sys/netinet/sctp_output.c

   1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
   2
   3 /*
   4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #if !(defined(__OpenBSD__) || defined (__APPLE__))
  33 #include "opt_ipsec.h"
  34 #endif
  35 #if defined(__FreeBSD__) || defined(__DragonFly__)
  36 #include "opt_compat.h"
  37 #include "opt_inet6.h"
  38 #include "opt_inet.h"
  39 #endif
  40 #if defined(__NetBSD__)
  41 #include "opt_inet.h"
  42 #endif
  43 #ifdef __APPLE__
  44 #include <sctp.h>
  45 #elif !defined(__OpenBSD__)
  46 #include "opt_sctp.h"
  47 #endif
  48 #include <sys/param.h>
  49 #include <sys/systm.h>
  50 #include <sys/malloc.h>
  51 #include <sys/mbuf.h>
  52 #ifndef __OpenBSD__
  53 #include <sys/domain.h>
  54 #endif
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/sysctl.h>
  61 #include <sys/resourcevar.h>
  62 #include <sys/uio.h>
  63 #ifdef INET6
  64 #include <sys/domain.h>
  65 #endif
  66 #include <sys/thread2.h>
  67 #include <sys/socketvar2.h>
  68
  69 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  70 #include <sys/limits.h>
  71 #else
  72 #include <machine/limits.h>
  73 #endif
  74 #include <machine/cpu.h>
  75
  76 #include <net/if.h>
  77 #include <net/if_types.h>
  78
  79 #if defined(__FreeBSD__) || defined(__DragonFly__)
  80 #include <net/if_var.h>
  81 #endif
  82
  83 #include <net/route.h>
  84
  85 #include <netinet/in.h>
  86 #include <netinet/in_systm.h>
  87 #include <netinet/ip.h>
  88 #include <netinet/in_pcb.h>
  89 #include <netinet/in_var.h>
  90 #include <netinet/ip_var.h>
  91
  92 #ifdef INET6
  93 #include <netinet/ip6.h>
  94 #include <netinet6/ip6_var.h>
  95 #include <netinet6/scope6_var.h>
  96 #include <netinet6/nd6.h>
  97
  98 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
  99 #include <netinet6/in6_pcb.h>
 100 #elif defined(__OpenBSD__)
 101 #include <netinet/in_pcb.h>
 102 #endif
 103
 104 #include <netinet/icmp6.h>
 105
 106 #endif /* INET6 */
 107
 108 #include <net/net_osdep.h>
 109
 110 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
 111 #ifndef in6pcb
 112 #define in6pcb          inpcb
 113 #endif
 114 #endif
 115
 116 #include <netinet/sctp_pcb.h>
 117
 118 #ifdef IPSEC
 119 #ifndef __OpenBSD__
 120 #include <netinet6/ipsec.h>
 121 #include <netproto/key/key.h>
 122 #else
 123 #undef IPSEC
 124 #endif
 125 #endif /* IPSEC */
 126
 127 #include <netinet/sctp_var.h>
 128 #include <netinet/sctp_header.h>
 129 #include <netinet/sctputil.h>
 130 #include <netinet/sctp_pcb.h>
 131 #include <netinet/sctp_output.h>
 132 #include <netinet/sctp_uio.h>
 133 #include <netinet/sctputil.h>
 134 #include <netinet/sctp_hashdriver.h>
 135 #include <netinet/sctp_timer.h>
 136 #include <netinet/sctp_asconf.h>
 137 #include <netinet/sctp_indata.h>
 138
 139 #ifdef SCTP_DEBUG
 140 extern uint32_t sctp_debug_on;
 141 #endif
 142
 143 extern int sctp_peer_chunk_oh;
 144
 145 static int
 146 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
 147 {
 148         struct cmsghdr cmh;
 149         int tlen, at;
 150
 151         tlen = control->m_len;
 152         at = 0;
 153         /*
 154          * Independent of how many mbufs, find the c_type inside the control
 155          * structure and copy out the data.
 156          */
 157         while (at < tlen) {
 158                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
 159                         /* not enough room for one more we are done. */
 160                         return (0);
 161                 }
 162                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
 163                 if ((cmh.cmsg_len + at) > tlen) {
 164                         /*
 165                          * this is real messed up since there is not enough
 166                          * data here to cover the cmsg header. We are done.
 167                          */
 168                         return (0);
 169                 }
 170                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
 171                     (c_type == cmh.cmsg_type)) {
 172                         /* found the one we want, copy it out */
 173                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
 174                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
 175                                 /*
 176                                  * space of cmsg_len after header not
 177                                  * big enough
 178                                  */
 179                                 return (0);
 180                         }
 181                         m_copydata(control, at, cpsize, data);
 182                         return (1);
 183                  } else {
 184                         at += CMSG_ALIGN(cmh.cmsg_len);
 185                         if (cmh.cmsg_len == 0) {
 186                                 break;
 187                         }
 188                 }
 189         }
 190         /* not found */
 191         return (0);
 192 }
 193
 194 static struct mbuf *
 195 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
 196 {
 197         struct sctp_paramhdr *parmh;
 198         struct mbuf *mret;
 199         int len;
 200         if (ifa->ifa_addr->sa_family == AF_INET) {
 201                 len = sizeof(struct sctp_ipv4addr_param);
 202         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 203                 len = sizeof(struct sctp_ipv6addr_param);
 204         } else {
 205                 /* unknown type */
 206                 return (m);
 207         }
 208
 209         if (M_TRAILINGSPACE(m) >= len) {
 210                 /* easy side we just drop it on the end */
 211                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
 212                 mret = m;
 213         } else {
 214                 /* Need more space */
 215                 mret = m;
 216                 while (mret->m_next != NULL) {
 217                         mret = mret->m_next;
 218                 }
 219                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
 220                 if (mret->m_next == NULL) {
 221                         /* We are hosed, can't add more addresses */
 222                         return (m);
 223                 }
 224                 mret = mret->m_next;
 225                 parmh = mtod(mret, struct sctp_paramhdr *);
 226         }
 227         /* now add the parameter */
 228         if (ifa->ifa_addr->sa_family == AF_INET) {
 229                 struct sctp_ipv4addr_param *ipv4p;
 230                 struct sockaddr_in *sin;
 231                 sin = (struct sockaddr_in *)ifa->ifa_addr;
 232                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
 233                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
 234                 parmh->param_length = htons(len);
 235                 ipv4p->addr = sin->sin_addr.s_addr;
 236                 mret->m_len += len;
 237         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 238                 struct sctp_ipv6addr_param *ipv6p;
 239                 struct sockaddr_in6 *sin6;
 240                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
 241                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
 242                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
 243                 parmh->param_length = htons(len);
 244                 memcpy(ipv6p->addr, &sin6->sin6_addr,
 245                     sizeof(ipv6p->addr));
 246                 /* clear embedded scope in the address */
 247                 in6_clearscope((struct in6_addr *)ipv6p->addr);
 248                 mret->m_len += len;
 249         } else {
 250                 return (m);
 251         }
 252         return (mret);
 253 }
 254
 255
 256
 257 static struct mbuf *
 258 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
 259     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
 260 {
 261         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
 262         struct sctp_state_cookie *stc;
 263         struct sctp_paramhdr *ph;
 264         uint8_t *signature;
 265         int sig_offset;
 266         uint16_t cookie_sz;
 267
 268         mret = NULL;
 269
 270         MGET(mret, MB_DONTWAIT, MT_DATA);
 271         if (mret == NULL) {
 272                 return (NULL);
 273         }
 274         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
 275         if (copy_init == NULL) {
 276                 sctp_m_freem(mret);
 277                 return (NULL);
 278         }
 279         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
 280             MB_DONTWAIT);
 281         if (copy_initack == NULL) {
 282                 sctp_m_freem(mret);
 283                 sctp_m_freem(copy_init);
 284                 return (NULL);
 285         }
 286         /* easy side we just drop it on the end */
 287         ph = mtod(mret, struct sctp_paramhdr *);
 288         mret->m_len = sizeof(struct sctp_state_cookie) +
 289             sizeof(struct sctp_paramhdr);
 290         stc = (struct sctp_state_cookie *)((caddr_t)ph +
 291             sizeof(struct sctp_paramhdr));
 292         ph->param_type = htons(SCTP_STATE_COOKIE);
 293         ph->param_length = 0;   /* fill in at the end */
 294         /* Fill in the stc cookie data */
 295         *stc = *stc_in;
 296
 297         /* tack the INIT and then the INIT-ACK onto the chain */
 298         cookie_sz = 0;
 299         m_at = mret;
 300         for (m_at = mret; m_at; m_at = m_at->m_next) {
 301                 cookie_sz += m_at->m_len;
 302                 if (m_at->m_next == NULL) {
 303                         m_at->m_next = copy_init;
 304                         break;
 305                 }
 306         }
 307
 308         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
 309                 cookie_sz += m_at->m_len;
 310                 if (m_at->m_next == NULL) {
 311                         m_at->m_next = copy_initack;
 312                         break;
 313                 }
 314         }
 315
 316         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
 317                 cookie_sz += m_at->m_len;
 318                 if (m_at->m_next == NULL) {
 319                         break;
 320                 }
 321         }
 322         MGET(sig, MB_DONTWAIT, MT_DATA);
 323         if (sig == NULL) {
 324                 /* no space */
 325                 sctp_m_freem(mret);
 326                 sctp_m_freem(copy_init);
 327                 sctp_m_freem(copy_initack);
 328                 return (NULL);
 329         }
 330         sig->m_len = 0;
 331         m_at->m_next = sig;
 332         sig_offset = 0;
 333         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
 334         /* Time to sign the cookie */
 335         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
 336             (int)(inp->sctp_ep.current_secret_number)],
 337             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
 338             (uint8_t *)signature);
 339         sig->m_len += SCTP_SIGNATURE_SIZE;
 340         cookie_sz += SCTP_SIGNATURE_SIZE;
 341
 342         ph->param_length = htons(cookie_sz);
 343         return (mret);
 344 }
 345
 346
 347 static struct sockaddr_in *
 348 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 349 {
 350         struct sockaddr_in *sin;
 351         /*
 352          * Here we determine if its a prefered address. A
 353          * prefered address means it is the same scope or
 354          * higher scope then the destination.
