_pending(&net->rxt_timer.timer)) {
6973                         /* Here is a timer */
6974                         return (ret);
6975                 }
6976         }
6977         /* Gak, we did not have a timer somewhere */
6978 #ifdef SCTP_DEBUG
6979         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6980                 kprintf("Deadlock avoided starting timer on a dest at retran\n");
6981         }
6982 #endif
6983         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
6984         return (ret);
6985 }
6986
6987 int
6988 sctp_chunk_output(struct sctp_inpcb *inp,
6989                   struct sctp_tcb *stcb,
6990                   int from_where)
6991 {
6992         /* Ok this is the generic chunk service queue.
6993          * we must do the following:
6994          *  - See if there are retransmits pending, if so we
6995          *      must do these first and return.
6996          *  - Service the stream queue that is next,
6997          *    moving any message (note I must get a complete
6998          *    message i.e. FIRST/MIDDLE and LAST to the out
6999          *    queue in one pass) and assigning TSN's
7000          *  - Check to see if the cwnd/rwnd allows any output, if
7001          *      so we go ahead and fomulate and send the low level
7002          *    chunks. Making sure to combine any control in the
7003          *    control chunk queue also.
7004          */
7005         struct sctp_association *asoc;
7006         struct sctp_nets *net;
7007         int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
7008         struct timeval now;
7009         int now_filled=0;
7010         int cwnd_full=0;
7011         asoc = &stcb->asoc;
7012         tot_out = 0;
7013         num_out = 0;
7014         reason_code = 0;
7015         sctp_pegs[SCTP_CALLS_TO_CO]++;
7016 #ifdef SCTP_DEBUG
7017         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7018                 kprintf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
7019         }
7020 #endif
7021         while (asoc->sent_queue_retran_cnt) {
7022                 /* Ok, it is retransmission time only, we send out only ONE
7023                  * packet with a single call off to the retran code.
7024                  */
7025                 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
7026                 if (ret > 0) {
7027                         /* Can't send anymore */
7028 #ifdef SCTP_DEBUG
7029                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7030                                 kprintf("retransmission ret:%d -- full\n", ret);
7031                         }
7032 #endif
7033                         /*
7034                          * now lets push out control by calling med-level
7035                          * output once. this assures that we WILL send HB's
7036                          * if queued too.
7037                          */
7038                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
7039                                               &cwnd_full, from_where,
7040                                               &now, &now_filled);
7041 #ifdef SCTP_DEBUG
7042                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7043                                 kprintf("Control send outputs:%d@full\n", num_out);
7044                         }
7045 #endif
7046 #ifdef SCTP_AUDITING_ENABLED
7047                         sctp_auditing(8, inp, stcb, NULL);
7048 #endif
7049                         return (sctp_timer_validation(inp, stcb, asoc, ret));
7050                 }
7051                 if (ret < 0) {
7052                         /*
7053                          * The count was off.. retran is not happening so do
7054                          * the normal retransmission.
7055                          */
7056 #ifdef SCTP_DEBUG
7057                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7058                                 kprintf("Done with retrans, none left fill up window\n");
7059                         }
7060 #endif
7061 #ifdef SCTP_AUDITING_ENABLED
7062                         sctp_auditing(9, inp, stcb, NULL);
7063 #endif
7064                         break;
7065                 }
7066                 if (from_where == 1) {
7067                         /* Only one transmission allowed out of a timeout */
7068 #ifdef SCTP_DEBUG
7069                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7070                                 kprintf("Only one packet allowed out\n");
7071                         }
7072 #endif
7073 #ifdef SCTP_AUDITING_ENABLED
7074                         sctp_auditing(10, inp, stcb, NULL);
7075 #endif
7076                         /* Push out any control */
7077                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
7078                                               &now, &now_filled);
7079                         return (ret);
7080                 }
7081                 if ((num_out == 0) && (ret == 0)) {
7082                         /* No more retrans to send */
7083                         break;
7084                 }
7085         }
7086 #ifdef SCTP_AUDITING_ENABLED
7087         sctp_auditing(12, inp, stcb, NULL);
7088 #endif
7089         /* Check for bad destinations, if they exist move chunks around. */
7090         burst_limit = asoc->max_burst;
7091         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7092                 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
7093                     SCTP_ADDR_NOT_REACHABLE) {
7094                         /*
7095                          * if possible move things off of this address
7096                          * we still may send below due to the dormant state
7097                          * but we try to find an alternate address to send
7098                          * to and if we have one we move all queued data on
7099                          * the out wheel to this alternate address.
7100                          */
7101                         sctp_move_to_an_alt(stcb, asoc, net);
7102                 } else {
7103                         /*
7104                         if ((asoc->sat_network) || (net->addr_is_local)) {
7105                                 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7106                         }
7107                         */
7108 #ifdef SCTP_DEBUG
7109                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7110                                 kprintf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7111                         }
7112 #endif
7113
7114 #ifdef SCTP_USE_ALLMAN_BURST
7115                         if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7116                                 if (net->ssthresh < net->cwnd)
7117                                         net->ssthresh = net->cwnd;
7118                                 net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7119 #ifdef SCTP_LOG_MAXBURST
7120                                 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7121 #endif
7122                                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7123                         }
7124                         net->fast_retran_ip = 0;
7125 #endif
7126                 }
7127
7128         }
7129         /* Fill up what we can to the destination */
7130         burst_cnt = 0;
7131         cwnd_full = 0;
7132         do {
7133 #ifdef SCTP_DEBUG
7134                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7135                         kprintf("Burst count:%d - call m-c-o\n", burst_cnt);
7136                 }
7137 #endif
7138                 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7139                                               &reason_code, 0,  &cwnd_full, from_where,
7140                                               &now, &now_filled);
7141                 if (error) {
7142 #ifdef SCTP_DEBUG
7143                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7144                                 kprintf("Error %d was returned from med-c-op\n", error);
7145                         }
7146 #endif
7147 #ifdef SCTP_LOG_MAXBURST
7148                         sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7149 #endif
7150                         break;
7151                 }
7152 #ifdef SCTP_DEBUG
7153                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7154                         kprintf("m-c-o put out %d\n", num_out);
7155                 }
7156 #endif
7157                 tot_out += num_out;
7158                 burst_cnt++;
7159         } while (num_out
7160 #ifndef SCTP_USE_ALLMAN_BURST
7161                  &&  (burst_cnt < burst_limit)
7162 #endif
7163                 );
7164 #ifndef SCTP_USE_ALLMAN_BURST
7165         if (burst_cnt >= burst_limit) {
7166                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7167                 asoc->burst_limit_applied = 1;
7168 #ifdef SCTP_LOG_MAXBURST
7169                 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7170 #endif
7171         } else {
7172                 asoc->burst_limit_applied = 0;
7173         }
7174 #endif
7175
7176 #ifdef SCTP_DEBUG
7177         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7178                 kprintf("Ok, we have put out %d chunks\n", tot_out);
7179         }
7180 #endif
7181         if (tot_out == 0) {
7182                 sctp_pegs[SCTP_CO_NODATASNT]++;
7183                 if (asoc->stream_queue_cnt > 0) {
7184                         sctp_pegs[SCTP_SOS_NOSNT]++;
7185                 } else {
7186                         sctp_pegs[SCTP_NOS_NOSNT]++;
7187                 }
7188                 if (asoc->send_queue_cnt > 0) {
7189                         sctp_pegs[SCTP_SOSE_NOSNT]++;
7190                 } else {
7191                         sctp_pegs[SCTP_NOSE_NOSNT]++;
7192                 }
7193         }
7194         /* Now we need to clean up the control chunk chain if
7195          * a ECNE is on it. It must be marked as UNSENT again
7196          * so next call will continue to send it until
7197          * such time that we get a CWR, to remove it.
7198          */
7199         sctp_fix_ecn_echo(asoc);
7200         return (error);
7201 }
7202
7203
7204 int
7205 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, struct sockaddr *addr,
7206             struct mbuf *control, struct thread *p, int flags)
7207 {
7208         struct sctp_inpcb *t_inp;
7209         struct sctp_tcb *stcb;
7210         struct sctp_nets *net;
7211         struct sctp_association *asoc;
7212         int create_lock_applied = 0;
7213         int queue_only, error = 0;
7214         struct sctp_sndrcvinfo srcv;
7215         int un_sent = 0;
7216         int use_rcvinfo = 0;
7217         t_inp = inp;
7218         /*  struct route ro;*/
7219
7220         crit_enter();
7221         queue_only = 0;
7222         stcb = NULL;
7223         asoc = NULL;
7224         net = NULL;
7225
7226 #ifdef SCTP_DEBUG
7227         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7228                 kprintf("USR Send BEGINS\n");
7229         }
7230 #endif
7231
7232         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7233             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7234                 /* The listner can NOT send */
7235                 if (control) {
7236                         sctppcbinfo.mbuf_track--;
7237                         sctp_m_freem(control);
7238                         control = NULL;
7239                 }
7240                 sctp_m_freem(m);
7241                 crit_exit();
7242                 return (EFAULT);
7243         }
7244         /* Can't allow a V6 address on a non-v6 socket */
7245         if (addr) {
7246                 SCTP_ASOC_CREATE_LOCK(inp);
7247                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7248                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7249                         /* Should I really unlock ? */
7250                         SCTP_ASOC_CREATE_UNLOCK(inp);
7251                         if (control) {
7252                                 sctppcbinfo.mbuf_track--;
7253                                 sctp_m_freem(control);
7254                                 control = NULL;
7255                         }
7256                         sctp_m_freem(m);
7257                         crit_exit();
7258                         return (EFAULT);
7259                 }
7260                 create_lock_applied = 1;
7261                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7262                     (addr->sa_family == AF_INET6)) {
7263                         SCTP_ASOC_CREATE_UNLOCK(inp);
7264                         if (control) {
7265                                 sctppcbinfo.mbuf_track--;
7266                                 sctp_m_freem(control);
7267                                 control = NULL;
7268                         }
7269                         sctp_m_freem(m);
7270                         crit_exit();
7271                         return (EINVAL);
7272                 }
7273         }
7274         if (control) {
7275                 sctppcbinfo.mbuf_track++;
7276                 if (sctp_find_cmsg(SCTP_SNDRCV, &srcv, control,
7277                                    sizeof(srcv))) {
7278                         if (srcv.sinfo_flags & MSG_SENDALL) {
7279                                 /* its a sendall */
7280                                 sctppcbinfo.mbuf_track--;
7281                                 sctp_m_freem(control);
7282                                 crit_exit();
7283                                 if (create_lock_applied) {
7284                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7285                                         create_lock_applied = 0;
7286                                 }
7287                                 return (sctp_sendall(inp, NULL, m, &srcv));
7288                         }
7289                         if (srcv.sinfo_assoc_id) {
7290                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7291                                         SCTP_INP_RLOCK(inp);
7292                                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7293                                         if (stcb)
7294                                                 SCTP_TCB_LOCK(stcb);
7295                                         SCTP_INP_RUNLOCK(inp);
7296
7297                                         if (stcb == NULL) {
7298                                                 if (create_lock_applied) {
7299                                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7300                                                         create_lock_applied = 0;
7301                                                 }
7302                                                 sctppcbinfo.mbuf_track--;
7303                                                 sctp_m_freem(control);
7304                                                 sctp_m_freem(m);
7305                                                 crit_exit();
7306                                                 return (ENOTCONN);
7307                                         }
7308                                         net = stcb->asoc.primary_destination;
7309                                 } else {
7310                                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7311                                 }
7312                                 /*
7313                                  * Question: Should I error here if the
7314
7315                                  * assoc_id is no longer valid?
7316                                  * i.e. I can't find it?
7317                                  */
7318                                 if ((stcb) &&
7319                                     (addr != NULL)) {
7320                                         /* Must locate the net structure */
7321                                         if (addr)
7322                                                 net = sctp_findnet(stcb, addr);
7323                                 }
7324                                 if (net == NULL)
7325                                         net = stcb->asoc.primary_destination;
7326                         }
7327                         use_rcvinfo = 1;
7328                 }
7329         }
7330         if (stcb == NULL) {
7331                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7332                         SCTP_INP_RLOCK(inp);
7333                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7334                         if (stcb)
7335                                 SCTP_TCB_LOCK(stcb);
7336                         SCTP_INP_RUNLOCK(inp);
7337                         if (stcb == NULL) {
7338                                 crit_exit();
7339                                 if (create_lock_applied) {
7340                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7341                                         create_lock_applied = 0;
7342                                 }
7343                                 if (control) {
7344                                         sctppcbinfo.mbuf_track--;
7345                                         sctp_m_freem(control);
7346                                         control = NULL;
7347                                 }
7348                                 sctp_m_freem(m);
7349                                 return (ENOTCONN);
7350                         }
7351                         if (addr == NULL) {
7352                                 net = stcb->asoc.primary_destination;
7353                         } else {
7354                                 net = sctp_findnet(stcb, addr);
7355                                 if (net == NULL) {
7356                                         net = stcb->asoc.primary_destination;
7357                                 }
7358                         }
7359                 } else {
7360                         if (addr != NULL) {
7361                                 SCTP_INP_WLOCK(inp);
7362                                 SCTP_INP_INCR_REF(inp);
7363                                 SCTP_INP_WUNLOCK(inp);
7364                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7365                                 if (stcb == NULL) {
7366                                         SCTP_INP_WLOCK(inp);
7367                                         SCTP_INP_DECR_REF(inp);
7368                                         SCTP_INP_WUNLOCK(inp);
7369                                 }
7370                         }
7371                 }
7372         }
7373         if ((stcb == NULL) &&
7374             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7375                 if (control) {
7376                         sctppcbinfo.mbuf_track--;
7377                         sctp_m_freem(control);
7378                         control = NULL;
7379                 }
7380                 if (create_lock_applied) {
7381                         SCTP_ASOC_CREATE_UNLOCK(inp);
7382                         create_lock_applied = 0;
7383                 }
7384                 sctp_m_freem(m);
7385                 crit_exit();
7386                 return (ENOTCONN);
7387         } else if ((stcb == NULL) &&
7388                    (addr == NULL)) {
7389                 if (control) {
7390                         sctppcbinfo.mbuf_track--;
7391                         sctp_m_freem(control);
7392                         control = NULL;
7393                 }
7394                 if (create_lock_applied) {
7395                         SCTP_ASOC_CREATE_UNLOCK(inp);
7396                         create_lock_applied = 0;
7397                 }
7398                 sctp_m_freem(m);
7399                 crit_exit();
7400                 return (ENOENT);
7401         } else if (stcb == NULL) {
7402                 /* UDP mode, we must go ahead and start the INIT process */
7403                 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7404                         /* Strange user to do this */
7405                         if (control) {
7406                                 sctppcbinfo.mbuf_track--;
7407                                 sctp_m_freem(control);
7408                                 control = NULL;
7409                         }
7410                         if (create_lock_applied) {
7411                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7412                                 create_lock_applied = 0;
7413                         }
7414                         sctp_m_freem(m);
7415                         crit_exit();
7416                         return (ENOENT);
7417                 }
7418                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7419                 if (stcb == NULL) {
7420                         if (control) {
7421                                 sctppcbinfo.mbuf_track--;
7422                                 sctp_m_freem(control);
7423                                 control = NULL;
7424                         }
7425                         if (create_lock_applied) {
7426                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7427                                 create_lock_applied = 0;
7428                         }
7429                         sctp_m_freem(m);
7430                         crit_exit();
7431                         return (error);
7432                 }
7433                 if (create_lock_applied) {
7434                         SCTP_ASOC_CREATE_UNLOCK(inp);
7435                         create_lock_applied = 0;
7436                 } else {
7437                         kprintf("Huh-1, create lock should have been applied!\n");
7438                 }
7439                 queue_only = 1;
7440                 asoc = &stcb->asoc;
7441                 asoc->state = SCTP_STATE_COOKIE_WAIT;
7442                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7443                 if (control) {
7444                         /* see if a init structure exists in cmsg headers */
7445                         struct sctp_initmsg initm;
7446                         int i;
7447                         if (sctp_find_cmsg(SCTP_INIT, &initm, control,
7448                                            sizeof(initm))) {
7449                                 /* we have an INIT override of the default */
7450                                 if (initm.sinit_max_attempts)
7451                                         asoc->max_init_times = initm.sinit_max_attempts;
7452                                 if (initm.sinit_num_ostreams)
7453                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
7454                                 if (initm.sinit_max_instreams)
7455                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
7456                                 if (initm.sinit_max_init_timeo)
7457                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7458                         }
7459                         if (asoc->streamoutcnt < asoc->pre_open_streams) {
7460                                 /* Default is NOT correct */
7461 #ifdef SCTP_DEBUG
7462                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7463                                         kprintf("Ok, defout:%d pre_open:%d\n",
7464                                                asoc->streamoutcnt, asoc->pre_open_streams);
7465                                 }
7466 #endif
7467                                 kfree(asoc->strmout, M_PCB);
7468                                 asoc->strmout = NULL;
7469                                 asoc->streamoutcnt = asoc->pre_open_streams;
7470                                 asoc->strmout = kmalloc(asoc->streamoutcnt * sizeof(struct sctp_stream_out),
7471                                                         M_PCB, M_WAITOK);
7472                                 for (i = 0; i < asoc->streamoutcnt; i++) {
7473                                         /*
7474                                          * inbound side must be set to 0xffff,
7475                                          * also NOTE when we get the INIT-ACK
7476                                          * back (for INIT sender) we MUST
7477                                          * reduce the count (streamoutcnt) but
7478                                          * first check if we sent to any of the
7479                                          * upper streams that were dropped (if
7480                                          * some were). Those that were dropped
7481                                          * must be notified to the upper layer
7482                                          * as failed to send.