 355          *  L = loopback, P = private, G = global
 356          * -----------------------------------------
 357          *  src    |      dest     |    result
 358          *-----------------------------------------
 359          *   L     |       L       |    yes
 360          *-----------------------------------------
 361          *   P     |       L       |    yes
 362          *-----------------------------------------
 363          *   G     |       L       |    yes
 364          *-----------------------------------------
 365          *   L     |       P       |    no
 366          *-----------------------------------------
 367          *   P     |       P       |    yes
 368          *-----------------------------------------
 369          *   G     |       P       |    no
 370          *-----------------------------------------
 371          *   L     |       G       |    no
 372          *-----------------------------------------
 373          *   P     |       G       |    no
 374          *-----------------------------------------
 375          *   G     |       G       |    yes
 376          *-----------------------------------------
 377          */
 378
 379         if (ifa->ifa_addr->sa_family != AF_INET) {
 380                 /* forget non-v4 */
 381                 return (NULL);
 382         }
 383         /* Ok the address may be ok */
 384         sin = (struct sockaddr_in *)ifa->ifa_addr;
 385         if (sin->sin_addr.s_addr == 0) {
 386                 return (NULL);
 387         }
 388         *sin_local = *sin_loop = 0;
 389         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 390             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 391                 *sin_loop = 1;
 392                 *sin_local = 1;
 393         }
 394         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 395                 *sin_local = 1;
 396         }
 397         if (!loopscope && *sin_loop) {
 398                 /* Its a loopback address and we don't have loop scope */
 399                 return (NULL);
 400         }
 401         if (!ipv4_scope && *sin_local) {
 402                 /* Its a private address, and we don't have private address scope */
 403                 return (NULL);
 404         }
 405         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
 406                 /* its a global src and a private dest */
 407                 return (NULL);
 408         }
 409         /* its a prefered address */
 410         return (sin);
 411 }
 412
 413 static struct sockaddr_in *
 414 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 415 {
 416         struct sockaddr_in *sin;
 417         /*
 418          * Here we determine if its a acceptable address. A
 419          * acceptable address means it is the same scope or
 420          * higher scope but we can allow for NAT which means
 421          * its ok to have a global dest and a private src.
 422          *
 423          *  L = loopback, P = private, G = global
 424          * -----------------------------------------
 425          *  src    |      dest     |    result
 426          *-----------------------------------------
 427          *   L     |       L       |    yes
 428          *-----------------------------------------
 429          *   P     |       L       |    yes
 430          *-----------------------------------------
 431          *   G     |       L       |    yes
 432          *-----------------------------------------
 433          *   L     |       P       |    no
 434          *-----------------------------------------
 435          *   P     |       P       |    yes
 436          *-----------------------------------------
 437          *   G     |       P       |    yes - probably this won't work.
 438          *-----------------------------------------
 439          *   L     |       G       |    no
 440          *-----------------------------------------
 441          *   P     |       G       |    yes
 442          *-----------------------------------------
 443          *   G     |       G       |    yes
 444          *-----------------------------------------
 445          */
 446
 447         if (ifa->ifa_addr->sa_family != AF_INET) {
 448                 /* forget non-v4 */
 449                 return (NULL);
 450         }
 451         /* Ok the address may be ok */
 452         sin = (struct sockaddr_in *)ifa->ifa_addr;
 453         if (sin->sin_addr.s_addr == 0) {
 454                 return (NULL);
 455         }
 456         *sin_local = *sin_loop = 0;
 457         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 458             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 459                 *sin_loop = 1;
 460                 *sin_local = 1;
 461         }
 462         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 463                 *sin_local = 1;
 464         }
 465         if (!loopscope && *sin_loop) {
 466                 /* Its a loopback address and we don't have loop scope */
 467                 return (NULL);
 468         }
 469         /* its an acceptable address */
 470         return (sin);
 471 }
 472
 473 /*
 474  * This treats the address list on the ep as a restricted list
 475  * (negative list). If a the passed address is listed, then
 476  * the address is NOT allowed on the association.
 477  */
 478 int
 479 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
 480 {
 481         struct sctp_laddr *laddr;
 482 #ifdef SCTP_DEBUG
 483         int cnt=0;
 484 #endif
 485         if (stcb == NULL) {
 486                 /* There are no restrictions, no TCB :-) */
 487                 return (0);
 488         }
 489 #ifdef SCTP_DEBUG
 490         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 491                 cnt++;
 492         }
 493         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 494                 kprintf("There are %d addresses on the restricted list\n", cnt);
 495         }
 496         cnt = 0;
 497 #endif
 498         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 499                 if (laddr->ifa == NULL) {
 500 #ifdef SCTP_DEBUG
 501                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 502                                 kprintf("Help I have fallen and I can't get up!\n");
 503                         }
 504 #endif
 505                         continue;
 506                 }
 507 #ifdef SCTP_DEBUG
 508                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 509                         cnt++;
 510                         kprintf("Restricted address[%d]:", cnt);
 511                         sctp_print_address(laddr->ifa->ifa_addr);
 512                 }
 513 #endif
 514                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
 515                         /* Yes it is on the list */
 516                         return (1);
 517                 }
 518         }
 519         return (0);
 520 }
 521
 522 static int
 523 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 524 {
 525         struct sctp_laddr *laddr;
 526
 527         if (ifa == NULL)
 528                 return (0);
 529         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 530                 if (laddr->ifa == NULL) {
 531 #ifdef SCTP_DEBUG
 532                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 533                                 kprintf("Help I have fallen and I can't get up!\n");
 534                         }
 535 #endif
 536                         continue;
 537                 }
 538                 if (laddr->ifa->ifa_addr == NULL)
 539                         continue;
 540                 if (laddr->ifa == ifa)
 541                         /* same pointer */
 542                         return (1);
 543                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
 544                         /* skip non compatible address comparison */
 545                         continue;
 546                 }
 547                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 548                         /* Yes it is restricted */
 549                         return (1);
 550                 }
 551         }
 552         return (0);
 553 }
 554
 555
 556
 557 static struct in_addr
 558 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
 559                                  struct rtentry *rt,
 560                                  uint8_t ipv4_scope,
 561                                  uint8_t loopscope)
 562 {
 563         struct in_addr ans;
 564         struct sctp_laddr *laddr;
 565         struct sockaddr_in *sin;
 566         struct ifnet *ifn;
 567         uint8_t sin_loop, sin_local;
 568
 569         /* first question, is the ifn we will emit on
 570          * in our list, if so, we want that one.