7483                                          */
7484                                         asoc->strmout[i].next_sequence_sent = 0x0;
7485                                         TAILQ_INIT(&asoc->strmout[i].outqueue);
7486                                         asoc->strmout[i].stream_no = i;
7487                                         asoc->strmout[i].next_spoke.tqe_next = 0;
7488                                         asoc->strmout[i].next_spoke.tqe_prev = 0;
7489                                 }
7490                         }
7491                 }
7492                 sctp_send_initiate(inp, stcb);
7493                 /*
7494                  * we may want to dig in after this call and adjust the MTU
7495                  * value. It defaulted to 1500 (constant) but the ro structure
7496                  * may now have an update and thus we may need to change it
7497                  * BEFORE we append the message.
7498                  */
7499                 net = stcb->asoc.primary_destination;
7500         } else {
7501                 if (create_lock_applied) {
7502                         SCTP_ASOC_CREATE_UNLOCK(inp);
7503                         create_lock_applied = 0;
7504                 }
7505                 asoc = &stcb->asoc;
7506                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7507                     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7508                         queue_only = 1;
7509                 }
7510                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7511                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7512                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7513                     (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7514                         if (control) {
7515                                 sctppcbinfo.mbuf_track--;
7516                                 sctp_m_freem(control);
7517                                 control = NULL;
7518                         }
7519                         if ((use_rcvinfo) &&
7520                             (srcv.sinfo_flags & MSG_ABORT)) {
7521                                 sctp_msg_append(stcb, net, m, &srcv, flags);
7522                                 error = 0;
7523                         } else {
7524                                 if (m)
7525                                         sctp_m_freem(m);
7526                                 error = ECONNRESET;
7527                         }
7528                         crit_exit();
7529                         SCTP_TCB_UNLOCK(stcb);
7530                         return (error);
7531                 }
7532         }
7533         if (create_lock_applied) {
7534                 /* we should never hit here with the create lock applied
7535                  *
7536                  */
7537                 SCTP_ASOC_CREATE_UNLOCK(inp);
7538                 create_lock_applied = 0;
7539         }
7540
7541
7542         if (use_rcvinfo == 0) {
7543                 srcv = stcb->asoc.def_send;
7544         }
7545 #ifdef SCTP_DEBUG
7546         else {
7547                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7548                         kprintf("stream:%d\n", srcv.sinfo_stream);
7549                         kprintf("flags:%x\n", (u_int)srcv.sinfo_flags);
7550                         kprintf("ppid:%d\n", srcv.sinfo_ppid);
7551                         kprintf("context:%d\n", srcv.sinfo_context);
7552                 }
7553         }
7554 #endif
7555         if (control) {
7556                 sctppcbinfo.mbuf_track--;
7557                 sctp_m_freem(control);
7558                 control = NULL;
7559         }
7560         if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7561                 /* we take the override or the unconfirmed */
7562                 ;
7563         } else {
7564                 net = stcb->asoc.primary_destination;
7565         }
7566         if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7567                 SCTP_TCB_UNLOCK(stcb);
7568                 crit_exit();
7569                 return (error);
7570         }
7571         if (net->flight_size > net->cwnd) {
7572                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7573                 queue_only = 1;
7574         } else if (asoc->ifp_had_enobuf) {
7575                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7576                 queue_only = 1;
7577         } else {
7578                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7579                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7580                            SCTP_MED_OVERHEAD);
7581
7582                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7583                     (stcb->asoc.total_flight > 0) &&
7584                     (un_sent < (int)stcb->asoc.smallest_mtu)
7585                         ) {
7586
7587                         /* Ok, Nagle is set on and we have
7588                          * data outstanding. Don't send anything
7589                          * and let the SACK drive out the data.
7590                          */
7591                         sctp_pegs[SCTP_NAGLE_NOQ]++;
7592                         queue_only = 1;
7593                 } else {
7594                         sctp_pegs[SCTP_NAGLE_OFF]++;
7595                 }
7596         }
7597         if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7598                 /* we can attempt to send too.*/
7599 #ifdef SCTP_DEBUG
7600                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7601                         kprintf("USR Send calls sctp_chunk_output\n");
7602                 }
7603 #endif
7604 #ifdef SCTP_AUDITING_ENABLED
7605                 sctp_audit_log(0xC0, 1);
7606                 sctp_auditing(6, inp, stcb, net);
7607 #endif
7608                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7609                 sctp_chunk_output(inp, stcb, 0);
7610 #ifdef SCTP_AUDITING_ENABLED
7611                 sctp_audit_log(0xC0, 2);
7612                 sctp_auditing(7, inp, stcb, net);
7613 #endif
7614
7615         }
7616 #ifdef SCTP_DEBUG
7617         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7618                 kprintf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7619         }
7620 #endif
7621         SCTP_TCB_UNLOCK(stcb);
7622         crit_exit();
7623         return (0);
7624 }
7625
7626 void
7627 send_forward_tsn(struct sctp_tcb *stcb,
7628                  struct sctp_association *asoc)
7629 {
7630         struct sctp_tmit_chunk *chk;
7631         struct sctp_forward_tsn_chunk *fwdtsn;
7632
7633         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7634                 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7635                         /* mark it to unsent */
7636                         chk->sent = SCTP_DATAGRAM_UNSENT;
7637                         chk->snd_count = 0;
7638                         /* Do we correct its output location? */
7639                         if (chk->whoTo != asoc->primary_destination) {
7640                                 sctp_free_remote_addr(chk->whoTo);
7641                                 chk->whoTo = asoc->primary_destination;
7642                                 chk->whoTo->ref_count++;
7643                         }
7644                         goto sctp_fill_in_rest;
7645                 }
7646         }
7647         /* Ok if we reach here we must build one */
7648         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7649         if (chk == NULL) {
7650                 return;
7651         }
7652         sctppcbinfo.ipi_count_chunk++;
7653         sctppcbinfo.ipi_gencnt_chunk++;
7654         chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7655         chk->asoc = asoc;
7656         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
7657         if (chk->data == NULL) {
7658                 chk->whoTo->ref_count--;
7659                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7660                 sctppcbinfo.ipi_count_chunk--;
7661                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7662                         panic("Chunk count is negative");
7663                 }
7664                 sctppcbinfo.ipi_gencnt_chunk++;
7665                 return;
7666         }
7667         chk->data->m_data += SCTP_MIN_OVERHEAD;
7668         chk->sent = SCTP_DATAGRAM_UNSENT;
7669         chk->snd_count = 0;
7670         chk->whoTo = asoc->primary_destination;
7671         chk->whoTo->ref_count++;
7672         TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7673         asoc->ctrl_queue_cnt++;
7674  sctp_fill_in_rest:
7675         /* Here we go through and fill out the part that
7676          * deals with stream/seq of the ones we skip.
7677          */
7678         chk->data->m_pkthdr.len = chk->data->m_len = 0;
7679         {
7680                 struct sctp_tmit_chunk *at, *tp1, *last;
7681                 struct sctp_strseq *strseq;
7682                 unsigned int cnt_of_space, i, ovh;
7683                 unsigned int space_needed;
7684                 unsigned int cnt_of_skipped = 0;
7685                 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7686                         if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7687                                 /* no more to look at */
7688                                 break;
7689                         }
7690                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7691                                 /* We don't report these */
7692                                 continue;
7693                         }
7694                         cnt_of_skipped++;
7695                 }
7696                 space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7697                                 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7698                 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7699                     ((chk->data->m_flags & M_EXT) == 0)) {
7700                         /* Need a M_EXT, get one and move
7701                          * fwdtsn to data area.
7702                          */
7703                         MCLGET(chk->data, MB_DONTWAIT);
7704                 }
7705                 cnt_of_space = M_TRAILINGSPACE(chk->data);
7706
7707                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7708                         ovh = SCTP_MIN_OVERHEAD;
7709                 } else {
7710                         ovh = SCTP_MIN_V4_OVERHEAD;
7711                 }
7712                 if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7713                         /* trim to a mtu size */
7714                         cnt_of_space = asoc->smallest_mtu - ovh;
7715                 }
7716                 if (cnt_of_space < space_needed) {
7717                         /* ok we must trim down the chunk by lowering
7718                          * the advance peer ack point.
7719                          */
7720                         cnt_of_skipped = (cnt_of_space-
7721                                           ((sizeof(struct sctp_forward_tsn_chunk))/
7722                                             sizeof(struct sctp_strseq)));
7723                         /* Go through and find the TSN that
7724                          * will be the one we report.
7725                          */
7726                         at = TAILQ_FIRST(&asoc->sent_queue);
7727                         for (i = 0; i < cnt_of_skipped; i++) {
7728                                 tp1 = TAILQ_NEXT(at, sctp_next);
7729                                 at = tp1;
7730                         }
7731                         last = at;
7732                         /* last now points to last one I can report, update peer ack point */
7733                         asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7734                         space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7735                 }
7736                 chk->send_size = space_needed;
7737                 /* Setup the chunk */
7738                 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7739                 fwdtsn->ch.chunk_length = htons(chk->send_size);
7740                 fwdtsn->ch.chunk_flags = 0;
7741                 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7742                 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7743                 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7744                                   (cnt_of_skipped * sizeof(struct sctp_strseq)));
7745                 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7746                 fwdtsn++;
7747                 /* Move pointer to after the fwdtsn and transfer to
7748                  * the strseq pointer.
7749                  */
7750                 strseq = (struct sctp_strseq *)fwdtsn;
7751                 /*
7752                  * Now populate the strseq list. This is done blindly
7753                  * without pulling out duplicate stream info. This is
7754                  * inefficent but won't harm the process since the peer
7755                  * will look at these in sequence and will thus release
7756                  * anything. It could mean we exceed the PMTU and chop
7757                  * off some that we could have included.. but this is
7758                  * unlikely (aka 1432/4 would mean 300+ stream seq's would
7759                  * have to be reported in one FWD-TSN. With a bit of work
7760                  * we can later FIX this to optimize and pull out duplcates..
7761                  * but it does add more overhead. So for now... not!
7762                  */
7763                 at = TAILQ_FIRST(&asoc->sent_queue);
7764                 for (i = 0; i < cnt_of_skipped; i++) {
7765                         tp1 = TAILQ_NEXT(at, sctp_next);
7766                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7767                                 /* We don't report these */
7768                                 i--;
7769                                 at = tp1;
7770                                 continue;
7771                         }
7772                         strseq->stream = ntohs(at->rec.data.stream_number);
7773                         strseq->sequence = ntohs(at->rec.data.stream_seq);
7774                         strseq++;
7775                         at = tp1;
7776                 }
7777         }
7778         return;
7779
7780 }
7781
7782 void
7783 sctp_send_sack(struct sctp_tcb *stcb)
7784 {
7785         /*
7786          * Queue up a SACK in the control queue. We must first check to
7787          * see if a SACK is somehow on the control queue. If so, we will
7788          * take and and remove the old one.