 571          */
 572         ifn = rt->rt_ifp;
 573         if (ifn) {
 574                 struct ifaddr_container *ifac;
 575
 576                 /* is a prefered one on the interface we route out? */
 577                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 578                         struct ifaddr *ifa = ifac->ifa;
 579
 580                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 581                         if (sin == NULL)
 582                                 continue;
 583                         if (sctp_is_addr_in_ep(inp, ifa)) {
 584                                 return (sin->sin_addr);
 585                         }
 586                 }
 587                 /* is an acceptable one on the interface we route out? */
 588                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 589                         struct ifaddr *ifa = ifac->ifa;
 590
 591                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 592                         if (sin == NULL)
 593                                 continue;
 594                         if (sctp_is_addr_in_ep(inp, ifa)) {
 595                                 return (sin->sin_addr);
 596                         }
 597                 }
 598         }
 599         /* ok, what about a prefered address in the inp */
 600         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 601              laddr && (laddr != inp->next_addr_touse);
 602              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 603                 if (laddr->ifa == NULL) {
 604                         /* address has been removed */
 605                         continue;
 606                 }
 607                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 608                 if (sin == NULL)
 609                         continue;
 610                 return (sin->sin_addr);
 611
 612         }
 613         /* ok, what about an acceptable address in the inp */
 614         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 615              laddr && (laddr != inp->next_addr_touse);
 616              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 617                 if (laddr->ifa == NULL) {
 618                         /* address has been removed */
 619                         continue;
 620                 }
 621                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 622                 if (sin == NULL)
 623                         continue;
 624                 return (sin->sin_addr);
 625
 626         }
 627
 628         /* no address bound can be a source for the destination we are in trouble */
 629 #ifdef SCTP_DEBUG
 630         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 631                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
 632         }
 633 #endif
 634         memset(&ans, 0, sizeof(ans));
 635         return (ans);
 636 }
 637
 638
 639
 640 static struct in_addr
 641 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
 642                                   struct sctp_tcb *stcb,
 643                                   struct sctp_nets *net,
 644                                   struct rtentry *rt,
 645                                   uint8_t ipv4_scope,
 646                                   uint8_t loopscope,
 647                                   int non_asoc_addr_ok)
 648 {
 649         /*
 650          * Here we have two cases, bound all asconf
 651          * allowed. bound all asconf not allowed.
 652          *
 653          */
 654         struct sctp_laddr *laddr, *starting_point;
 655         struct in_addr ans;
 656         struct ifnet *ifn;
 657         uint8_t sin_loop, sin_local, start_at_beginning=0;
 658         struct sockaddr_in *sin;
 659
 660         /* first question, is the ifn we will emit on
 661          * in our list, if so, we want that one.
 662          */
 663         ifn = rt->rt_ifp;
 664
 665         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
 666                 /*
 667                  * Here we use the list of addresses on the endpoint. Then
 668                  * the addresses listed on the "restricted" list is just that,
 669                  * address that have not been added and can't be used (unless
 670                  * the non_asoc_addr_ok is set).
 671                  */
 672 #ifdef SCTP_DEBUG
 673                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 674                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
 675                 }
 676 #endif
 677                 /* first question, is the ifn we will emit on
 678                  * in our list, if so, we want that one.
 679                  */
 680                 if (ifn) {
 681                         struct ifaddr_container *ifac;
 682
 683                         /* first try for an prefered address on the ep */
 684                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 685                                 struct ifaddr *ifa = ifac->ifa;
 686
 687                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 688                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 689                                         if (sin == NULL)
 690                                                 continue;
 691                                         if ((non_asoc_addr_ok == 0) &&
 692                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 693                                                 /* on the no-no list */
 694                                                 continue;
 695                                         }
 696                                         return (sin->sin_addr);
 697                                 }
 698                         }
 699                         /* next try for an acceptable address on the ep */
 700                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 701                                 struct ifaddr *ifa = ifac->ifa;
 702
 703                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 704                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 705                                         if (sin == NULL)
 706                                                 continue;
 707                                         if ((non_asoc_addr_ok == 0) &&
 708                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 709                                                 /* on the no-no list */
 710                                                 continue;
 711                                         }
 712                                         return (sin->sin_addr);
 713                                 }
 714                         }
 715
 716                 }
 717                 /* if we can't find one like that then we must
 718                  * look at all addresses bound to pick one at
 719                  * first prefereable then secondly acceptable.
 720                  */
 721                 starting_point = stcb->asoc.last_used_address;
 722         sctpv4_from_the_top:
 723                 if (stcb->asoc.last_used_address == NULL) {
 724                         start_at_beginning=1;
 725                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 726                 }
 727                 /* search beginning with the last used address */
 728                 for (laddr = stcb->asoc.last_used_address; laddr;
 729                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 730                         if (laddr->ifa == NULL) {
 731                                 /* address has been removed */
 732                                 continue;
 733                         }
 734                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 735                         if (sin == NULL)
 736                                 continue;
 737                         if ((non_asoc_addr_ok == 0) &&
 738                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 739                                 /* on the no-no list */
 740                                 continue;
 741                         }
 742                         return (sin->sin_addr);
 743
 744                 }
 745                 if (start_at_beginning == 0) {
 746                         stcb->asoc.last_used_address = NULL;
 747                         goto sctpv4_from_the_top;
 748                 }
 749                 /* now try for any higher scope than the destination */
 750                 stcb->asoc.last_used_address = starting_point;
 751                 start_at_beginning = 0;
 752         sctpv4_from_the_top2:
 753                 if (stcb->asoc.last_used_address == NULL) {
 754                         start_at_beginning=1;
 755                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 756                 }
 757                 /* search beginning with the last used address */
 758                 for (laddr = stcb->asoc.last_used_address; laddr;
 759                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 760                         if (laddr->ifa == NULL) {
 761                                 /* address has been removed */
 762                                 continue;
 763                         }
 764                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 765                         if (sin == NULL)
 766                                 continue;
 767                         if ((non_asoc_addr_ok == 0) &&
 768                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 769                                 /* on the no-no list */
 770                                 continue;
 771                         }
 772                         return (sin->sin_addr);
 773                 }
 774                 if (start_at_beginning == 0) {
 775                         stcb->asoc.last_used_address = NULL;
 776                         goto sctpv4_from_the_top2;
 777                 }
 778         } else {
 779                 /*
 780                  * Here we have an address list on the association, thats the
 781                  * only valid source addresses that we can use.
 782                  */
 783 #ifdef SCTP_DEBUG
 784                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 785                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
 786                 }
 787 #endif
 788                 /* First look at all addresses for one that is on
 789                  * the interface we route out
 790                  */
 791                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 792                              sctp_nxt_addr) {
 793                         if (laddr->ifa == NULL) {
 794                                 /* address has been removed */
 795                                 continue;
 796                         }
 797                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 798                         if (sin == NULL)
 799                                 continue;
 800                         /* first question, is laddr->ifa an address associated with the emit interface */
 801                         if (ifn) {
 802                                 struct ifaddr_container *ifac;
 803
 804                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 805                                         struct ifaddr *ifa = ifac->ifa;
 806
 807                                         if (laddr->ifa == ifa) {
 808                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 809                                                 return (sin->sin_addr);
 810                                         }
 811                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 812                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 813                                                 return (sin->sin_addr);
 814                                         }
 815                                 }
 816                         }
 817                 }
 818                 /* what about an acceptable one on the interface? */
 819                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 820                              sctp_nxt_addr) {
 821                         if (laddr->ifa == NULL) {
 822                                 /* address has been removed */
 823                                 continue;
 824                         }
 825                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 826                         if (sin == NULL)
 827                                 continue;
 828                         /* first question, is laddr->ifa an address associated with the emit interface */
 829                         if (ifn) {
 830                                 struct ifaddr_container *ifac;
 831
 832                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 833                                         struct ifaddr *ifa = ifac->ifa;
 834
 835                                         if (laddr->ifa == ifa) {
 836                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 837                                                 return (sin->sin_addr);
 838                                         }
 839                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 840                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 841                                                 return (sin->sin_addr);
 842                                         }
 843                                 }
 844                         }
 845                 }
 846                 /* ok, next one that is preferable in general */
 847                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 848                              sctp_nxt_addr) {
 849                         if (laddr->ifa == NULL) {
 850                                 /* address has been removed */
 851                                 continue;
 852                         }
 853                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 854                         if (sin == NULL)
 855                                 continue;
 856                         return (sin->sin_addr);
 857                 }
 858
 859                 /* last, what about one that is acceptable */
 860                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 861                              sctp_nxt_addr) {
 862                         if (laddr->ifa == NULL) {
 863                                 /* address has been removed */
 864                                 continue;
 865                         }
 866                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 867                         if (sin == NULL)
 868                                 continue;
 869                         return (sin->sin_addr);
 870                 }
 871         }
 872         memset(&ans, 0, sizeof(ans));
 873         return (ans);
 874 }
 875
 876 static struct sockaddr_in *
 877 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 878                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
 879 {
 880         struct ifaddr_container *ifac;
 881         struct sockaddr_in *sin;
 882         uint8_t sin_loop, sin_local;
 883         int num_eligible_addr = 0;
 884
 885         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 886                 struct ifaddr *ifa = ifac->ifa;
 887
 888                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 889                 if (sin == NULL)
 890                         continue;
 891                 if (stcb) {
 892                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 893                                 /* It is restricted for some reason.. probably
 894                                  * not yet added.