7789          */
7790         struct sctp_association *asoc;
7791         struct sctp_tmit_chunk *chk, *a_chk;
7792         struct sctp_sack_chunk *sack;
7793         struct sctp_gap_ack_block *gap_descriptor;
7794         uint32_t *dup;
7795         int start;
7796         unsigned int i, maxi, seeing_ones, m_size;
7797         unsigned int num_gap_blocks, space;
7798
7799         start = maxi = 0;
7800         seeing_ones = 1;
7801         a_chk = NULL;
7802         asoc = &stcb->asoc;
7803         if (asoc->last_data_chunk_from == NULL) {
7804                 /* Hmm we never received anything */
7805                 return;
7806         }
7807         sctp_set_rwnd(stcb, asoc);
7808         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7809                 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7810                         /* Hmm, found a sack already on queue, remove it */
7811                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7812                         asoc->ctrl_queue_cnt++;
7813                         a_chk = chk;
7814                         if (a_chk->data)
7815                                 sctp_m_freem(a_chk->data);
7816                         a_chk->data = NULL;
7817                         sctp_free_remote_addr(a_chk->whoTo);
7818                         a_chk->whoTo = NULL;
7819                         break;
7820                 }
7821         }
7822         if (a_chk == NULL) {
7823                 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7824                 if (a_chk == NULL) {
7825                         /* No memory so we drop the idea, and set a timer */
7826                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7827                                         stcb->sctp_ep, stcb, NULL);
7828                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7829                                          stcb->sctp_ep, stcb, NULL);
7830                         return;
7831                 }
7832                 sctppcbinfo.ipi_count_chunk++;
7833                 sctppcbinfo.ipi_gencnt_chunk++;
7834                 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7835         }
7836         a_chk->asoc = asoc;
7837         a_chk->snd_count = 0;
7838         a_chk->send_size = 0;   /* fill in later */
7839         a_chk->sent = SCTP_DATAGRAM_UNSENT;
7840         m_size = (asoc->mapping_array_size << 3);
7841
7842         if ((asoc->numduptsns) ||
7843             (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7844                 ) {
7845                 /* Ok, we have some duplicates or the destination for the
7846                  * sack is unreachable, lets see if we can select an alternate
7847                  * than asoc->last_data_chunk_from
7848                  */
7849                 if ((!(asoc->last_data_chunk_from->dest_state &
7850                       SCTP_ADDR_NOT_REACHABLE)) &&
7851                     (asoc->used_alt_onsack > 2)) {
7852                         /* We used an alt last time, don't this time */
7853                         a_chk->whoTo = NULL;
7854                 } else {
7855                         asoc->used_alt_onsack++;
7856                         a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7857                 }
7858                 if (a_chk->whoTo == NULL) {
7859                         /* Nope, no alternate */
7860                         a_chk->whoTo = asoc->last_data_chunk_from;
7861                         asoc->used_alt_onsack = 0;
7862                 }
7863         } else {
7864                 /* No duplicates so we use the last
7865                  * place we received data from.
7866                  */
7867 #ifdef SCTP_DEBUG
7868                 if (asoc->last_data_chunk_from == NULL) {
7869                         kprintf("Huh, last_data_chunk_from is null when we want to sack??\n");
7870                 }
7871 #endif
7872                 asoc->used_alt_onsack = 0;
7873                 a_chk->whoTo = asoc->last_data_chunk_from;
7874         }
7875         if (a_chk->whoTo)
7876                 a_chk->whoTo->ref_count++;
7877
7878         /* Ok now lets formulate a MBUF with our sack */
7879         MGETHDR(a_chk->data, MB_DONTWAIT, MT_DATA);
7880         if ((a_chk->data == NULL) ||
7881             (a_chk->whoTo == NULL)) {
7882                 /* rats, no mbuf memory */
7883                 if (a_chk->data) {
7884                         /* was a problem with the destination */
7885                         sctp_m_freem(a_chk->data);
7886                         a_chk->data = NULL;
7887                 }
7888                 a_chk->whoTo->ref_count--;
7889                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7890                 sctppcbinfo.ipi_count_chunk--;
7891                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7892                         panic("Chunk count is negative");
7893                 }
7894                 sctppcbinfo.ipi_gencnt_chunk++;
7895                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7896                                 stcb->sctp_ep, stcb, NULL);
7897                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7898                                  stcb->sctp_ep, stcb, NULL);
7899                 return;
7900         }
7901         /* First count the number of gap ack blocks we need */
7902         if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7903                 /* We know if there are none above the cum-ack we
7904                  * have everything with NO gaps
7905                  */
7906                 num_gap_blocks = 0;
7907         } else {
7908                 /* Ok we must count how many gaps we
7909                  * have.
7910                  */
7911                 num_gap_blocks = 0;
7912                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7913                         maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7914                 } else {
7915                         maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7916                 }
7917                 if (maxi > m_size) {
7918                         /* impossible but who knows, someone is playing with us  :> */
7919 #ifdef SCTP_DEBUG
7920                         kprintf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7921                                maxi,
7922                                m_size,
7923                                asoc->highest_tsn_inside_map,
7924                                asoc->mapping_array_base_tsn,
7925                                asoc->cumulative_tsn
7926                                );
7927 #endif
7928                         num_gap_blocks = 0;
7929                         goto no_gaps_now;
7930                 }
7931                 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7932                         start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7933                 } else {
7934                         /* Set it so we start at 0 */
7935                         start = -1;
7936                 }
7937                 /* Ok move start up one to look at the NEXT past the cum-ack */
7938                 start++;
7939                 for (i = start; i <= maxi; i++) {
7940                         if (seeing_ones) {
7941                                 /* while seeing ones I must
7942                                  * transition back to 0 before
7943                                  * finding the next gap and
7944                                  * counting the segment.
7945                                  */
7946                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7947                                         seeing_ones = 0;
7948                                 }
7949                         } else {
7950                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7951                                         seeing_ones = 1;
7952                                         num_gap_blocks++;
7953                                 }
7954                         }
7955                 }
7956         no_gaps_now:
7957                 if (num_gap_blocks == 0) {
7958                         /*
7959                          * Traveled all of the bits and NO one,
7960                          * must have reneged
7961                          */
7962                         if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
7963                            asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
7964 #ifdef SCTP_MAP_LOGGING
7965                            sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
7966 #endif
7967                         }
7968                 }
7969         }
7970
7971         /* Now calculate the space needed */
7972         space = (sizeof(struct sctp_sack_chunk) +
7973                  (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7974                  (asoc->numduptsns * sizeof(int32_t))
7975                 );
7976         if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
7977                 /* Reduce the size of the sack to fit */
7978                 int calc, fit;
7979                 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
7980                 calc -= sizeof(struct sctp_gap_ack_block);
7981                 fit = calc/sizeof(struct sctp_gap_ack_block);
7982                 if (fit > (int)num_gap_blocks) {
7983                         /* discard some dups */
7984                         asoc->numduptsns = (fit - num_gap_blocks);
7985                 } else {
7986                         /* discard all dups and some gaps */
7987                         num_gap_blocks = fit;
7988                         asoc->numduptsns = 0;
7989                 }
7990                 /* recalc space */
7991                 space = (sizeof(struct sctp_sack_chunk) +
7992                          (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7993                          (asoc->numduptsns * sizeof(int32_t))
7994                         );
7995
7996         }
7997
7998         if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
7999                 /* We need a cluster */
8000                 MCLGET(a_chk->data, MB_DONTWAIT);
8001                 if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
8002                         /* can't get a cluster
8003                          * give up and try later.
8004                          */
8005                         if (a_chk->data)
8006                                 sctp_m_freem(a_chk->data);
8007                         a_chk->data = NULL;
8008                         a_chk->whoTo->ref_count--;
8009                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
8010                         sctppcbinfo.ipi_count_chunk--;
8011                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8012                                 panic("Chunk count is negative");
8013                         }
8014                         sctppcbinfo.ipi_gencnt_chunk++;
8015                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
8016                                         stcb->sctp_ep, stcb, NULL);
8017                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
8018                                          stcb->sctp_ep, stcb, NULL);
8019                         return;
8020                 }
8021         }
8022
8023         /* ok, lets go through and fill it in */
8024         a_chk->data->m_data += SCTP_MIN_OVERHEAD;
8025         sack = mtod(a_chk->data, struct sctp_sack_chunk *);
8026         sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
8027         sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
8028         sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
8029         sack->sack.a_rwnd = htonl(asoc->my_rwnd);
8030         asoc->my_last_reported_rwnd = asoc->my_rwnd;
8031         sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
8032         sack->sack.num_dup_tsns = htons(asoc->numduptsns);
8033
8034         a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
8035                             (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8036                             (asoc->numduptsns * sizeof(int32_t)));
8037         a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
8038         sack->ch.chunk_length = htons(a_chk->send_size);
8039
8040         gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
8041         seeing_ones = 0;
8042         for (i = start; i <= maxi; i++) {
8043                 if (num_gap_blocks == 0) {
8044                         break;
8045                 }
8046                 if (seeing_ones) {
8047                         /* while seeing Ones I must
8048                          * transition back to 0 before
8049                          * finding the next gap
8050                          */
8051                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
8052                                 gap_descriptor->end = htons(((uint16_t)(i-start)));
8053                                 gap_descriptor++;
8054                                 seeing_ones = 0;
8055                                 num_gap_blocks--;
8056                         }
8057                 } else {
8058                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
8059                                 gap_descriptor->start = htons(((uint16_t)(i+1-start)));
8060                                 /* advance struct to next pointer */
8061                                 seeing_ones = 1;
8062                         }
8063                 }
8064         }
8065         if (num_gap_blocks) {
8066                 /* special case where the array is all 1's
8067                  * to the end of the array.
8068                  */
8069                 gap_descriptor->end = htons(((uint16_t)((i-start))));
8070                 gap_descriptor++;
8071         }
8072         /* now we must add any dups we are going to report. */
8073         if (asoc->numduptsns) {
8074                 dup = (uint32_t *)gap_descriptor;
8075                 for (i = 0; i < asoc->numduptsns; i++) {
8076                         *dup = htonl(asoc->dup_tsns[i]);
8077                         dup++;
8078                 }
8079                 asoc->numduptsns = 0;
8080         }
8081         /* now that the chunk is prepared queue it to the control
8082          * chunk queue.
8083          */
8084         TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
8085         asoc->ctrl_queue_cnt++;
8086         sctp_pegs[SCTP_PEG_SACKS_SENT]++;
8087         return;
8088 }
8089
8090 void
8091 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
8092 {
8093         struct mbuf *m_abort;
8094         struct sctp_abort_msg *abort_m;
8095         int sz;
8096         abort_m = NULL;
8097         MGETHDR(m_abort, MB_DONTWAIT, MT_HEADER);
8098         if (m_abort == NULL) {
8099                 /* no mbuf's */
8100                 return;
8101         }
8102         m_abort->m_data += SCTP_MIN_OVERHEAD;
8103         abort_m = mtod(m_abort, struct sctp_abort_msg *);
8104         m_abort->m_len = sizeof(struct sctp_abort_msg);
8105         m_abort->m_next = operr;
8106         sz = 0;
8107         if (operr) {
8108                 struct mbuf *n;
8109                 n = operr;
8110                 while (n) {
8111                         sz += n->m_len;
8112                         n = n->m_next;
8113                 }
8114         }
8115         abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8116         abort_m->msg.ch.chunk_flags = 0;
8117         abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8118                                              sz);
8119         abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8120         abort_m->sh.dest_port = stcb->rport;
8121         abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8122         abort_m->sh.checksum = 0;
8123         m_abort->m_pkthdr.len = m_abort->m_len + sz;
8124         m_abort->m_pkthdr.rcvif = 0;
8125         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8126             stcb->asoc.primary_destination,
8127             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
8128             m_abort, 1, 0, NULL, 0);
8129 }
8130
8131 int
8132 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8133                             struct sctp_nets *net)
8134
8135 {
8136         /* formulate and SEND a SHUTDOWN-COMPLETE */
8137         struct mbuf *m_shutdown_comp;
8138         struct sctp_shutdown_complete_msg *comp_cp;
8139
8140         m_shutdown_comp = NULL;
8141         MGETHDR(m_shutdown_comp, MB_DONTWAIT, MT_HEADER);
8142         if (m_shutdown_comp == NULL) {
8143                 /* no mbuf's */
8144                 return (-1);
8145         }
8146         m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8147         comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8148         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8149         comp_cp->shut_cmp.ch.chunk_flags = 0;
8150         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8151         comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8152         comp_cp->sh.dest_port = stcb->rport;
8153         comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8154         comp_cp->sh.checksum = 0;
8155
8156         m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8157         m_shutdown_comp->m_pkthdr.rcvif = 0;
8158         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8159             (struct sockaddr *)&net->ro._l_addr, m_shutdown_comp,
8160             1, 0, NULL, 0);
8161         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8162             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8163                 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8164                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
8165                 soisdisconnected(stcb->sctp_ep->sctp_socket);
8166         }
8167         return (0);
8168 }
8169
8170 int
8171 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8172 {
8173         /* formulate and SEND a SHUTDOWN-COMPLETE */
8174         struct mbuf *mout;
8175         struct ip *iph, *iph_out;
8176         struct ip6_hdr *ip6, *ip6_out;
8177         int offset_out;
8178         struct sctp_shutdown_complete_msg *comp_cp;
8179
8180         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
8181         if (mout == NULL) {
8182                 /* no mbuf's */
8183                 return (-1);
8184         }
8185         iph = mtod(m, struct ip *);
8186         iph_out = NULL;
8187         ip6_out = NULL;
8188         offset_out = 0;
8189         if (iph->ip_v == IPVERSION) {
8190                 mout->m_len = sizeof(struct ip) +
8191                     sizeof(struct sctp_shutdown_complete_msg);
8192                 mout->m_next = NULL;
8193                 iph_out = mtod(mout, struct ip *);
8194
8195                 /* Fill in the IP header for the ABORT */
8196                 iph_out->ip_v = IPVERSION;
8197                 iph_out->ip_hl = (sizeof(struct ip)/4);
8198                 iph_out->ip_tos = (u_char)0;
8199                 iph_out->ip_id = 0;
8200                 iph_out->ip_off = 0;
8201                 iph_out->ip_ttl = MAXTTL;
8202                 iph_out->ip_p = IPPROTO_SCTP;
8203                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8204                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8205
8206                 /* let IP layer calculate this */
8207                 iph_out->ip_sum = 0;
8208                 offset_out += sizeof(*iph_out);
8209                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8210                     (caddr_t)iph_out + offset_out);
8211         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8212                 ip6 = (struct ip6_hdr *)iph;
8213                 mout->m_len = sizeof(struct ip6_hdr) +
8214                     sizeof(struct sctp_shutdown_complete_msg);
8215                 mout->m_next = NULL;
8216                 ip6_out = mtod(mout, struct ip6_hdr *);
8217
8218                 /* Fill in the IPv6 header for the ABORT */
8219                 ip6_out->ip6_flow = ip6->ip6_flow;
8220                 ip6_out->ip6_hlim = ip6_defhlim;
8221                 ip6_out->ip6_nxt = IPPROTO_SCTP;
8222                 ip6_out->ip6_src = ip6->ip6_dst;
8223                 ip6_out->ip6_dst = ip6->ip6_src;
8224                 ip6_out->ip6_plen = mout->m_len;
8225                 offset_out += sizeof(*ip6_out);
8226                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8227                     (caddr_t)ip6_out + offset_out);
8228         } else {
8229                 /* Currently not supported. */
8230                 return (-1);
8231         }
8232
8233         /* Now copy in and fill in the ABORT tags etc. */
8234         comp_cp->sh.src_port = sh->dest_port;
8235         comp_cp->sh.dest_port = sh->src_port;
8236         comp_cp->sh.checksum = 0;
8237         comp_cp->sh.v_tag = sh->v_tag;
8238         comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8239         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8240         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8241
8242         mout->m_pkthdr.len = mout->m_len;
8243         /* add checksum */
8244         if ((sctp_no_csum_on_loopback) &&
8245            (m->m_pkthdr.rcvif) &&
8246            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
8247                 comp_cp->sh.checksum =  0;
8248         } else {
8249                 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8250         }
8251
8252         /* zap the rcvif, it should be null */
8253         mout->m_pkthdr.rcvif = 0;
8254         /* zap the stack pointer to the route */
8255         if (iph_out != NULL) {
8256                 struct route ro;
8257
8258                 bzero(&ro, sizeof ro);
8259 #ifdef SCTP_DEBUG
8260                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8261                         kprintf("sctp_shutdown_complete2 calling ip_output:\n");
8262                         sctp_print_address_pkt(iph_out, &comp_cp->sh);
8263                 }
8264 #endif
8265                 /* set IPv4 length */
8266 #if defined(__FreeBSD__)
8267                 iph_out->ip_len = mout->m_pkthdr.len;
8268 #else
8269                 iph_out->ip_len = htons(mout->m_pkthdr.len);
8270 #endif
8271                 /* out it goes */
8272                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
8273 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
8274     || defined(__NetBSD__) || defined(__DragonFly__)
8275                     , NULL
8276 #endif
8277                     );
8278                 /* Free the route if we got one back */
8279                 if (ro.ro_rt)
8280                         RTFREE(ro.ro_rt);
8281         } else if (ip6_out != NULL) {
8282 #ifdef NEW_STRUCT_ROUTE
8283                 struct route ro;
8284 #else
8285                 struct route_in6 ro;
8286 #endif
8287
8288                 bzero(&ro, sizeof(ro));
8289 #ifdef SCTP_DEBUG
8290                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8291                         kprintf("sctp_shutdown_complete2 calling ip6_output:\n");
8292                         sctp_print_address_pkt((struct ip *)ip6_out,
8293                             &comp_cp->sh);
8294                 }
8295 #endif
8296                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
8297 #if defined(__NetBSD__)
8298                            , NULL
8299 #endif
8300 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
8301                            , NULL
8302 #endif
8303                     );
8304                 /* Free the route if we got one back */
8305                 if (ro.ro_rt)
8306                         RTFREE(ro.ro_rt);
8307         }
8308         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8309         return (0);
8310 }
8311
8312 static struct sctp_nets *
8313 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8314 {
8315         struct sctp_nets *net, *hnet;
8316         int ms_goneby, highest_ms, state_overide=0;
8317
8318         SCTP_GETTIME_TIMEVAL(now);
8319         highest_ms = 0;
8320         hnet = NULL;
8321         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8322                 if (
8323                         ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8324                         (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8325                         ) {
8326                         /* Skip this guy from consideration if HB is off AND its confirmed*/
8327 #ifdef SCTP_DEBUG
8328                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8329                                 kprintf("Skipping net:%p state:%d nohb/out-of-scope\n",
8330                                        net, net->dest_state);
8331                         }
8332 #endif
8333                         continue;
8334                 }
8335                 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
8336                         /* skip this dest net from consideration */
8337 #ifdef SCTP_DEBUG
8338                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8339                                 kprintf("Skipping net:%p reachable NOT\n",
8340                                        net);
8341                         }
8342 #endif
8343                         continue;
8344                 }
8345                 if (net->last_sent_time.tv_sec) {
8346                         /* Sent to so we subtract */
8347                         ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8348                 } else
8349                         /* Never been sent to */
8350                         ms_goneby = 0x7fffffff;
8351 #ifdef SCTP_DEBUG
8352                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8353                         kprintf("net:%p ms_goneby:%d\n",
8354                                net, ms_goneby);
8355                 }
8356 #endif
8357                 /* When the address state is unconfirmed but still considered reachable, we
8358                  * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8359                  * state, thenw we cut it back to HB at a more normal pace.
8360                  */
8361                 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8362                         state_overide = 1;
8363                 } else {
8364                         state_overide = 0;
8365                 }
8366
8367                 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8368                     (ms_goneby > highest_ms)) {
8369                         highest_ms = ms_goneby;
8370                         hnet = net;
8371 #ifdef SCTP_DEBUG
8372                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8373                                 kprintf("net:%p is the new high\n",
8374                                        net);
8375                         }
8376 #endif
8377                 }
8378         }
8379         if (hnet &&
8380            ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8381                 state_overide = 1;
8382         } else {
8383                 state_overide = 0;
8384         }
8385
8386         if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8387                 /* Found the one with longest delay bounds
8388                  * OR it is unconfirmed and still not marked
8389                  * unreachable.
8390                  */
8391 #ifdef SCTP_DEBUG
8392                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8393                         kprintf("net:%p is the hb winner -",
8394                                 hnet);
8395                         if (hnet)
8396                                 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr);
8397                         else
8398                                 kprintf(" none\n");
8399                 }
8400 #endif
8401                 /* update the timer now */
8402                 hnet->last_sent_time = *now;
8403                 return (hnet);
8404         }
8405         /* Nothing to HB */
8406         return (NULL);
8407 }
8408
8409 int
8410 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8411 {
8412         struct sctp_tmit_chunk *chk;
8413         struct sctp_nets *net;
8414         struct sctp_heartbeat_chunk *hb;
8415         struct timeval now;
8416         struct sockaddr_in *sin;
8417         struct sockaddr_in6 *sin6;
8418
8419         if (user_req == 0) {
8420                 net = sctp_select_hb_destination(stcb, &now);
8421                 if (net == NULL) {
8422                         /* All our busy none to send to, just
8423                          * start the timer again.
8424                          */
8425                         if (stcb->asoc.state == 0) {
8426                                 return (0);
8427                         }
8428                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8429                                          stcb->sctp_ep,
8430                                          stcb,
8431                                          net);
8432                         return (0);
8433                 }
8434 #ifndef SCTP_USE_ALLMAN_BURST
8435                 else {
8436                         /* found one idle.. decay cwnd on this one
8437                          * by 1/2 if none outstanding.
8438                          */
8439
8440                         if (net->flight_size == 0) {
8441                                 net->cwnd /= 2;
8442                                 if (net->addr_is_local) {
8443                                         if (net->cwnd < (net->mtu *4)) {
8444                                                 net->cwnd = net->mtu * 4;
8445                                         }
8446                                 } else {
8447                                         if (net->cwnd < (net->mtu * 2)) {
8448                                                 net->cwnd = net->mtu * 2;
8449                                         }
8450                                 }
8451
8452                         }
8453
8454                 }
8455 #endif
8456         } else {
8457                 net = u_net;
8458                 if (net == NULL) {
8459                         return (0);
8460                 }
8461                 SCTP_GETTIME_TIMEVAL(&now);
8462         }
8463         sin = (struct sockaddr_in *)&net->ro._l_addr;
8464         if (sin->sin_family != AF_INET) {
8465                 if (sin->sin_family != AF_INET6) {
8466                         /* huh */
8467                         return (0);
8468                 }
8469         }
8470         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8471         if (chk == NULL) {
8472 #ifdef SCTP_DEBUG
8473                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8474                         kprintf("Gak, can't get a chunk for hb\n");
8475                 }
8476 #endif
8477                 return (0);
8478         }
8479         sctppcbinfo.ipi_gencnt_chunk++;
8480         sctppcbinfo.ipi_count_chunk++;
8481         chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8482         chk->asoc = &stcb->asoc;
8483         chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8484         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8485         if (chk->data == NULL) {
8486                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8487                 sctppcbinfo.ipi_count_chunk--;
8488                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8489                         panic("Chunk count is negative");
8490                 }
8491                 sctppcbinfo.ipi_gencnt_chunk++;
8492                 return (0);
8493         }
8494         chk->data->m_data += SCTP_MIN_OVERHEAD;
8495         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8496         chk->sent = SCTP_DATAGRAM_UNSENT;
8497         chk->snd_count = 0;
8498         chk->whoTo = net;
8499         chk->whoTo->ref_count++;
8500         /* Now we have a mbuf that we can fill in with the details */
8501         hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8502
8503         /* fill out chunk header */
8504         hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8505         hb->ch.chunk_flags = 0;
8506         hb->ch.chunk_length = htons(chk->send_size);
8507         /* Fill out hb parameter */
8508         hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8509         hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8510         hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8511         hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8512         /* Did our user request this one, put it in */
8513         hb->heartbeat.hb_info.user_req = user_req;
8514         hb->heartbeat.hb_info.addr_family = sin->sin_family;
8515         hb->heartbeat.hb_info.addr_len = sin->sin_len;
8516         if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8517                 /* we only take from the entropy pool if the address is
8518                  * not confirmed.
8519                  */
8520                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8521                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8522         } else {
8523                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8524                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8525         }
8526         if (sin->sin_family == AF_INET) {
8527                 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8528         } else if (sin->sin_family == AF_INET6) {
8529                 /* We leave the scope the way it is in our lookup table. */
8530                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
8531                 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8532         } else {
8533                 /* huh compiler bug */
8534 #ifdef SCTP_DEBUG
8535                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8536                         kprintf("Compiler bug bleeds a mbuf and a chunk\n");
8537                 }
8538 #endif
8539                 return (0);
8540         }
8541         /* ok we have a destination that needs a beat */
8542         /* lets do the theshold management Qiaobing style */
8543         if (user_req == 0) {
8544                 if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8545                                               stcb->asoc.max_send_times)) {
8546                         /* we have lost the association, in a way this
8547                          * is quite bad since we really are one less time
8548                          * since we really did not send yet. This is the
8549                          * down side to the Q's style as defined in the RFC
8550                          * and not my alternate style defined in the RFC.
8551                          */
8552                         if (chk->data != NULL) {
8553                                 sctp_m_freem(chk->data);
8554                                 chk->data = NULL;
8555                         }
8556                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8557                         sctppcbinfo.ipi_count_chunk--;
8558                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8559                                 panic("Chunk count is negative");
8560                         }
8561                         sctppcbinfo.ipi_gencnt_chunk++;
8562                         return (-1);
8563                 }
8564         }
8565         net->hb_responded = 0;
8566 #ifdef SCTP_DEBUG
8567         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8568                 kprintf("Inserting chunk for HB\n");
8569         }
8570 #endif
8571         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8572         stcb->asoc.ctrl_queue_cnt++;
8573         sctp_pegs[SCTP_HB_SENT]++;
8574         /*
8575          * Call directly med level routine to put out the chunk. It will
8576          * always tumble out control chunks aka HB but it may even tumble
8577          * out data too.
8578          */
8579         if (user_req == 0) {
8580                 /* Ok now lets start the HB timer if it is NOT a user req */
8581                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8582                                  stcb, net);
8583         }
8584         return (1);
8585 }
8586
8587 void
8588 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8589                    uint32_t high_tsn)
8590 {
8591         struct sctp_association *asoc;
8592         struct sctp_ecne_chunk *ecne;
8593         struct sctp_tmit_chunk *chk;
8594         asoc = &stcb->asoc;
8595         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8596                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8597                         /* found a previous ECN_ECHO update it if needed */
8598                         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8599                         ecne->tsn = htonl(high_tsn);
8600                         return;
8601                 }
8602         }
8603         /* nope could not find one to update so we must build one */
8604         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8605         if (chk == NULL) {
8606                 return;
8607         }
8608         sctp_pegs[SCTP_ECNE_SENT]++;
8609         sctppcbinfo.ipi_count_chunk++;
8610         sctppcbinfo.ipi_gencnt_chunk++;
8611         chk->rec.chunk_id = SCTP_ECN_ECHO;
8612         chk->asoc = &stcb->asoc;
8613         chk->send_size = sizeof(struct sctp_ecne_chunk);
8614         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8615         if (chk->data == NULL) {
8616                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8617                 sctppcbinfo.ipi_count_chunk--;
8618                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8619                         panic("Chunk count is negative");
8620                 }
8621                 sctppcbinfo.ipi_gencnt_chunk++;
8622                 return;
8623         }
8624         chk->data->m_data += SCTP_MIN_OVERHEAD;
8625         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8626         chk->sent = SCTP_DATAGRAM_UNSENT;
8627         chk->snd_count = 0;
8628         chk->whoTo = net;
8629         chk->whoTo->ref_count++;
8630         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8631         ecne->ch.chunk_type = SCTP_ECN_ECHO;
8632         ecne->ch.chunk_flags = 0;
8633         ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8634         ecne->tsn = htonl(high_tsn);
8635         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8636         asoc->ctrl_queue_cnt++;
8637 }
8638
8639 void
8640 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8641                          struct mbuf *m, int iphlen, int bad_crc)
8642 {
8643         struct sctp_association *asoc;
8644         struct sctp_pktdrop_chunk *drp;
8645         struct sctp_tmit_chunk *chk;
8646         uint8_t *datap;
8647         int len;
8648         unsigned int small_one;
8649         struct ip *iph;
8650
8651         long spc;
8652         asoc = &stcb->asoc;
8653         if (asoc->peer_supports_pktdrop == 0) {
8654                 /* peer must declare support before I
8655                  * send one.