 895                                  */
 896                                 continue;
 897                         }
 898                 }
 899                 if (cur_addr_num == num_eligible_addr) {
 900                         return (sin);
 901                 }
 902         }
 903         return (NULL);
 904 }
 905
 906
 907 static int
 908 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 909                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 910 {
 911         struct ifaddr_container *ifac;
 912         struct sockaddr_in *sin;
 913         int num_eligible_addr = 0;
 914
 915         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 916                 struct ifaddr *ifa = ifac->ifa;
 917
 918                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
 919                 if (sin == NULL)
 920                         continue;
 921                 if (stcb) {
 922                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 923                                 /* It is restricted for some reason.. probably
 924                                  * not yet added.
 925                                  */
 926                                 continue;
 927                         }
 928                 }
 929                 num_eligible_addr++;
 930         }
 931         return (num_eligible_addr);
 932
 933 }
 934
 935 static struct in_addr
 936 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
 937                         struct sctp_tcb *stcb,
 938                         struct sctp_nets *net,
 939                         struct rtentry *rt,
 940                         uint8_t ipv4_scope,
 941                         uint8_t loopscope,
 942                         int non_asoc_addr_ok)
 943 {
 944         int cur_addr_num=0, num_prefered=0;
 945         uint8_t sin_loop, sin_local;
 946         struct ifnet *ifn;
 947         struct sockaddr_in *sin;
 948         struct in_addr ans;
 949         struct ifaddr_container *ifac;
 950         /*
 951          * For v4 we can use (in boundall) any address in the association. If
 952          * non_asoc_addr_ok is set we can use any address (at least in theory).
 953          * So we look for prefered addresses first. If we find one, we use it.
 954          * Otherwise we next try to get an address on the interface, which we
 955          * should be able to do (unless non_asoc_addr_ok is false and we are
 956          * routed out that way). In these cases where we can't use the address
 957          * of the interface we go through all the ifn's looking for an address
 958          * we can use and fill that in. Punting means we send back address
 959          * 0, which will probably cause problems actually since then IP will
 960          * fill in the address of the route ifn, which means we probably already
 961          * rejected it.. i.e. here comes an abort :-<.
 962          */
 963         ifn = rt->rt_ifp;
 964         if (net) {
 965                 cur_addr_num = net->indx_of_eligible_next_to_use;
 966         }
 967         if (ifn == NULL) {
 968                 goto bound_all_v4_plan_c;
 969         }
 970         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
 971 #ifdef SCTP_DEBUG
 972         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 973                 kprintf("Found %d preferred source addresses\n", num_prefered);
 974         }
 975 #endif
 976         if (num_prefered == 0) {
 977                 /* no eligible addresses, we must use some other
 978                  * interface address if we can find one.
 979                  */
 980                 goto bound_all_v4_plan_b;
 981         }
 982         /* Ok we have num_eligible_addr set with how many we can use,
 983          * this may vary from call to call due to addresses being deprecated etc..
 984          */
 985         if (cur_addr_num >= num_prefered) {
 986                 cur_addr_num = 0;
 987         }
 988         /* select the nth address from the list (where cur_addr_num is the nth) and
 989          * 0 is the first one, 1 is the second one etc...
 990          */
 991 #ifdef SCTP_DEBUG
 992         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 993                 kprintf("cur_addr_num:%d\n", cur_addr_num);
 994         }
 995 #endif
 996         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
 997                                                                    ipv4_scope, cur_addr_num);
 998
 999         /* if sin is NULL something changed??, plan_a now */
1000         if (sin) {
1001                 return (sin->sin_addr);
1002         }
1003
1004         /*
1005          * plan_b: Look at the interface that we emit on
1006          *         and see if we can find an acceptable address.
1007          */
1008  bound_all_v4_plan_b:
1009         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1010                 struct ifaddr *ifa = ifac->ifa;
1011
1012                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1013                 if (sin == NULL)
1014                         continue;
1015                 if (stcb) {
1016                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1017                                 /* It is restricted for some reason.. probably
1018                                  * not yet added.
1019                                  */
1020                                 continue;
1021                         }
1022                 }
1023                 return (sin->sin_addr);
1024         }
1025         /*
1026          * plan_c: Look at all interfaces and find a prefered
1027          *         address. If we reache here we are in trouble I think.
1028          */
1029  bound_all_v4_plan_c:
1030         for (ifn = TAILQ_FIRST(&ifnet);
1031              ifn && (ifn != inp->next_ifn_touse);
1032              ifn=TAILQ_NEXT(ifn, if_list)) {
1033                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1034                         /* wrong base scope */
1035                         continue;
1036                 }
1037                 if (ifn == rt->rt_ifp)
1038                         /* already looked at this guy */
1039                         continue;
1040                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1041                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1042 #ifdef SCTP_DEBUG
1043                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1044                         kprintf("Found ifn:%p %d preferred source addresses\n", ifn, num_prefered);
1045                 }
1046 #endif
1047                 if (num_prefered == 0) {
1048                         /*
1049                          * None on this interface.
1050                          */
1051                         continue;
1052                 }
1053                 /* Ok we have num_eligible_addr set with how many we can use,
1054                  * this may vary from call to call due to addresses being deprecated etc..
1055                  */
1056                 if (cur_addr_num >= num_prefered) {
1057                         cur_addr_num = 0;
1058                 }
1059                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1060                                                                           ipv4_scope, cur_addr_num);
1061                 if (sin == NULL)
1062                         continue;
1063                 return (sin->sin_addr);
1064
1065         }
1066
1067         /*
1068          * plan_d: We are in deep trouble. No prefered address on
1069          *         any interface. And the emit interface does not
1070          *         even have an acceptable address. Take anything
1071          *         we can get! If this does not work we are
1072          *         probably going to emit a packet that will
1073          *         illicit an ABORT, falling through.
1074          */
1075
1076         for (ifn = TAILQ_FIRST(&ifnet);
1077              ifn && (ifn != inp->next_ifn_touse);
1078              ifn=TAILQ_NEXT(ifn, if_list)) {
1079                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1080                         /* wrong base scope */
1081                         continue;
1082                 }
1083                 if (ifn == rt->rt_ifp)
1084                         /* already looked at this guy */
1085                         continue;
1086
1087                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1088                         struct ifaddr *ifa = ifac->ifa;
1089
1090                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1091                         if (sin == NULL)
1092                                 continue;
1093                         if (stcb) {
1094                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1095                                         /* It is restricted for some reason.. probably
1096                                          * not yet added.
1097                                          */
1098                                         continue;
1099                                 }
1100                         }
1101                         return (sin->sin_addr);
1102                 }
1103         }
1104         /*
1105          * Ok we can find NO address to source from that is
1106          * not on our negative list. It is either the special
1107          * ASCONF case where we are sourceing from a intf that
1108          * has been ifconfig'd to a different address (i.e.
1109          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1110          * address. OR we are hosed, and this baby is going
1111          * to abort the association.