8656                  */
8657                 return;
8658         }
8659         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8660         if (chk == NULL) {
8661                 return;
8662         }
8663         sctppcbinfo.ipi_count_chunk++;
8664         sctppcbinfo.ipi_gencnt_chunk++;
8665
8666         iph = mtod(m, struct ip *);
8667         if (iph == NULL) {
8668                 return;
8669         }
8670         if (iph->ip_v == IPVERSION) {
8671                 /* IPv4 */
8672 #if defined(__FreeBSD__)
8673                 len = chk->send_size = iph->ip_len;
8674 #else
8675                 len = chk->send_size = (iph->ip_len - iphlen);
8676 #endif
8677         } else {
8678                 struct ip6_hdr *ip6h;
8679                 /* IPv6 */
8680                 ip6h = mtod(m, struct ip6_hdr *);
8681                 len = chk->send_size = htons(ip6h->ip6_plen);
8682         }
8683         if ((len+iphlen) > m->m_pkthdr.len) {
8684                 /* huh */
8685                 chk->send_size = len = m->m_pkthdr.len - iphlen;
8686         }
8687         chk->asoc = &stcb->asoc;
8688         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8689         if (chk->data == NULL) {
8690         jump_out:
8691                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8692                 sctppcbinfo.ipi_count_chunk--;
8693                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8694                         panic("Chunk count is negative");
8695                 }
8696                 sctppcbinfo.ipi_gencnt_chunk++;
8697                 return;
8698         }
8699         if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8700                 MCLGET(chk->data, MB_DONTWAIT);
8701                 if ((chk->data->m_flags & M_EXT) == 0) {
8702                         /* Give up */
8703                         sctp_m_freem(chk->data);
8704                         chk->data = NULL;
8705                         goto jump_out;
8706                 }
8707         }
8708         chk->data->m_data += SCTP_MIN_OVERHEAD;
8709         drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8710         if (drp == NULL) {
8711                 sctp_m_freem(chk->data);
8712                 chk->data = NULL;
8713                 goto jump_out;
8714         }
8715         small_one = asoc->smallest_mtu;
8716         if (small_one > MCLBYTES) {
8717                 /* Only one cluster worth of data MAX */
8718                 small_one = MCLBYTES;
8719         }
8720         chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8721                           sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8722         if (chk->book_size > small_one) {
8723                 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8724                 drp->trunc_len = htons(chk->send_size);
8725                 chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8726                                              sizeof(struct sctp_pktdrop_chunk) +
8727                                              sizeof(struct sctphdr));
8728                 len = chk->send_size;
8729         } else {
8730                 /* no truncation needed */
8731                 drp->ch.chunk_flags = 0;
8732                 drp->trunc_len = htons(0);
8733         }
8734         if (bad_crc) {
8735                 drp->ch.chunk_flags |= SCTP_BADCRC;
8736         }
8737         chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8738         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8739         chk->sent = SCTP_DATAGRAM_UNSENT;
8740         chk->snd_count = 0;
8741         if (net) {
8742                 /* we should hit here */
8743                 chk->whoTo = net;
8744         } else {
8745                 chk->whoTo = asoc->primary_destination;
8746         }
8747         chk->whoTo->ref_count++;
8748         chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8749         drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8750         drp->ch.chunk_length = htons(chk->send_size);
8751         spc = stcb->sctp_socket->so_rcv.ssb_hiwat;
8752         if (spc < 0) {
8753                 spc = 0;
8754         }
8755         drp->bottle_bw = htonl(spc);
8756         drp->current_onq = htonl(asoc->size_on_delivery_queue +
8757                                  asoc->size_on_reasm_queue +
8758                                  asoc->size_on_all_streams +
8759                                  asoc->my_rwnd_control_len +
8760                                  stcb->sctp_socket->so_rcv.ssb_cc);
8761         drp->reserved = 0;
8762         datap = drp->data;
8763         m_copydata(m, iphlen, len, datap);
8764         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8765         asoc->ctrl_queue_cnt++;
8766 }
8767
8768 void
8769 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8770 {
8771         struct sctp_association *asoc;
8772         struct sctp_cwr_chunk *cwr;
8773         struct sctp_tmit_chunk *chk;
8774
8775         asoc = &stcb->asoc;
8776         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8777                 if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8778                         /* found a previous ECN_CWR update it if needed */
8779                         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8780                         if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8781                                               MAX_TSN)) {
8782                                 cwr->tsn = htonl(high_tsn);
8783                         }
8784                         return;
8785                 }
8786         }
8787         /* nope could not find one to update so we must build one */
8788         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8789         if (chk == NULL) {
8790                 return;
8791         }
8792         sctppcbinfo.ipi_count_chunk++;
8793         sctppcbinfo.ipi_gencnt_chunk++;
8794         chk->rec.chunk_id = SCTP_ECN_CWR;
8795         chk->asoc = &stcb->asoc;
8796         chk->send_size = sizeof(struct sctp_cwr_chunk);
8797         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8798         if (chk->data == NULL) {
8799                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8800                 sctppcbinfo.ipi_count_chunk--;
8801                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8802                         panic("Chunk count is negative");
8803                 }
8804                 sctppcbinfo.ipi_gencnt_chunk++;
8805                 return;
8806         }
8807         chk->data->m_data += SCTP_MIN_OVERHEAD;
8808         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8809         chk->sent = SCTP_DATAGRAM_UNSENT;
8810         chk->snd_count = 0;
8811         chk->whoTo = net;
8812         chk->whoTo->ref_count++;
8813         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8814         cwr->ch.chunk_type = SCTP_ECN_CWR;
8815         cwr->ch.chunk_flags = 0;
8816         cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8817         cwr->tsn = htonl(high_tsn);
8818         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8819         asoc->ctrl_queue_cnt++;
8820 }
8821 static void
8822 sctp_reset_the_streams(struct sctp_tcb *stcb,
8823      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8824 {
8825         int i;
8826
8827         if (req->reset_flags & SCTP_RESET_ALL) {
8828                 for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8829                         stcb->asoc.strmout[i].next_sequence_sent = 0;
8830                 }
8831         } else if (number_entries) {
8832                 for (i=0; i<number_entries; i++) {
8833                         if (list[i] >= stcb->asoc.streamoutcnt) {
8834                                 /* no such stream */
8835                                 continue;
8836                         }
8837                         stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8838                 }
8839         }
8840         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8841 }
8842
8843 void
8844 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8845      struct sctp_stream_reset_request *req)
8846 {
8847         struct sctp_association *asoc;
8848         struct sctp_stream_reset_resp *strack;
8849         struct sctp_tmit_chunk *chk;
8850         uint32_t seq;
8851         int number_entries, i;
8852         uint8_t two_way=0, not_peer=0;
8853         uint16_t *list=NULL;
8854
8855         asoc = &stcb->asoc;
8856         if (req->reset_flags & SCTP_RESET_ALL)
8857                 number_entries = 0;
8858         else
8859                 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8860
8861         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8862         if (chk == NULL) {
8863                 return;
8864         }
8865         sctppcbinfo.ipi_count_chunk++;
8866         sctppcbinfo.ipi_gencnt_chunk++;
8867         chk->rec.chunk_id = SCTP_STREAM_RESET;
8868         chk->asoc = &stcb->asoc;
8869         chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8870         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8871         if (chk->data == NULL) {
8872         strresp_jump_out:
8873                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8874                 sctppcbinfo.ipi_count_chunk--;
8875                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8876                         panic("Chunk count is negative");
8877                 }
8878                 sctppcbinfo.ipi_gencnt_chunk++;
8879                 return;
8880         }
8881         chk->data->m_data += SCTP_MIN_OVERHEAD;
8882         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8883         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8884                 MCLGET(chk->data, MB_DONTWAIT);
8885                 if ((chk->data->m_flags & M_EXT) == 0) {
8886                         /* Give up */
8887                         sctp_m_freem(chk->data);
8888                         chk->data = NULL;
8889                         goto strresp_jump_out;
8890                 }
8891                 chk->data->m_data += SCTP_MIN_OVERHEAD;
8892         }
8893         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8894                 /* can't do it, no room */
8895                 /* Give up */
8896                 sctp_m_freem(chk->data);
8897                 chk->data = NULL;
8898                 goto strresp_jump_out;
8899
8900         }
8901         chk->sent = SCTP_DATAGRAM_UNSENT;
8902         chk->snd_count = 0;
8903         chk->whoTo = asoc->primary_destination;
8904         chk->whoTo->ref_count++;
8905         strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8906
8907         strack->ch.chunk_type = SCTP_STREAM_RESET;
8908         strack->ch.chunk_flags = 0;
8909         strack->ch.chunk_length = htons(chk->send_size);
8910
8911         memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8912
8913         strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8914         strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8915
8916
8917
8918         if (chk->send_size % 4) {
8919                 /* need a padding for the end */
8920                 int pad;
8921                 uint8_t *end;
8922                 end = (uint8_t *)((caddr_t)strack + chk->send_size);
8923                 pad = chk->send_size % 4;
8924                 for (i = 0; i < pad; i++) {
8925                         end[i] = 0;
8926                 }
8927                 chk->send_size += pad;
8928         }
8929
8930         /* actual response */
8931         if (req->reset_flags & SCTP_RESET_YOUR) {
8932                 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8933         } else {
8934                 strack->sr_resp.reset_flags = 0;
8935         }
8936
8937         /* copied from reset request */
8938         strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8939         seq = ntohl(req->reset_req_seq);
8940
8941         list = req->list_of_streams;
8942         /* copy the un-converted network byte order streams */
8943         for (i=0; i<number_entries; i++) {
8944                 strack->sr_resp.list_of_streams[i] = list[i];
8945         }
8946         if (asoc->str_reset_seq_in == seq) {
8947                 /* is it the next expected? */
8948                 asoc->str_reset_seq_in++;
8949                 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8950                 asoc->str_reset_sending_seq = asoc->sending_seq;
8951                 if (number_entries) {
8952                         int i;
8953                         uint16_t temp;
8954                         /* convert them to host byte order */
8955                         for (i=0 ; i<number_entries; i++) {
8956                                 temp = ntohs(list[i]);
8957                                 list[i] = temp;
8958                         }
8959                 }
8960                 if (req->reset_flags & SCTP_RESET_YOUR) {
8961                         /* reset my outbound streams */
8962                         sctp_reset_the_streams(stcb, req , number_entries, list);
8963                 }
8964                 if (req->reset_flags & SCTP_RECIPRICAL) {
8965                         /* reset peer too */
8966                         sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
8967                 }
8968
8969         } else {
8970                 /* no its a retran so I must just ack and do nothing */
8971                 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
8972         }
8973         strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
8974         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8975                           chk,
8976                           sctp_next);
8977         asoc->ctrl_queue_cnt++;
8978 }
8979
8980
8981 void
8982 sctp_send_str_reset_req(struct sctp_tcb *stcb,
8983      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
8984 {
8985         /* Send a stream reset request. The number_entrys may be 0 and list NULL
8986          * if the request is to reset all streams. If two_way is true then we
8987          * not only request a RESET of the received streams but we also
8988          * request the peer to send a reset req to us too.
8989          * Flag combinations in table:
8990          *
8991          *       two_way | not_peer  | = | Flags
8992          *       ------------------------------
8993          *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
8994          *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
8995          *         0     |    1      | = | Not a Valid Request (not anyone)
8996          *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
8997          */
8998         struct sctp_association *asoc;
8999         struct sctp_stream_reset_req *strreq;
9000         struct sctp_tmit_chunk *chk;
9001
9002
9003         asoc = &stcb->asoc;
9004         if (asoc->stream_reset_outstanding) {
9005                 /* Already one pending, must get ACK back
9006                  * to clear the flag.
9007                  */
9008                 return;
9009         }
9010
9011         if ((two_way == 0) && (not_peer == 1)) {
9012                 /* not a valid request */
9013                 return;
9014         }
9015
9016         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9017         if (chk == NULL) {
9018                 return;
9019         }
9020         sctppcbinfo.ipi_count_chunk++;
9021         sctppcbinfo.ipi_gencnt_chunk++;
9022         chk->rec.chunk_id = SCTP_STREAM_RESET;
9023         chk->asoc = &stcb->asoc;
9024         chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
9025         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
9026         if (chk->data == NULL) {
9027         strreq_jump_out:
9028                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9029                 sctppcbinfo.ipi_count_chunk--;
9030                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9031                         panic("Chunk count is negative");
9032                 }
9033                 sctppcbinfo.ipi_gencnt_chunk++;
9034                 return;
9035         }
9036         chk->data->m_data += SCTP_MIN_OVERHEAD;
9037         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
9038         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9039                 MCLGET(chk->data, MB_DONTWAIT);
9040                 if ((chk->data->m_flags & M_EXT) == 0) {
9041                         /* Give up */
9042                         sctp_m_freem(chk->data);
9043                         chk->data = NULL;
9044                         goto strreq_jump_out;
9045                 }
9046                 chk->data->m_data += SCTP_MIN_OVERHEAD;
9047         }
9048         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9049                 /* can't do it, no room */
9050                 /* Give up */
9051                 sctp_m_freem(chk->data);
9052                 chk->data = NULL;
9053                 goto strreq_jump_out;
9054         }
9055         chk->sent = SCTP_DATAGRAM_UNSENT;
9056         chk->snd_count = 0;
9057         chk->whoTo = asoc->primary_destination;
9058         chk->whoTo->ref_count++;
9059
9060         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
9061         strreq->ch.chunk_type = SCTP_STREAM_RESET;
9062         strreq->ch.chunk_flags = 0;
9063         strreq->ch.chunk_length = htons(chk->send_size);
9064
9065         strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
9066         strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
9067
9068         if (chk->send_size % 4) {
9069                 /* need a padding for the end */
9070                 int pad, i;
9071                 uint8_t *end;
9072                 end = (uint8_t *)((caddr_t)strreq + chk->send_size);
9073                 pad = chk->send_size % 4;
9074                 for (i=0; i<pad; i++) {
9075                         end[i] = 0;
9076                 }
9077                 chk->send_size += pad;
9078         }
9079
9080         strreq->sr_req.reset_flags = 0;
9081         if (number_entrys == 0) {
9082                 strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
9083         }
9084         if (two_way == 0) {
9085                 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
9086         } else {
9087                 if (not_peer == 0) {
9088                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
9089                 } else {
9090                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
9091                 }
9092         }
9093         memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
9094         strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
9095         if (number_entrys) {
9096                 /* populate the specific entry's */
9097                 int i;
9098                 for (i=0; i < number_entrys; i++) {
9099                         strreq->sr_req.list_of_streams[i] = htons(list[i]);
9100                 }
9101         }
9102         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9103                           chk,
9104                           sctp_next);
9105         asoc->ctrl_queue_cnt++;
9106         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
9107         asoc->stream_reset_outstanding = 1;
9108 }
9109
9110 void
9111 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
9112     struct mbuf *err_cause)
9113 {
9114         /*
9115          * Formulate the abort message, and send it back down.