1112          */
1113         if (non_asoc_addr_ok) {
1114                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1115         } else {
1116                 memset(&ans, 0, sizeof(ans));
1117                 return (ans);
1118         }
1119 }
1120
1121
1122
1123 /* tcb may be NULL */
1124 struct in_addr
1125 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1126     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1127     int non_asoc_addr_ok)
1128 {
1129         struct in_addr ans;
1130         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1131         uint8_t ipv4_scope, loopscope;
1132         /*
1133          * Rules:
1134          * - Find the route if needed, cache if I can.
1135          * - Look at interface address in route, Is it
1136          *   in the bound list. If so we have the best source.
1137          * - If not we must rotate amongst the addresses.
1138          *
1139          * Cavets and issues
1140          *
1141          * Do we need to pay attention to scope. We can have
1142          * a private address or a global address we are sourcing
1143          * or sending to. So if we draw it out
1144          *      source     *      dest   *  result
1145          *  ------------------------------------------
1146          *  a   Private    *     Global  *  NAT?
1147          *  ------------------------------------------
1148          *  b   Private    *     Private *  No problem
1149          *  ------------------------------------------
1150          *  c   Global     *     Private *  Huh, How will this work?
1151          *  ------------------------------------------
1152          *  d   Global     *     Global  *  No Problem
1153          *  ------------------------------------------
1154          *
1155          * And then we add to that what happens if there are multiple
1156          * addresses assigned to an interface. Remember the ifa on a
1157          * ifn is a linked list of addresses. So one interface can
1158          * have more than one IPv4 address. What happens if we
1159          * have both a private and a global address? Do we then
1160          * use context of destination to sort out which one is
1161          * best? And what about NAT's sending P->G may get you
1162          * a NAT translation, or should you select the G thats
1163          * on the interface in preference.
1164          *
1165          * Decisions:
1166          *
1167          *  - count the number of addresses on the interface.
1168          *  - if its one, no problem except case <c>. For <a>
1169          *    we will assume a NAT out there.
1170          *  - if there are more than one, then we need to worry
1171          *    about scope P or G. We should prefer G -> G and
1172          *    P -> P if possible. Then as a secondary fall back
1173          *    to mixed types G->P being a last ditch one.
1174          *  - The above all works for bound all, but bound
1175          *    specific we need to use the same concept but instead
1176          *    only consider the bound addresses. If the bound set
1177          *    is NOT assigned to the interface then we must use
1178          *    rotation amongst them.
1179          *
1180          * Notes: For v4, we can always punt and let ip_output
1181          * decide by sending back a source of 0.0.0.0
1182          */
1183
1184         if (ro->ro_rt == NULL) {
1185                 /*
1186                  * Need a route to cache.
1187                  *
1188                  */
1189 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1190                 rtalloc_ign(ro, 0UL);
1191 #else
1192                 rtalloc(ro);
1193 #endif
1194         }
1195         if (ro->ro_rt == NULL) {
1196                 /* No route to host .. punt */
1197                 memset(&ans, 0, sizeof(ans));
1198                 return (ans);
1199         }
1200         /* Setup our scopes */
1201         if (stcb) {
1202                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1203                 loopscope = stcb->asoc.loopback_scope;
1204         } else {
1205                 /* Scope based on outbound address */
1206                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1207                         ipv4_scope = 1;
1208                         loopscope = 0;
1209                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1210                         ipv4_scope = 1;
1211                         loopscope = 1;
1212                 } else {
1213                         ipv4_scope = 0;
1214                         loopscope = 0;
1215                 }
1216         }
1217 #ifdef SCTP_DEBUG
1218         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1219                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1220                        loopscope, ipv4_scope);
1221         }
1222 #endif
1223         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1224                 /*
1225                  * When bound to all if the address list is set
1226                  * it is a negative list. Addresses being added
1227                  * by asconf.
1228                  */
1229                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1230                     ipv4_scope, loopscope, non_asoc_addr_ok));
1231         }
1232         /*
1233          * Three possiblities here:
1234          *
1235          * a) stcb is NULL, which means we operate only from
1236          *    the list of addresses (ifa's) bound to the assoc and
1237          *    we care not about the list.
1238          * b) stcb is NOT-NULL, which means we have an assoc structure and
1239          *    auto-asconf is on. This means that the list of addresses is
1240          *    a NOT list. We use the list from the inp, but any listed address
1241          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1242          *    set we CAN use an address NOT available (i.e. being added). Its
1243          *    a negative list.
1244          * c) stcb is NOT-NULL, which means we have an assoc structure and
1245          *    auto-asconf is off. This means that the list of addresses is
1246          *    the ONLY addresses I can use.. its positive.
1247          *
1248          *    Note we collapse b & c into the same function just like in
1249          *    the v6 address selection.
1250          */
1251         if (stcb) {
1252                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1253                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1254         } else {
1255                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1256                     ipv4_scope, loopscope));
1257         }
1258         /* this should not be reached */
1259         memset(&ans, 0, sizeof(ans));
1260         return (ans);
1261 }
1262
1263
1264
1265 static struct sockaddr_in6 *
1266 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1267 {
1268         struct in6_ifaddr *ifa6;
1269         struct sockaddr_in6 *sin6;
1270
1271         if (ifa->ifa_addr->sa_family != AF_INET6) {
1272                 /* forget non-v6 */
1273                 return (NULL);
1274         }
1275         ifa6 = (struct in6_ifaddr *)ifa;
1276         /* ok to use deprecated addresses? */
1277         if (!ip6_use_deprecated) {
1278                 if (IFA6_IS_DEPRECATED(ifa6)) {
1279                         /* can't use this type */
1280                         return (NULL);
1281                 }
1282         }
1283         /* are we ok, with the current state of this address? */
1284         if (ifa6->ia6_flags &
1285             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1286                 /* Can't use these types */
1287                 return (NULL);
1288         }
1289         /* Ok the address may be ok */
1290         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1291         *sin_local = *sin_loop = 0;
1292         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1293             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1294                 *sin_loop = 1;
1295         }
1296         if (!loopscope && *sin_loop) {
1297                 /* Its a loopback address and we don't have loop scope */
1298                 return (NULL);
1299         }
1300         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1301                 /* we skip unspecifed addresses */
1302                 return (NULL);
1303         }
1304
1305         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1306                 *sin_local = 1;
1307         }
1308         if (!loc_scope && *sin_local) {
1309                 /* Its a link local address, and we don't have link local scope */
1310                 return (NULL);
1311         }
1312         return (sin6);
1313 }
1314
1315
1316 static struct sockaddr_in6 *
1317 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1318                                   struct sctp_tcb *stcb,
1319                                   struct sctp_nets *net,
1320                                   struct rtentry *rt,
1321                                   uint8_t loc_scope,
1322                                   uint8_t loopscope,
1323                                   int non_asoc_addr_ok)
1324 {
1325         /*
1326          *   Each endpoint has a list of local addresses associated
1327          *   with it. The address list is either a "negative list" i.e.
1328          *   those addresses that are NOT allowed to be used as a source OR
1329          *   a "postive list" i.e. those addresses that CAN be used.
1330          *
1331          *   Its a negative list if asconf is allowed. What we do
1332          *   in this case is use the ep address list BUT we have
1333          *   to cross check it against the negative list.
1334          *
1335          *   In the case where NO asconf is allowed, we have just
1336          *   a straight association level list that we must use to
1337          *   find a source address.
1338          */
1339         struct sctp_laddr *laddr, *starting_point;
1340         struct sockaddr_in6 *sin6;
1341         int sin_loop, sin_local;
1342         int start_at_beginning=0;
1343         struct ifnet *ifn;
1344
1345         ifn = rt->rt_ifp;
1346         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1347 #ifdef SCTP_DEBUG
1348                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1349                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1350                 }
1351 #endif
1352                 /* first question, is the ifn we will emit on
1353                  * in our list, if so, we want that one.
1354                  */
1355                 if (ifn) {
1356                         struct ifaddr_container *ifac;
1357
1358                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1359                                 struct ifaddr *ifa = ifac->ifa;
1360
1361                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1362                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1363                                         if (sin6 == NULL)
1364                                                 continue;
1365                                         if ((non_asoc_addr_ok == 0) &&
1366                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1367                                                 /* on the no-no list */
1368                                                 continue;
1369                                         }
1370                                         return (sin6);
1371                                 }
1372                         }
1373                 }
1374                 starting_point = stcb->asoc.last_used_address;
1375                 /* First try for matching scope */
1376         sctp_from_the_top:
1377                 if (stcb->asoc.last_used_address == NULL) {
1378                         start_at_beginning=1;
1379                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1380                 }
1381                 /* search beginning with the last used address */
1382                 for (laddr = stcb->asoc.last_used_address; laddr;
1383                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1384                         if (laddr->ifa == NULL) {
1385                                 /* address has been removed */
1386                                 continue;
1387                         }
1388                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1389                         if (sin6 == NULL)
1390                                 continue;
1391                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1392                                 /* on the no-no list */
1393                                 continue;
1394                         }
1395                         /* is it of matching scope ? */
1396                         if ((loopscope == 0) &&
1397                             (loc_scope == 0) &&
1398                             (sin_loop == 0) &&
1399                             (sin_local == 0)) {
1400                                 /* all of global scope we are ok with it */
1401                                 return (sin6);
1402                         }
1403                         if (loopscope && sin_loop)
1404                                 /* both on the loopback, thats ok */
1405                                 return (sin6);
1406                         if (loc_scope && sin_local)
1407                                 /* both local scope */
1408                                 return (sin6);
1409
1410                 }
1411                 if (start_at_beginning == 0) {
1412                         stcb->asoc.last_used_address = NULL;
1413                         goto sctp_from_the_top;
1414                 }
1415                 /* now try for any higher scope than the destination */
1416                 stcb->asoc.last_used_address = starting_point;
1417                 start_at_beginning = 0;
1418         sctp_from_the_top2:
1419                 if (stcb->asoc.last_used_address == NULL) {
1420                         start_at_beginning=1;
1421                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1422                 }
1423                 /* search beginning with the last used address */
1424                 for (laddr = stcb->asoc.last_used_address; laddr;
1425                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1426                         if (laddr->ifa == NULL) {
1427                                 /* address has been removed */
1428                                 continue;
1429                         }
1430                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1431                         if (sin6 == NULL)
1432                                 continue;
1433                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1434                                 /* on the no-no list */
1435                                 continue;
1436                         }
1437                         return (sin6);
1438                 }
1439                 if (start_at_beginning == 0) {
1440                         stcb->asoc.last_used_address = NULL;
1441                         goto sctp_from_the_top2;
1442                 }
1443         } else {
1444 #ifdef SCTP_DEBUG
1445                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1446                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
1447                 }
1448 #endif
1449                 /* First try for interface output match */
1450                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1451                              sctp_nxt_addr) {
1452                         if (laddr->ifa == NULL) {
1453                                 /* address has been removed */
1454                                 continue;
1455                         }
1456                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1457                         if (sin6 == NULL)
1458                                 continue;
1459                         /* first question, is laddr->ifa an address associated with the emit interface */
1460                         if (ifn) {
1461                                 struct ifaddr_container *ifac;
1462
1463                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1464                                         struct ifaddr *ifa = ifac->ifa;
1465
1466                                         if (laddr->ifa == ifa) {
1467                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1468                                                 return (sin6);
1469                                         }
1470                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1471                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1472                                                 return (sin6);
1473                                         }
1474                                 }
1475                         }
1476                 }
1477                 /* Next try for matching scope */
1478                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1479                              sctp_nxt_addr) {
1480                         if (laddr->ifa == NULL) {
1481                                 /* address has been removed */
1482                                 continue;
1483                         }
1484                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1485                         if (sin6 == NULL)
1486                                 continue;
1487
1488                         if ((loopscope == 0) &&
1489                             (loc_scope == 0) &&
1490                             (sin_loop == 0) &&
1491                             (sin_local == 0)) {
1492                                 /* all of global scope we are ok with it */
1493                                 return (sin6);
1494                         }
1495                         if (loopscope && sin_loop)
1496                                 /* both on the loopback, thats ok */
1497                                 return (sin6);
1498                         if (loc_scope && sin_local)
1499                                 /* both local scope */
1500                                 return (sin6);
1501                 }
1502                 /* ok, now try for a higher scope in the source address */
1503                 /* First try for matching scope */
1504                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1505                              sctp_nxt_addr) {
1506                         if (laddr->ifa == NULL) {
1507                                 /* address has been removed */
1508                                 continue;
1509                         }
1510                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1511                         if (sin6 == NULL)
1512                                 continue;
1513                         return (sin6);
1514                 }
1515         }
1516         return (NULL);
1517 }
1518
1519 static struct sockaddr_in6 *
1520 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1521                                  struct rtentry *rt,
1522                                  uint8_t loc_scope,
1523                                  uint8_t loopscope)
1524 {
1525         /*
1526          * Here we are bound specific and have only
1527          * an inp. We must find an address that is bound
1528          * that we can give out as a src address. We
1529          * prefer two addresses of same scope if we can
1530          * find them that way.
1531          */
1532         struct sctp_laddr *laddr;
1533         struct sockaddr_in6 *sin6;
1534         struct ifnet *ifn;
1535         int sin_loop, sin_local;
1536
1537         /* first question, is the ifn we will emit on
1538          * in our list, if so, we want that one.
1539          */
1540
1541         ifn = rt->rt_ifp;
1542         if (ifn) {
1543                 struct ifaddr_container *ifac;
1544
1545                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1546                         struct ifaddr *ifa = ifac->ifa;
1547
1548                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1549                         if (sin6 == NULL)
1550                                 continue;
1551                         if (sctp_is_addr_in_ep(inp, ifa)) {
1552                                 return (sin6);
1553                         }
1554                 }
1555         }
1556         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1557              laddr && (laddr != inp->next_addr_touse);
1558              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1559                 if (laddr->ifa == NULL) {
1560                         /* address has been removed */
1561                         continue;
1562                 }
1563                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1564                 if (sin6 == NULL)
1565                         continue;
1566
1567                 if ((loopscope == 0) &&
1568                     (loc_scope == 0) &&
1569                     (sin_loop == 0) &&
1570                     (sin_local == 0)) {
1571                         /* all of global scope we are ok with it */
1572                         return (sin6);
1573                 }
1574                 if (loopscope && sin_loop)
1575                         /* both on the loopback, thats ok */
1576                         return (sin6);
1577                 if (loc_scope && sin_local)
1578                         /* both local scope */
1579                         return (sin6);
1580
1581         }
1582         /* if we reach here, we could not find two addresses
1583          * of the same scope to give out. Lets look for any higher level
1584          * scope for a source address.
1585          */
1586         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1587              laddr && (laddr != inp->next_addr_touse);
1588              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1589                 if (laddr->ifa == NULL) {
1590                         /* address has been removed */
1591                         continue;
1592                 }
1593                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1594                 if (sin6 == NULL)
1595                         continue;
1596                 return (sin6);
1597         }
1598         /* no address bound can be a source for the destination */
1599 #ifdef SCTP_DEBUG
1600         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1601                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1602         }
1603 #endif
1604         return (NULL);
1605 }
1606
1607
1608 static struct sockaddr_in6 *
1609 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1610                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1611 {
1612         struct ifaddr_container *ifac;
1613         struct sockaddr_in6 *sin6;
1614         int sin_loop, sin_local;
1615         int num_eligible_addr = 0;
1616
1617         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1618                 struct ifaddr *ifa = ifac->ifa;
1619
1620                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1621                 if (sin6 == NULL)
1622                         continue;
1623                 if (stcb) {
1624                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1625                                 /* It is restricted for some reason.. probably
1626                                  * not yet added.
1627                                  */
1628                                 continue;
1629                         }
1630                 }
1631                 if (match_scope) {
1632                         /* Here we are asked to match scope if possible */
1633                         if (loopscope && sin_loop)
1634                                 /* src and destination are loopback scope */
1635                                 return (sin6);
1636                         if (loc_scope && sin_local)
1637                                 /* src and destination are local scope */
1638                                 return (sin6);
1639                         if ((loopscope == 0) &&
1640                             (loc_scope == 0)  &&
1641                             (sin_loop == 0) &&
1642                             (sin_local == 0)) {
1643                                 /* src and destination are global scope */
1644                                 return (sin6);
1645                         }
1646                         continue;
1647                 }
1648                 if (num_eligible_addr == cur_addr_num) {
1649                         /* this is it */
1650                         return (sin6);
1651                 }
1652                 num_eligible_addr++;
1653         }
1654         return (NULL);
1655 }
1656
1657
1658 static int
1659 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1660                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1661 {
1662         struct ifaddr_container *ifac;
1663         struct sockaddr_in6 *sin6;
1664         int num_eligible_addr = 0;
1665         int sin_loop, sin_local;
1666
1667         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1668                 struct ifaddr *ifa = ifac->ifa;
1669
1670                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1671                 if (sin6 == NULL)
1672                         continue;
1673                 if (stcb) {
1674                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1675                                 /* It is restricted for some reason.. probably
1676                                  * not yet added.