9116          */
9117         struct mbuf *mout;
9118         struct sctp_abort_msg *abm;
9119         struct ip *iph, *iph_out;
9120         struct ip6_hdr *ip6, *ip6_out;
9121         int iphlen_out;
9122
9123         /* don't respond to ABORT with ABORT */
9124         if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
9125                 if (err_cause)
9126                         sctp_m_freem(err_cause);
9127                 return;
9128         }
9129         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
9130         if (mout == NULL) {
9131                 if (err_cause)
9132                         sctp_m_freem(err_cause);
9133                 return;
9134         }
9135         iph = mtod(m, struct ip *);
9136         iph_out = NULL;
9137         ip6_out = NULL;
9138         if (iph->ip_v == IPVERSION) {
9139                 iph_out = mtod(mout, struct ip *);
9140                 mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9141                 mout->m_next = err_cause;
9142
9143                 /* Fill in the IP header for the ABORT */
9144                 iph_out->ip_v = IPVERSION;
9145                 iph_out->ip_hl = (sizeof(struct ip) / 4);
9146                 iph_out->ip_tos = (u_char)0;
9147                 iph_out->ip_id = 0;
9148                 iph_out->ip_off = 0;
9149                 iph_out->ip_ttl = MAXTTL;
9150                 iph_out->ip_p = IPPROTO_SCTP;
9151                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9152                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9153                 /* let IP layer calculate this */
9154                 iph_out->ip_sum = 0;
9155
9156                 iphlen_out = sizeof(*iph_out);
9157                 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
9158         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9159                 ip6 = (struct ip6_hdr *)iph;
9160                 ip6_out = mtod(mout, struct ip6_hdr *);
9161                 mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9162                 mout->m_next = err_cause;
9163
9164                 /* Fill in the IP6 header for the ABORT */
9165                 ip6_out->ip6_flow = ip6->ip6_flow;
9166                 ip6_out->ip6_hlim = ip6_defhlim;
9167                 ip6_out->ip6_nxt = IPPROTO_SCTP;
9168                 ip6_out->ip6_src = ip6->ip6_dst;
9169                 ip6_out->ip6_dst = ip6->ip6_src;
9170
9171                 iphlen_out = sizeof(*ip6_out);
9172                 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
9173         } else {
9174                 /* Currently not supported */
9175                 return;
9176         }
9177
9178         abm->sh.src_port = sh->dest_port;
9179         abm->sh.dest_port = sh->src_port;
9180         abm->sh.checksum = 0;
9181         if (vtag == 0) {
9182                 abm->sh.v_tag = sh->v_tag;
9183                 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9184         } else {
9185                 abm->sh.v_tag = htonl(vtag);
9186                 abm->msg.ch.chunk_flags = 0;
9187         }
9188         abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9189
9190         if (err_cause) {
9191                 struct mbuf *m_tmp = err_cause;
9192                 int err_len = 0;
9193                 /* get length of the err_cause chain */
9194                 while (m_tmp != NULL) {
9195                         err_len += m_tmp->m_len;
9196                         m_tmp = m_tmp->m_next;
9197                 }
9198                 mout->m_pkthdr.len = mout->m_len + err_len;
9199                 if (err_len % 4) {
9200                         /* need pad at end of chunk */
9201                         u_int32_t cpthis=0;
9202                         int padlen;
9203                         padlen = 4 - (mout->m_pkthdr.len % 4);
9204                         m_copyback(mout, mout->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9205                 }
9206                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9207         } else {
9208                 mout->m_pkthdr.len = mout->m_len;
9209                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9210         }
9211
9212         /* add checksum */
9213         if ((sctp_no_csum_on_loopback) &&
9214            (m->m_pkthdr.rcvif) &&
9215            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9216                 abm->sh.checksum =  0;
9217         } else {
9218                 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9219         }
9220
9221         /* zap the rcvif, it should be null */
9222         mout->m_pkthdr.rcvif = 0;
9223         if (iph_out != NULL) {
9224                 struct route ro;
9225
9226                 /* zap the stack pointer to the route */
9227                 bzero(&ro, sizeof ro);
9228 #ifdef SCTP_DEBUG
9229                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9230                         kprintf("sctp_send_abort calling ip_output:\n");
9231                         sctp_print_address_pkt(iph_out, &abm->sh);
9232                 }
9233 #endif
9234                 /* set IPv4 length */
9235 #if defined(__FreeBSD__)
9236                 iph_out->ip_len = mout->m_pkthdr.len;
9237 #else
9238                 iph_out->ip_len = htons(mout->m_pkthdr.len);
9239 #endif
9240                 /* out it goes */
9241                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
9242 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9243     || defined(__NetBSD__) || defined(__DragonFly__)
9244                     , NULL
9245 #endif
9246                     );
9247                 /* Free the route if we got one back */
9248                 if (ro.ro_rt)
9249                         RTFREE(ro.ro_rt);
9250         } else if (ip6_out != NULL) {
9251 #ifdef NEW_STRUCT_ROUTE
9252                 struct route ro;
9253 #else
9254                 struct route_in6 ro;
9255 #endif
9256
9257                 /* zap the stack pointer to the route */
9258                 bzero(&ro, sizeof(ro));
9259 #ifdef SCTP_DEBUG
9260                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9261                         kprintf("sctp_send_abort calling ip6_output:\n");
9262                         sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9263                 }
9264 #endif
9265                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
9266 #if defined(__NetBSD__)
9267                         , NULL
9268 #endif
9269 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9270                     , NULL
9271 #endif
9272                     );
9273                 /* Free the route if we got one back */
9274                 if (ro.ro_rt)
9275                         RTFREE(ro.ro_rt);
9276         }
9277         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9278 }
9279
9280 void
9281 sctp_send_operr_to(struct mbuf *m, int iphlen,
9282                    struct mbuf *scm,
9283                    uint32_t vtag)
9284 {
9285         struct sctphdr *ihdr;
9286         int retcode;
9287         struct sctphdr *ohdr;
9288         struct sctp_chunkhdr *ophdr;
9289
9290         struct ip *iph;
9291 #ifdef SCTP_DEBUG
9292         struct sockaddr_in6 lsa6, fsa6;
9293 #endif
9294         uint32_t val;
9295         iph = mtod(m, struct ip *);
9296         ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
9297         if (!(scm->m_flags & M_PKTHDR)) {
9298                 /* must be a pkthdr */
9299                 kprintf("Huh, not a packet header in send_operr\n");
9300                 m_freem(scm);
9301                 return;
9302         }
9303         M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), MB_DONTWAIT);
9304         if (scm == NULL) {
9305                 /* can't send because we can't add a mbuf */
9306                 return;
9307         }
9308         ohdr = mtod(scm, struct sctphdr *);
9309         ohdr->src_port = ihdr->dest_port;
9310         ohdr->dest_port = ihdr->src_port;
9311         ohdr->v_tag = vtag;
9312         ohdr->checksum = 0;
9313         ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9314         ophdr->chunk_type = SCTP_OPERATION_ERROR;
9315         ophdr->chunk_flags = 0;
9316         ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9317         if (scm->m_pkthdr.len % 4) {
9318                 /* need padding */
9319                 u_int32_t cpthis=0;
9320                 int padlen;
9321                 padlen = 4 - (scm->m_pkthdr.len % 4);
9322                 m_copyback(scm, scm->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9323         }
9324         if ((sctp_no_csum_on_loopback) &&
9325             (m->m_pkthdr.rcvif) &&
9326             (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9327                 val = 0;
9328         } else {
9329                 val = sctp_calculate_sum(scm, NULL, 0);
9330         }
9331         ohdr->checksum = val;
9332         if (iph->ip_v == IPVERSION) {
9333                 /* V4 */
9334                 struct ip *out;
9335                 struct route ro;
9336                 M_PREPEND(scm, sizeof(struct ip), MB_DONTWAIT);
9337                 if (scm == NULL)
9338                         return;
9339                 bzero(&ro, sizeof ro);
9340                 out = mtod(scm, struct ip *);
9341                 out->ip_v = iph->ip_v;
9342                 out->ip_hl = (sizeof(struct ip)/4);
9343                 out->ip_tos = iph->ip_tos;
9344                 out->ip_id = iph->ip_id;
9345                 out->ip_off = 0;
9346                 out->ip_ttl = MAXTTL;
9347                 out->ip_p = IPPROTO_SCTP;
9348                 out->ip_sum = 0;
9349                 out->ip_src = iph->ip_dst;
9350                 out->ip_dst = iph->ip_src;
9351 #if defined(__FreeBSD__)
9352                 out->ip_len = scm->m_pkthdr.len;
9353 #else
9354                 out->ip_len = htons(scm->m_pkthdr.len);
9355 #endif
9356                 retcode = ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL
9357 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9358     || defined(__NetBSD__) || defined(__DragonFly__)
9359                     , NULL
9360 #endif
9361                         );
9362                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9363                 /* Free the route if we got one back */
9364                 if (ro.ro_rt)
9365                         RTFREE(ro.ro_rt);
9366         } else {
9367                 /* V6 */
9368 #ifdef NEW_STRUCT_ROUTE
9369                 struct route ro;
9370 #else
9371                 struct route_in6 ro;
9372 #endif
9373                 struct ip6_hdr *out6, *in6;
9374
9375                 M_PREPEND(scm, sizeof(struct ip6_hdr), MB_DONTWAIT);
9376                 if (scm == NULL)
9377                         return;
9378                 bzero(&ro, sizeof ro);
9379                 in6 = mtod(m, struct ip6_hdr *);
9380                 out6 = mtod(scm, struct ip6_hdr *);
9381                 out6->ip6_flow = in6->ip6_flow;
9382                 out6->ip6_hlim = ip6_defhlim;
9383                 out6->ip6_nxt = IPPROTO_SCTP;
9384                 out6->ip6_src = in6->ip6_dst;
9385                 out6->ip6_dst = in6->ip6_src;
9386
9387 #ifdef SCTP_DEBUG
9388                 bzero(&lsa6, sizeof(lsa6));
9389                 lsa6.sin6_len = sizeof(lsa6);
9390                 lsa6.sin6_family = AF_INET6;
9391                 lsa6.sin6_addr = out6->ip6_src;
9392                 bzero(&fsa6, sizeof(fsa6));
9393                 fsa6.sin6_len = sizeof(fsa6);
9394                 fsa6.sin6_family = AF_INET6;
9395                 fsa6.sin6_addr = out6->ip6_dst;
9396                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9397                         kprintf("sctp_operr_to calling ipv6 output:\n");
9398                         kprintf("src: ");
9399                         sctp_print_address((struct sockaddr *)&lsa6);
9400                         kprintf("dst ");
9401                         sctp_print_address((struct sockaddr *)&fsa6);
9402                 }
9403 #endif /* SCTP_DEBUG */
9404                 ip6_output(scm, NULL, &ro, 0, NULL, NULL
9405 #if defined(__NetBSD__)
9406             , NULL
9407 #endif
9408 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9409             , NULL
9410 #endif
9411                 );
9412                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9413                 /* Free the route if we got one back */
9414                 if (ro.ro_rt)
9415                         RTFREE(ro.ro_rt);
9416         }
9417 }
9418
9419 static int
9420 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9421 {
9422         int left, cancpy, willcpy, error;
9423         left = cpsz;
9424
9425         if (m == NULL) {
9426                 /* TSNH */
9427                 *mbcnt = 0;
9428                 return (ENOMEM);
9429         }
9430         m->m_len = 0;
9431         if ((left+resv_upfront) > (int)MHLEN) {
9432                 MCLGET(m, MB_WAIT);
9433                 if (m == NULL) {
9434                         *mbcnt = 0;
9435                         return (ENOMEM);
9436                 }
9437                 if ((m->m_flags & M_EXT) == 0) {
9438                         *mbcnt = 0;
9439                         return (ENOMEM);
9440                 }
9441                 *mbcnt += m->m_ext.ext_size;
9442         }
9443         *mbcnt += MSIZE;
9444         cancpy = M_TRAILINGSPACE(m);
9445         willcpy = min(cancpy, left);
9446         if ((willcpy + resv_upfront) > cancpy) {
9447                 willcpy -= resv_upfront;
9448         }
9449         while (left > 0) {
9450                 /* Align data to the end */
9451                 if ((m->m_flags & M_EXT) == 0) {
9452                         if (m->m_flags & M_PKTHDR) {
9453                                 MH_ALIGN(m, willcpy);
9454                         } else {
9455                                 M_ALIGN(m, willcpy);
9456                         }
9457                 } else {
9458                         MC_ALIGN(m, willcpy);
9459                 }
9460                 error = uiomove(mtod(m, caddr_t), willcpy, uio);
9461                 if (error) {
9462                         return (error);
9463                 }
9464                 m->m_len = willcpy;
9465                 m->m_nextpkt = 0;
9466                 left -= willcpy;
9467                 if (left > 0) {
9468                         MGET(m->m_next, MB_WAIT, MT_DATA);
9469                         if (m->m_next == NULL) {
9470                                 *mbcnt = 0;
9471                                 return (ENOMEM);
9472                         }
9473                         m = m->m_next;
9474                         m->m_len = 0;
9475                         *mbcnt += MSIZE;
9476                         if (left > (int)MHLEN) {
9477                                 MCLGET(m, MB_WAIT);
9478                                 if (m == NULL) {
9479                                         *mbcnt = 0;
9480                                         return (ENOMEM);
9481                                 }
9482                                 if ((m->m_flags & M_EXT) == 0) {
9483                                         *mbcnt = 0;
9484                                         return (ENOMEM);
9485                                 }
9486                                 *mbcnt += m->m_ext.ext_size;
9487                         }
9488                         cancpy = M_TRAILINGSPACE(m);
9489                         willcpy = min(cancpy, left);
9490                 }
9491         }
9492         return (0);
9493 }
9494
9495 static int
9496 sctp_copy_it_in(struct sctp_inpcb *inp,
9497                 struct sctp_tcb *stcb,
9498                 struct sctp_association *asoc,
9499                 struct sctp_nets *net,
9500                 struct sctp_sndrcvinfo *srcv,
9501                 struct uio *uio,
9502                 int flags)
9503 {
9504         /* This routine must be very careful in
9505          * its work. Protocol processing is
9506          * up and running so care must be taken to
9507          * spl...() when you need to do something
9508          * that may effect the stcb/asoc. The sb is
9509          * locked however. When data is copied the
9510          * protocol processing should be enabled since
9511          * this is a slower operation...
9512          */
9513         struct socket *so;
9514         int error = 0;
9515         int frag_size, mbcnt = 0, mbcnt_e = 0;
9516         unsigned int sndlen;
9517         unsigned int tot_demand;
9518         int tot_out, dataout;
9519         struct sctp_tmit_chunk *chk;
9520         struct mbuf *mm;
9521         struct sctp_stream_out *strq;
9522         uint32_t my_vtag;
9523         int resv_in_first;
9524
9525         crit_enter();
9526         so = stcb->sctp_socket;
9527         chk = NULL;
9528         mm = NULL;
9529
9530         sndlen = uio->uio_resid;
9531         /* lock the socket buf */
9532         SOCKBUF_LOCK(&so->so_snd);
9533         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
9534         if (error) {
9535                 crit_exit();
9536                 goto out_locked;
9537         }
9538
9539         /* will it ever fit ? */
9540         if (sndlen > so->so_snd.ssb_hiwat) {
9541                 /* It will NEVER fit */
9542                 error = EMSGSIZE;
9543                 crit_exit();
9544                 goto release;
9545         }
9546         /* Do I need to block? */
9547         if ((so->so_snd.ssb_hiwat <
9548             (sndlen + asoc->total_output_queue_size)) ||
9549             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9550             (asoc->total_output_mbuf_queue_size >
9551             so->so_snd.ssb_mbmax)
9552         ) {
9553                 /* prune any prsctp bufs out */
9554                 if (asoc->peer_supports_prsctp) {
9555                         sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9556                 }
9557                 /*
9558                  * We store off a pointer to the endpoint.
9559                  * Since on return from this we must check to
9560                  * see if an so_error is set. If so we may have
9561                  * been reset and our stcb destroyed. Returning
9562                  * an error will flow back to the user...