1677                                  */
1678                                 continue;
1679                         }
1680                 }
1681                 num_eligible_addr++;
1682         }
1683         return (num_eligible_addr);
1684 }
1685
1686
1687 static struct sockaddr_in6 *
1688 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1689                         struct sctp_tcb *stcb,
1690                         struct sctp_nets *net,
1691                         struct rtentry *rt,
1692                         uint8_t loc_scope,
1693                         uint8_t loopscope,
1694                         int non_asoc_addr_ok)
1695 {
1696         /* Ok, we are bound all SO any address
1697          * is ok to use as long as it is NOT in the negative
1698          * list.
1699          */
1700         int num_eligible_addr;
1701         int cur_addr_num=0;
1702         int started_at_beginning=0;
1703         int match_scope_prefered;
1704         /* first question is, how many eligible addresses are
1705          * there for the destination ifn that we are using that
1706          * are within the proper scope?
1707          */
1708         struct ifnet *ifn;
1709         struct sockaddr_in6 *sin6;
1710
1711         ifn = rt->rt_ifp;
1712         if (net) {
1713                 cur_addr_num = net->indx_of_eligible_next_to_use;
1714         }
1715         if (cur_addr_num == 0) {
1716                 match_scope_prefered = 1;
1717         } else {
1718                 match_scope_prefered = 0;
1719         }
1720         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1721 #ifdef SCTP_DEBUG
1722         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1723                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1724         }
1725 #endif
1726         if (num_eligible_addr == 0) {
1727                 /* no eligible addresses, we must use some other
1728                  * interface address if we can find one.
1729                  */
1730                 goto bound_all_v6_plan_b;
1731         }
1732         /* Ok we have num_eligible_addr set with how many we can use,
1733          * this may vary from call to call due to addresses being deprecated etc..
1734          */
1735         if (cur_addr_num >= num_eligible_addr) {
1736                 cur_addr_num = 0;
1737         }
1738         /* select the nth address from the list (where cur_addr_num is the nth) and
1739          * 0 is the first one, 1 is the second one etc...
1740          */
1741 #ifdef SCTP_DEBUG
1742         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1743                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1744                        cur_addr_num, match_scope_prefered);
1745         }
1746 #endif
1747         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1748                                                           loc_scope, cur_addr_num, match_scope_prefered);
1749         if (match_scope_prefered && (sin6 == NULL)) {
1750                 /* retry without the preference for matching scope */
1751 #ifdef SCTP_DEBUG
1752         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1753                 kprintf("retry with no match_scope_prefered\n");
1754         }
1755 #endif
1756                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1757                                                                   loc_scope, cur_addr_num, 0);
1758         }
1759         if (sin6) {
1760 #ifdef SCTP_DEBUG
1761                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1762                         kprintf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1763                 }
1764 #endif
1765                 if (net) {
1766                         /* store so we get the next one */
1767                         if (cur_addr_num < 255)
1768                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1769                         else
1770                                 net->indx_of_eligible_next_to_use = 0;
1771                 }
1772                 return (sin6);
1773         }
1774         num_eligible_addr = 0;
1775  bound_all_v6_plan_b:
1776         /* ok, if we reach here we either fell through
1777          * due to something changing during an interupt (unlikely)
1778          * or we have NO eligible source addresses for the ifn
1779          * of the route (most likely). We must look at all the other
1780          * interfaces EXCEPT rt->rt_ifp and do the same game.
1781          */
1782 #ifdef SCTP_DEBUG
1783         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1784                 kprintf("bound-all Plan B\n");
1785         }
1786 #endif
1787         if (inp->next_ifn_touse == NULL) {
1788                 started_at_beginning=1;
1789                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1790 #ifdef SCTP_DEBUG
1791                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1792                         kprintf("Start at first IFN:%p\n", inp->next_ifn_touse);
1793                 }
1794 #endif
1795         } else {
1796                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1797 #ifdef SCTP_DEBUG
1798                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1799                         kprintf("Resume at IFN:%p\n", inp->next_ifn_touse);
1800                 }
1801 #endif
1802                 if (inp->next_ifn_touse == NULL) {
1803 #ifdef SCTP_DEBUG
1804                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1805                                 kprintf("IFN Resets\n");
1806                         }
1807 #endif
1808                         started_at_beginning=1;
1809                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1810                 }
1811         }
1812         for (ifn = inp->next_ifn_touse; ifn;
1813              ifn = TAILQ_NEXT(ifn, if_list)) {
1814                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1815                         /* wrong base scope */
1816                         continue;
1817                 }
1818                 if (loc_scope && (ifn->if_index != loc_scope)) {
1819                         /* by definition the scope (from to->sin6_scopeid)
1820                          * must match that of the interface. If not then
1821                          * we could pick a wrong scope for the address.
1822                          * Ususally we don't hit plan-b since the route
1823                          * handles this. However we can hit plan-b when
1824                          * we send to local-host so the route is the
1825                          * loopback interface, but the destination is a
1826                          * link local.
1827                          */
1828                         continue;
1829                 }
1830                 if (ifn == rt->rt_ifp) {
1831                         /* already looked at this guy */
1832                         continue;
1833                 }
1834                 /* Address rotation will only work when we are not
1835                  * rotating sourced interfaces and are using the interface
1836                  * of the route. We would need to have a per interface index
1837                  * in order to do proper rotation.
1838                  */
1839                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1840 #ifdef SCTP_DEBUG
1841                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1842                         kprintf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1843                 }
1844 #endif
1845                 if (num_eligible_addr == 0) {
1846                         /* none we can use */
1847                         continue;
1848                 }
1849                 /* Ok we have num_eligible_addr set with how many we can use,
1850                  * this may vary from call to call due to addresses being deprecated etc..
1851                  */
1852                 inp->next_ifn_touse = ifn;
1853
1854                 /* select the first one we can find with perference for matching scope.
1855                  */
1856                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1857                 if (sin6 == NULL) {
1858                         /* can't find one with matching scope how about a source with higher
1859                          * scope
1860                          */
1861                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1862                         if (sin6 == NULL)
1863                                 /* Hmm, can't find one in the interface now */
1864                                 continue;
1865                 }
1866 #ifdef SCTP_DEBUG
1867                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1868                         kprintf("Selected the %d'th address of ifn:%p\n",
1869                                cur_addr_num,
1870                                ifn);
1871                 }
1872 #endif
1873                 return (sin6);
1874         }
1875         if (started_at_beginning == 0) {
1876                 /* we have not been through all of them yet, force
1877                  * us to go through them all.
1878                  */
1879 #ifdef SCTP_DEBUG
1880                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1881                         kprintf("Force a recycle\n");
1882                 }
1883 #endif
1884                 inp->next_ifn_touse = NULL;
1885                 goto bound_all_v6_plan_b;
1886         }
1887         return (NULL);
1888
1889 }
1890
1891 /* stcb and net may be NULL */
1892 struct in6_addr
1893 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1894     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1895     int non_asoc_addr_ok)
1896 {
1897         struct in6_addr ans;
1898         struct sockaddr_in6 *rt_addr;
1899         uint8_t loc_scope, loopscope;
1900         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1901
1902         /*
1903          * This routine is tricky standard v6 src address
1904          * selection cannot take into account what we have
1905          * bound etc, so we can't use it.
1906          *
1907          * Instead here is what we must do:
1908          * 1) Make sure we have a route, if we
1909          *    don't have a route we can never reach the peer.
1910          * 2) Once we have a route, determine the scope of the
1911          *     route. Link local, loopback or global.