9563                  */
9564                 while ((so->so_snd.ssb_hiwat <
9565                     (sndlen + asoc->total_output_queue_size)) ||
9566                     (asoc->chunks_on_out_queue >
9567                     sctp_max_chunks_on_queue) ||
9568                     (asoc->total_output_mbuf_queue_size >
9569                     so->so_snd.ssb_mbmax)
9570                 ) {
9571                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
9572                                 /* Non-blocking io in place */
9573                                 error = EWOULDBLOCK;
9574                                 crit_exit();
9575                                 goto release;
9576                         }
9577                         inp->sctp_tcb_at_block = (void *)stcb;
9578                         inp->error_on_block = 0;
9579 #ifdef SCTP_BLK_LOGGING
9580                         sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9581                             so, asoc);
9582 #endif
9583                         ssb_unlock(&so->so_snd);
9584                         SCTP_TCB_UNLOCK(stcb);
9585                         error = ssb_wait(&so->so_snd);
9586                         SCTP_INP_RLOCK(inp);
9587                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9588                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9589                                 /* Should I really unlock ? */
9590                                 SCTP_INP_RUNLOCK(inp);
9591                                 error = EFAULT;
9592                                 crit_exit();
9593                                 goto out_locked;
9594                         }
9595                         SCTP_TCB_LOCK(stcb);
9596                         SCTP_INP_RUNLOCK(inp);
9597
9598                         inp->sctp_tcb_at_block = 0;
9599 #ifdef SCTP_BLK_LOGGING
9600                         sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9601                             so, asoc);
9602 #endif
9603                         if (inp->error_on_block) {
9604                                 /*
9605                                  * if our asoc was killed, the free code
9606                                  * (in sctp_pcb.c) will save a error in
9607                                  * here for us
9608                                  */
9609                                 error = inp->error_on_block;
9610                                 crit_exit();
9611                                 goto out_locked;
9612                         }
9613                         if (error) {
9614                                 crit_exit();
9615                                 goto out_locked;
9616                         }
9617                         /* did we encounter a socket error? */
9618                         if (so->so_error) {
9619                                 error = so->so_error;
9620                                 crit_exit();
9621                                 goto out_locked;
9622                         }
9623                         error = ssb_lock(&so->so_snd, M_WAITOK);
9624                         if (error) {
9625                                 /* Can't acquire the lock */
9626                                 crit_exit();
9627                                 goto out_locked;
9628                         }
9629 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9630                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9631 #else
9632                         if (so->so_state & SS_CANTSENDMORE) {
9633 #endif
9634                                 /* The socket is now set not to sendmore.. its gone */
9635                                 error = EPIPE;
9636                                 crit_exit();
9637                                 goto release;
9638                         }
9639                         if (so->so_error) {
9640                                 error = so->so_error;
9641                                 crit_exit();
9642                                 goto release;
9643                         }
9644                         if (asoc->peer_supports_prsctp) {
9645                                 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9646                         }
9647                 }
9648         }
9649         dataout = tot_out = uio->uio_resid;
9650         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9651                 resv_in_first = SCTP_MED_OVERHEAD;
9652         } else {
9653                 resv_in_first = SCTP_MED_V4_OVERHEAD;
9654         }
9655
9656         /* Are we aborting? */
9657         if (srcv->sinfo_flags & MSG_ABORT) {
9658                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9659                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9660                         /* It has to be up before we abort */
9661                         /* how big is the user initiated abort? */
9662
9663                         /* I wonder about doing a MGET without a splnet set.
9664                          * it is done that way in the sosend code so I guess
9665                          * it is ok :-0
9666                          */
9667                         MGETHDR(mm, MB_WAIT, MT_DATA);
9668                         if (mm) {
9669                                 struct sctp_paramhdr *ph;
9670
9671                                 tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9672                                 if (tot_demand > MHLEN) {
9673                                         if (tot_demand > MCLBYTES) {
9674                                                 /* truncate user data */
9675                                                 tot_demand = MCLBYTES;
9676                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9677                                         }
9678                                         MCLGET(mm, MB_WAIT);
9679                                         if ((mm->m_flags & M_EXT) == 0) {
9680                                                 /* truncate further */
9681                                                 tot_demand = MHLEN;
9682                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9683                                         }
9684                                 }
9685                                 /* now move forward the data pointer */
9686                                 ph = mtod(mm, struct sctp_paramhdr *);
9687                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9688                                 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9689                                 ph++;
9690                                 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9691                                 mm->m_len = mm->m_pkthdr.len;
9692                                 error = uiomove((caddr_t)ph, tot_out, uio);
9693                                 if (error) {
9694                                         /*
9695                                          * Here if we can't get his data we
9696                                          * still abort we just don't get to
9697                                          * send the users note :-0
9698                                          */
9699                                         sctp_m_freem(mm);
9700                                         mm = NULL;
9701                                 }
9702                         }
9703                         ssb_unlock(&so->so_snd);
9704                         SOCKBUF_UNLOCK(&so->so_snd);
9705                         sctp_abort_an_association(stcb->sctp_ep, stcb,
9706                                                   SCTP_RESPONSE_TO_USER_REQ,
9707                                                   mm);
9708                         mm = NULL;
9709                         crit_exit();
9710                         goto out_notlocked;
9711                 }
9712                 crit_exit();
9713                 goto release;
9714         }
9715
9716         /* Now can we send this? */
9717         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9718             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9719             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9720             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9721                 /* got data while shutting down */
9722                 error = ECONNRESET;
9723                 crit_exit();
9724                 goto release;
9725         }
9726         /* Is the stream no. valid? */
9727         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9728                 /* Invalid stream number */
9729                 error = EINVAL;
9730                 crit_exit();
9731                 goto release;
9732         }
9733         if (asoc->strmout == NULL) {
9734                 /* huh? software error */
9735 #ifdef SCTP_DEBUG
9736                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9737                         kprintf("software error in sctp_copy_it_in\n");
9738                 }
9739 #endif
9740                 error = EFAULT;
9741                 crit_exit();
9742                 goto release;
9743         }
9744         if ((srcv->sinfo_flags & MSG_EOF) &&
9745             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9746             (tot_out == 0)) {
9747                 crit_exit();
9748                 goto zap_by_it_now;
9749         }
9750         if (tot_out == 0) {
9751                 /* not allowed */
9752                 error = EMSGSIZE;
9753                 crit_exit();
9754                 goto release;
9755         }
9756         /* save off the tag */
9757         my_vtag = asoc->my_vtag;
9758         strq = &asoc->strmout[srcv->sinfo_stream];
9759         /* First lets figure out the "chunking" point */
9760         frag_size = sctp_get_frag_point(stcb, asoc);
9761
9762         /* two choices here, it all fits in one chunk or
9763          * we need multiple chunks.
9764          */
9765         crit_exit();
9766         SOCKBUF_UNLOCK(&so->so_snd);
9767         if (tot_out <= frag_size) {
9768                 /* no need to setup a template */
9769                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9770                 if (chk == NULL) {
9771                         error = ENOMEM;
9772                         SOCKBUF_LOCK(&so->so_snd);
9773                         goto release;
9774                 }
9775                 sctppcbinfo.ipi_count_chunk++;
9776                 sctppcbinfo.ipi_gencnt_chunk++;
9777                 asoc->chunks_on_out_queue++;
9778                 MGETHDR(mm, MB_WAIT, MT_DATA);
9779                 if (mm == NULL) {
9780                         error = ENOMEM;
9781                         goto clean_up;
9782                 }
9783                 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9784                 if (error)
9785                         goto clean_up;
9786                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9787                 chk->mbcnt = mbcnt_e;
9788                 mbcnt += mbcnt_e;
9789                 mbcnt_e = 0;
9790                 mm->m_pkthdr.len = tot_out;
9791                 chk->data = mm;
9792                 mm = NULL;
9793
9794                 /* the actual chunk flags */
9795                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9796                 chk->whoTo->ref_count++;
9797
9798                 /* fix up the send_size if it is not present */
9799                 chk->send_size = tot_out;
9800                 chk->book_size = chk->send_size;
9801                 /* ok, we are commited */
9802                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9803                         /* bump the ssn if we are unordered. */
9804                         strq->next_sequence_sent++;
9805                 }
9806                 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9807                         asoc->sent_queue_cnt_removeable++;
9808                 }
9809                 crit_enter();
9810                 if ((asoc->state == 0) ||
9811                     (my_vtag != asoc->my_vtag) ||
9812                     (so != inp->sctp_socket) ||
9813                     (inp->sctp_socket == 0)) {
9814                         /* connection was aborted */
9815                         crit_exit();
9816                         error = ECONNRESET;
9817                         goto clean_up;
9818                 }
9819                 asoc->stream_queue_cnt++;
9820                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9821                 /* now check if this stream is on the wheel */
9822                 if ((strq->next_spoke.tqe_next == NULL) &&
9823                     (strq->next_spoke.tqe_prev == NULL)) {
9824                         /* Insert it on the wheel since it is not
9825                          * on it currently
9826                          */
9827                         sctp_insert_on_wheel(asoc, strq);
9828                 }
9829                 crit_exit();
9830 clean_up:
9831                 if (error) {
9832                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9833                         sctppcbinfo.ipi_count_chunk--;
9834                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9835                                 panic("Chunk count is negative");
9836                         }
9837                         SOCKBUF_LOCK(&so->so_snd);
9838                         goto release;
9839                 }
9840         } else {
9841                 /* we need to setup a template */
9842                 struct sctp_tmit_chunk template;
9843                 struct sctpchunk_listhead tmp;
9844
9845                 /* setup the template */
9846                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9847
9848                 /* Prepare the temp list */
9849                 TAILQ_INIT(&tmp);
9850
9851                 /* Template is complete, now time for the work */
9852                 while (tot_out > 0) {
9853                         /* Get a chunk */
9854                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9855                         if (chk == NULL) {
9856                                 /*
9857                                  * ok we must spin through and dump anything
9858                                  * we have allocated and then jump to the
9859                                  * no_membad
9860                                  */
9861                                 error = ENOMEM;
9862                         }
9863                         sctppcbinfo.ipi_count_chunk++;
9864                         asoc->chunks_on_out_queue++;
9865
9866                         sctppcbinfo.ipi_gencnt_chunk++;
9867                         *chk = template;
9868                         chk->whoTo->ref_count++;
9869                         MGETHDR(chk->data, MB_WAIT, MT_DATA);
9870                         if (chk->data == NULL) {
9871                                 error = ENOMEM;
9872                                 goto temp_clean_up;
9873                         }
9874                         tot_demand = min(tot_out, frag_size);
9875                         error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9876                         if (error)
9877                                 goto temp_clean_up;
9878                         /* now fix the chk->send_size */
9879                         chk->mbcnt = mbcnt_e;
9880                         mbcnt += mbcnt_e;
9881                         mbcnt_e = 0;
9882                         chk->send_size = tot_demand;
9883                         chk->data->m_pkthdr.len = tot_demand;
9884                         chk->book_size = chk->send_size;
9885                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9886                                 asoc->sent_queue_cnt_removeable++;
9887                         }
9888                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9889                         tot_out -= tot_demand;
9890                 }
9891                 /* Now the tmp list holds all chunks and data */
9892                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9893                         /* bump the ssn if we are unordered. */
9894                         strq->next_sequence_sent++;
9895                 }
9896                 /* Mark the first/last flags. This will
9897                  * result int a 3 for a single item on the list
9898                  */
9899                 chk = TAILQ_FIRST(&tmp);
9900                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9901                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9902                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9903
9904                 /* now move it to the streams actual queue */
9905                 /* first stop protocol processing */
9906                 crit_enter();
9907                 if ((asoc->state == 0) ||
9908                     (my_vtag != asoc->my_vtag) ||
9909                     (so != inp->sctp_socket) ||
9910                     (inp->sctp_socket == 0)) {
9911                         /* connection was aborted */
9912                         crit_exit();
9913                         error = ECONNRESET;
9914                         goto temp_clean_up;
9915                 }
9916                 chk = TAILQ_FIRST(&tmp);
9917                 while (chk) {
9918                         chk->data->m_nextpkt = 0;
9919                         TAILQ_REMOVE(&tmp, chk, sctp_next);
9920                         asoc->stream_queue_cnt++;
9921                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9922                         chk = TAILQ_FIRST(&tmp);
9923                 }
9924                 /* now check if this stream is on the wheel */
9925                 if ((strq->next_spoke.tqe_next == NULL) &&
9926                     (strq->next_spoke.tqe_prev == NULL)) {
9927                         /* Insert it on the wheel since it is not
9928                          * on it currently
9929                          */
9930                         sctp_insert_on_wheel(asoc, strq);
9931                 }
9932                 /* Ok now we can allow pping */
9933                 crit_exit();
9934 temp_clean_up:
9935                 if (error) {
9936                         SOCKBUF_LOCK(&so->so_snd);
9937                         chk = TAILQ_FIRST(&tmp);
9938                         while (chk) {
9939                                 if (chk->data) {
9940                                         sctp_m_freem(chk->data);
9941                                         chk->data = NULL;
9942                                 }
9943                                 TAILQ_REMOVE(&tmp, chk, sctp_next);
9944                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9945                                 sctppcbinfo.ipi_count_chunk--;
9946                                 asoc->chunks_on_out_queue--;
9947                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9948                                         panic("Chunk count is negative");
9949                                 }
9950                                 sctppcbinfo.ipi_gencnt_chunk++;
9951                                 chk = TAILQ_FIRST(&tmp);
9952                         }
9953                         goto release;
9954                 }
9955         }
9956 zap_by_it_now:
9957 #ifdef SCTP_MBCNT_LOGGING
9958         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9959                        asoc->total_output_queue_size,
9960                        dataout,
9961                        asoc->total_output_mbuf_queue_size,
9962                        mbcnt);
9963 #endif
9964         crit_enter();
9965         SOCKBUF_LOCK(&so->so_snd);
9966         asoc->total_output_queue_size += dataout;
9967         asoc->total_output_mbuf_queue_size += mbcnt;
9968         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
9969             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
9970                 so->so_snd.ssb_cc += dataout;
9971                 so->so_snd.ssb_mbcnt += mbcnt;
9972         }
9973         if ((srcv->sinfo_flags & MSG_EOF) &&
9974             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
9975                 ) {
9976                 int some_on_streamwheel = 0;
9977                 error = 0;
9978                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
9979                         /* Check to see if some data queued */
9980                         struct sctp_stream_out *outs;
9981                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
9982                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
9983                                         some_on_streamwheel = 1;
9984                                         break;
9985                                 }
9986                         }
9987                 }
9988                 if (TAILQ_EMPTY(&asoc->send_queue) &&
9989                     TAILQ_EMPTY(&asoc->sent_queue) &&
9990                     (some_on_streamwheel == 0)) {
9991                         /* there is nothing queued to send, so I'm done... */
9992                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
9993                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
9994                                 /* only send SHUTDOWN the first time through */
9995 #ifdef SCTP_DEBUG
9996                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
9997                                         kprintf("%s:%d sends a shutdown\n",
9998                                                __FILE__,
9999                                                __LINE__
10000                                                 );
10001                                 }
10002 #endif
10003                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
10004                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
10005                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
10006                                                  asoc->primary_destination);
10007                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
10008                                                  asoc->primary_destination);
10009                         }
10010                 } else {
10011                         /*
10012                          * we still got (or just got) data to send, so set
10013                          * SHUTDOWN_PENDING
10014                          */
10015                         /*
10016                          * XXX sockets draft says that MSG_EOF should be sent
10017                          * with no data.  currently, we will allow user data
10018                          * to be sent first and move to SHUTDOWN-PENDING
10019                          */
10020                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
10021                 }
10022         }
10023         crit_exit();
10024 #ifdef SCTP_DEBUG
10025         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
10026                 kprintf("++total out:%d total_mbuf_out:%d\n",
10027                        (int)asoc->total_output_queue_size,
10028                        (int)asoc->total_output_mbuf_queue_size);
10029         }
10030 #endif
10031
10032 release:
10033         ssb_unlock(&so->so_snd);
10034 out_locked:
10035         SOCKBUF_UNLOCK(&so->so_snd);
10036 out_notlocked:
10037         if (mm)
10038                 sctp_m_freem(mm);
10039         return (error);
10040 }
10041
10042
10043 int
10044 sctp_sosend(struct socket *so,
10045 #ifdef __NetBSD__
10046             struct mbuf *addr_mbuf,
10047 #else
10048             struct sockaddr *addr,
10049 #endif
10050             struct uio *uio,
10051             struct mbuf *top,
10052             struct mbuf *control,
10053 #if defined(__NetBSD__) || defined(__APPLE__)
10054             int flags
10055 #else
10056             int flags,
10057 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10058             struct thread *p
10059 #else
10060             struct proc *p
10061 #endif
10062 #endif
10063 )
10064 {
10065         int error, use_rcvinfo;
10066         int queue_only = 0, queue_only_for_init=0;
10067         int un_sent = 0;
10068         int now_filled=0;
10069         struct sctp_inpcb *inp;
10070         struct sctp_tcb *stcb=NULL;
10071         struct sctp_sndrcvinfo srcv;
10072         struct timeval now;
10073         struct sctp_nets *net;
10074         struct sctp_association *asoc;
10075         struct sctp_inpcb *t_inp;
10076         int create_lock_applied = 0;
10077 #if defined(__APPLE__)
10078         struct proc *p = current_proc();
10079 #elif defined(__NetBSD__)
10080         struct proc *p = curproc; /* XXX */
10081         struct sockaddr *addr = NULL;
10082         if (addr_mbuf)
10083                 addr = mtod(addr_mbuf, struct sockaddr *);
10084 #endif
10085
10086         error = use_rcvinfo = 0;
10087         net = NULL;
10088         stcb = NULL;
10089         asoc = NULL;
10090         t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
10091
10092         crit_enter();
10093
10094         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
10095             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
10096                 /* The listner can NOT send */
10097                 error = EFAULT;
10098                 crit_exit();
10099                 goto out;
10100         }
10101         if (addr) {
10102                 SCTP_ASOC_CREATE_LOCK(inp);
10103                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
10104                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
10105                         /* Should I really unlock ? */
10106                         error = EFAULT;
10107                         crit_exit();
10108                         goto out;
10109
10110                 }
10111                 create_lock_applied = 1;
10112                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
10113                     (addr->sa_family == AF_INET6)) {
10114                         error = EINVAL;
10115                         crit_exit();
10116                         goto out;
10117                 }
10118         }
10119         /* now we must find the assoc */
10120         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
10121                 SCTP_INP_RLOCK(inp);
10122                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
10123                 if (stcb == NULL) {
10124                         SCTP_INP_RUNLOCK(inp);
10125                         error = ENOTCONN;
10126                         crit_exit();
10127                         goto out;
10128                 }
10129                 SCTP_TCB_LOCK(stcb);
10130                 SCTP_INP_RUNLOCK(inp);
10131                 net = stcb->asoc.primary_destination;
10132         }
10133         /* get control */
10134         if (control) {
10135                 /* process cmsg snd/rcv info (maybe a assoc-id) */
10136                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10137                                    sizeof(srcv))) {
10138                         /* got one */
10139                         if (srcv.sinfo_flags & MSG_SENDALL) {
10140                                 /* its a sendall */
10141                                 sctppcbinfo.mbuf_track--;
10142                                 sctp_m_freem(control);
10143
10144                                 if (create_lock_applied) {
10145                                         SCTP_ASOC_CREATE_UNLOCK(inp);
10146                                         create_lock_applied = 0;
10147                                 }
10148                                 return (sctp_sendall(inp, uio, top, &srcv));
10149                         }
10150                         use_rcvinfo = 1;
10151                 }
10152         }
10153         if (stcb == NULL) {
10154                 /* Need to do a lookup */
10155                 if (use_rcvinfo && srcv.sinfo_assoc_id) {
10156                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
10157                         /*
10158                          * Question: Should I error here if the assoc_id is
10159                          * no longer valid? i.e. I can't find it?
10160                          */
10161                         if ((stcb) &&
10162                             (addr != NULL)) {
10163                                 /* Must locate the net structure */
10164                                 net = sctp_findnet(stcb, addr);
10165                         }
10166                 }
10167                 if (stcb == NULL) {
10168                         if (addr != NULL) {
10169                                 /* Since we did not use findep we must
10170                                  * increment it, and if we don't find a
10171                                  * tcb decrement it.
10172                                  */
10173                                 SCTP_INP_WLOCK(inp);
10174                                 SCTP_INP_INCR_REF(inp);
10175                                 SCTP_INP_WUNLOCK(inp);
10176                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
10177                                 if (stcb == NULL) {
10178                                         SCTP_INP_WLOCK(inp);
10179                                         SCTP_INP_DECR_REF(inp);
10180                                         SCTP_INP_WUNLOCK(inp);
10181                                 }
10182                         }
10183                 }
10184         }
10185         if ((stcb == NULL) &&
10186             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
10187                 error = ENOTCONN;
10188                 crit_exit();
10189                 goto out;
10190         } else if ((stcb == NULL) && (addr == NULL)) {
10191                 error = ENOENT;
10192                 crit_exit();
10193                 goto out;
10194         } else if (stcb == NULL) {
10195                 /* UDP style, we must go ahead and start the INIT process */
10196                 if ((use_rcvinfo) &&
10197                     (srcv.sinfo_flags & MSG_ABORT)) {
10198                         /* User asks to abort a non-existant asoc */
10199                         error = ENOENT;
10200                         crit_exit();
10201                         goto out;
10202                 }
10203                 /* get an asoc/stcb struct */
10204                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
10205                 if (stcb == NULL) {
10206                         /* Error is setup for us in the call */
10207                         crit_exit();
10208                         goto out;
10209                 }
10210                 if (create_lock_applied) {
10211                         SCTP_ASOC_CREATE_UNLOCK(inp);
10212                         create_lock_applied = 0;
10213                 } else {
10214                         kprintf("Huh-3? create lock should have been on??\n");
10215                 }
10216                 /* Turn on queue only flag to prevent data from being sent */
10217                 queue_only = 1;
10218                 asoc = &stcb->asoc;
10219                 asoc->state = SCTP_STATE_COOKIE_WAIT;
10220                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
10221                 if (control) {
10222                         /* see if a init structure exists in cmsg headers */
10223                         struct sctp_initmsg initm;
10224                         int i;
10225                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
10226                                 /* we have an INIT override of the default */
10227                                 if (initm.sinit_max_attempts)
10228                                         asoc->max_init_times = initm.sinit_max_attempts;
10229                                 if (initm.sinit_num_ostreams)
10230                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
10231                                 if (initm.sinit_max_instreams)
10232                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
10233                                 if (initm.sinit_max_init_timeo)
10234                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10235                                 if (asoc->streamoutcnt < asoc->pre_open_streams) {
10236                                         /* Default is NOT correct */
10237 #ifdef SCTP_DEBUG
10238                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10239                                                 kprintf("Ok, defout:%d pre_open:%d\n",
10240                                                        asoc->streamoutcnt, asoc->pre_open_streams);
10241                                         }
10242 #endif
10243                                         kfree(asoc->strmout, M_PCB);
10244                                         asoc->strmout = NULL;
10245                                         asoc->streamoutcnt = asoc->pre_open_streams;
10246
10247                                         /* What happesn if this fails? .. we panic ...*/
10248                                         asoc->strmout =
10249                                             kmalloc(asoc->streamoutcnt *
10250                                                 sizeof(struct sctp_stream_out),
10251                                                 M_PCB, M_WAITOK);
10252                                         for (i = 0; i < asoc->streamoutcnt; i++) {
10253                                                 /*
10254                                                  * inbound side must be set to 0xffff,
10255                                                  * also NOTE when we get the INIT-ACK
10256                                                  * back (for INIT sender) we MUST
10257                                                  * reduce the count (streamoutcnt) but
10258                                                  * first check if we sent to any of the
10259                                                  * upper streams that were dropped (if
10260                                                  * some were). Those that were dropped
10261                                                  * must be notified to the upper layer
10262                                                  * as failed to send.
10263                                                  */
10264                                                 asoc->strmout[i].next_sequence_sent = 0x0;
10265                                                 TAILQ_INIT(&asoc->strmout[i].outqueue);
10266                                                 asoc->strmout[i].stream_no = i;
10267                                                 asoc->strmout[i].next_spoke.tqe_next = 0;
10268                                                 asoc->strmout[i].next_spoke.tqe_prev = 0;
10269                                         }
10270                                 }
10271                         }
10272
10273                 }
10274                 /* out with the INIT */
10275                 queue_only_for_init = 1;
10276                 sctp_send_initiate(inp, stcb);
10277                 /*
10278                  * we may want to dig in after this call and adjust the MTU
10279                  * value. It defaulted to 1500 (constant) but the ro structure
10280                  * may now have an update and thus we may need to change it
10281                  * BEFORE we append the message.
10282                  */
10283                 net = stcb->asoc.primary_destination;
10284                 asoc = &stcb->asoc;
10285         } else {
10286                 asoc = &stcb->asoc;
10287         }
10288         if (create_lock_applied) {
10289                 SCTP_ASOC_CREATE_UNLOCK(inp);
10290                 create_lock_applied = 0;
10291         }
10292         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10293             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10294                 queue_only = 1;
10295         }
10296         if (use_rcvinfo == 0) {
10297                 /* Grab the default stuff from the asoc */
10298                 srcv = stcb->asoc.def_send;
10299         }
10300         /* we are now done with all control */
10301         if (control) {
10302                 sctp_m_freem(control);
10303                 control = NULL;
10304         }
10305
10306         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10307             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10308             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10309             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10310                 if ((use_rcvinfo) &&
10311                     (srcv.sinfo_flags & MSG_ABORT)) {
10312                         ;
10313                 } else {
10314                         error = ECONNRESET;
10315                         crit_exit();
10316                         goto out;
10317                 }
10318         }
10319         /* Ok, we will attempt a msgsnd :> */
10320         if (p)
10321 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10322                 p->td_lwp->lwp_ru.ru_msgsnd++;
10323 #else
10324         p->p_stats->p_ru.ru_msgsnd++;
10325 #endif
10326
10327         if (stcb) {
10328                 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10329                         /* we take the override or the unconfirmed */
10330                         ;
10331                 } else {
10332                         net = stcb->asoc.primary_destination;
10333                 }
10334         }
10335
10336         if (top == NULL) {
10337                 /* Must copy it all in from user land. The
10338                  * socket buf is locked but we don't suspend
10339                  * protocol processing until we are ready to
10340                  * send/queue it.
10341                  */
10342                 crit_exit();
10343                 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10344                 if (error)
10345                         goto out;
10346         } else {
10347                 /* Here we must either pull in the user data to chunk
10348                  * buffers, or use top to do a msg_append.
10349                  */
10350                 error = sctp_msg_append(stcb, net, top, &srcv, flags);
10351                 crit_exit();
10352                 if (error)
10353                         goto out;
10354                 /* zap the top since it is now being used */
10355                 top = 0;
10356         }
10357
10358         if (net->flight_size > net->cwnd) {
10359                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10360                 queue_only = 1;
10361
10362         } else if (asoc->ifp_had_enobuf) {
10363                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10364                 queue_only = 1;
10365         } else {
10366                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10367                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10368                            SCTP_MED_OVERHEAD);
10369
10370                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10371                     (stcb->asoc.total_flight > 0) &&
10372                     (un_sent < (int)stcb->asoc.smallest_mtu)) {
10373
10374                         /* Ok, Nagle is set on and we have data outstanding. Don't
10375                          * send anything and let SACKs drive out the data unless we
10376                          * have a "full" segment to send.
10377                          */
10378                         sctp_pegs[SCTP_NAGLE_NOQ]++;
10379                         queue_only = 1;
10380                 } else {
10381                         sctp_pegs[SCTP_NAGLE_OFF]++;
10382                 }
10383         }
10384         if (queue_only_for_init) {
10385                 /* It is possible to have a turn around of the
10386                  * INIT/INIT-ACK/COOKIE before I have a chance to
10387                  * copy in the data. In such a case I DO want to
10388                  * send it out by reversing the queue only flag.
10389                  */
10390                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10391                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10392                         /* yep, reverse it */
10393                         queue_only = 0;
10394                 }
10395         }
10396
10397         if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10398                 /* we can attempt to send too.*/
10399 #ifdef SCTP_DEBUG
10400                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10401                         kprintf("USR Send calls sctp_chunk_output\n");
10402                 }
10403 #endif
10404                 crit_enter();
10405                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10406                 sctp_chunk_output(inp, stcb, 0);
10407                 crit_exit();
10408         } else if ((queue_only == 0) &&
10409                    (stcb->asoc.peers_rwnd == 0) &&
10410                    (stcb->asoc.total_flight == 0)) {
10411                 /* We get to have a probe outstanding */
10412                 crit_enter();
10413                 sctp_from_user_send = 1;
10414                 sctp_chunk_output(inp, stcb, 0);
10415                 sctp_from_user_send = 0;
10416                 crit_exit();
10417
10418         } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10419                 int num_out, reason, cwnd_full;
10420                 /* Here we do control only */
10421                 crit_enter();
10422                 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10423                                       &reason, 1, &cwnd_full, 1, &now, &now_filled);
10424                 crit_exit();
10425         }
10426 #ifdef SCTP_DEBUG
10427         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10428                 kprintf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10429                        queue_only, stcb->asoc.peers_rwnd, un_sent,
10430                        stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10431                        stcb->asoc.total_output_queue_size);
10432         }
10433 #endif
10434  out:
10435         if (create_lock_applied) {
10436                 SCTP_ASOC_CREATE_UNLOCK(inp);
10437                 create_lock_applied = 0;
10438         }
10439         if (stcb)
10440                 SCTP_TCB_UNLOCK(stcb);
10441         if (top)
10442                 sctp_m_freem(top);
10443         if (control)
10444                 sctp_m_freem(control);
10445         return (error);
10446 }