1912          * 3) Next we divide into three types. Either we
1913          *    are bound all.. which means we want to use
1914          *    one of the addresses of the interface we are
1915          *    going out. <or>
1916          * 4a) We have not stcb, which means we are using the
1917          *    specific addresses bound on an inp, in this
1918          *    case we are similar to the stcb case (4b below)
1919          *    accept the list is always a positive list.<or>
1920          * 4b) We are bound specific with a stcb, which means we have a
1921          *    list of bound addresses and we must see if the
1922          *    ifn of the route is actually one of the bound addresses.
1923          *    If not, then we must rotate addresses amongst properly
1924          *    scoped bound addresses, if so we use the address
1925          *    of the interface.
1926          * 5) Always, no matter which path we take through the above
1927          *    we must be sure the source address we use is allowed to
1928          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1929          *    addresses cannot be used.
1930          * 6) Addresses that are deprecated MAY be used
1931          *              if (!ip6_use_deprecated) {
1932          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1933          *                        skip the address
1934          *                    }
1935          *              }
1936          */
1937
1938         /*** 1> determine route, if not already done */
1939         if (ro->ro_rt == NULL) {
1940                 /*
1941                  * Need a route to cache.
1942                  */
1943 #ifndef SCOPEDROUTING
1944                 int scope_save;
1945                 scope_save = to->sin6_scope_id;
1946                 to->sin6_scope_id = 0;
1947 #endif
1948
1949 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1950                 rtalloc_ign(ro, 0UL);
1951 #else
1952                 rtalloc(ro);
1953 #endif
1954 #ifndef SCOPEDROUTING
1955                 to->sin6_scope_id = scope_save;
1956 #endif
1957         }
1958         if (ro->ro_rt == NULL) {
1959                 /*
1960                  * no route to host. this packet is going no-where.
1961                  * We probably should make sure we arrange to send back
1962                  * an error.
1963                  */
1964 #ifdef SCTP_DEBUG
1965                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1966                         kprintf("No route to host, this packet cannot be sent!\n");
1967                 }
1968 #endif
1969                 memset(&ans, 0, sizeof(ans));
1970                 return (ans);
1971         }
1972
1973         /*** 2a> determine scope for outbound address/route */
1974         loc_scope = loopscope = 0;
1975         /*
1976          * We base our scope on the outbound packet scope and route,
1977          * NOT the TCB (if there is one). This way in local scope we will only
1978          * use a local scope src address when we send to a local address.
1979          */
1980
1981         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1982                 /* If the route goes to the loopback address OR
1983                  * the address is a loopback address, we are loopback
1984                  * scope.
1985                  */
1986 #ifdef SCTP_DEBUG
1987                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1988                         kprintf("Loopback scope is set\n");
1989                 }
1990 #endif
1991                 loc_scope = 0;
1992                 loopscope = 1;
1993                 if (net != NULL) {
1994                         /* mark it as local */
1995                         net->addr_is_local = 1;
1996                 }
1997
1998         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
1999 #ifdef SCTP_DEBUG
2000                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2001                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2002                 }
2003 #endif
2004                 if (to->sin6_scope_id)
2005                         loc_scope = to->sin6_scope_id;
2006                 else {
2007                         loc_scope = 1;
2008                 }
2009                 loopscope = 0;
2010         } else {
2011 #ifdef SCTP_DEBUG
2012                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2013                         kprintf("Global scope is set\n");
2014                 }
2015 #endif
2016         }
2017
2018         /* now, depending on which way we are bound we call the appropriate
2019          * routine to do steps 3-6
2020          */
2021 #ifdef SCTP_DEBUG
2022         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2023                 kprintf("Destination address:");
2024                 sctp_print_address((struct sockaddr *)to);
2025         }
2026 #endif
2027
2028         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2029 #ifdef SCTP_DEBUG
2030                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2031                         kprintf("Calling bound-all src addr selection for v6\n");
2032                 }
2033 #endif
2034                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2035         } else {
2036 #ifdef SCTP_DEBUG
2037                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2038                         kprintf("Calling bound-specific src addr selection for v6\n");
2039                 }
2040 #endif
2041                 if (stcb)
2042                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2043                 else
2044                         /* we can't have a non-asoc address since we have no association */
2045                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2046         }
2047         if (rt_addr == NULL) {
2048                 /* no suitable address? */
2049                 struct in6_addr in6;
2050 #ifdef SCTP_DEBUG
2051                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2052                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2053                 }
2054 #endif
2055                 memset(&in6, 0, sizeof(in6));
2056                 return (in6);
2057         }
2058 #ifdef SCTP_DEBUG
2059         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2060                 kprintf("Source address selected is:");
2061                 sctp_print_address((struct sockaddr *)rt_addr);
2062         }
2063 #endif
2064         return (rt_addr->sin6_addr);
2065 }
2066
2067 static uint8_t
2068 sctp_get_ect(struct sctp_tcb *stcb,
2069              struct sctp_tmit_chunk *chk)
2070 {
2071         uint8_t this_random;
2072
2073         /* Huh? */
2074         if (sctp_ecn == 0)
2075                 return (0);
2076
2077         if (sctp_ecn_nonce == 0)
2078                 /* no nonce, always return ECT0 */
2079                 return (SCTP_ECT0_BIT);
2080
2081         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2082                 /* Peer does NOT support it, so we send a ECT0 only */
2083                 return (SCTP_ECT0_BIT);
2084         }
2085
2086         if (chk == NULL)
2087            return (SCTP_ECT0_BIT);
2088
2089         if (((stcb->asoc.hb_random_idx == 3) &&
2090              (stcb->asoc.hb_ect_randombit > 7)) ||
2091              (stcb->asoc.hb_random_idx > 3)) {
2092                 uint32_t rndval;
2093                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2094                 memcpy(stcb->asoc.hb_random_values, &rndval,
2095                        sizeof(stcb->asoc.hb_random_values));
2096                 this_random = stcb->asoc.hb_random_values[0];
2097                 stcb->asoc.hb_random_idx = 0;
2098                 stcb->asoc.hb_ect_randombit = 0;
2099         } else {
2100                 if (stcb->asoc.hb_ect_randombit > 7) {
2101                   stcb->asoc.hb_ect_randombit = 0;
2102                   stcb->asoc.hb_random_idx++;
2103                 }
2104                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2105         }
2106         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2107                 if (chk != NULL)
2108                         /* ECN Nonce stuff */
2109                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2110                 stcb->asoc.hb_ect_randombit++;
2111                 return (SCTP_ECT1_BIT);
2112         } else {
2113                 stcb->asoc.hb_ect_randombit++;
2114                 return (SCTP_ECT0_BIT);
2115         }
2116 }
2117
2118 extern int sctp_no_csum_on_loopback;
2119
2120 static int
2121 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2122                            struct sctp_tcb *stcb,    /* may be NULL */
2123                            struct sctp_nets *net,
2124                            struct sockaddr *to,
2125                            struct mbuf *m,
2126                            int nofragment_flag,
2127                            int ecn_ok,
2128                            struct sctp_tmit_chunk *chk,
2129                            int out_of_asoc_ok)
2130         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2131 {
2132         /*
2133          * Given a mbuf chain (via m_next) that holds a packet header
2134          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2135          * - calculate SCTP checksum and fill in
2136          * - prepend a IP address header
2137          * - if boundall use INADDR_ANY
2138          * - if boundspecific do source address selection
2139          * - set fragmentation option for ipV4
2140          * - On return from IP output, check/adjust mtu size
2141          * - of output interface and smallest_mtu size as well.
2142          */
2143         struct sctphdr *sctphdr;
2144         int o_flgs;
2145         uint32_t csum;
2146         int ret;
2147         unsigned int have_mtu;
2148         struct route *ro;
2149
2150         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2151                 sctp_m_freem(m);
2152                 return (EFAULT);
2153         }
2154         if ((m->m_flags & M_PKTHDR) == 0) {
2155 #ifdef SCTP_DEBUG
2156                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2157                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2158                 }
2159 #endif
2160                 sctp_m_freem(m);
2161                 return (EFAULT);
2162         }
2163         /* Calculate the csum and fill in the length of the packet */
2164         sctphdr = mtod(m, struct sctphdr *);
2165         have_mtu = 0;
2166         if (sctp_no_csum_on_loopback &&
2167              (stcb) &&
2168              (stcb->asoc.loopback_scope)) {
2169                 sctphdr->checksum = 0;
2170                 m->m_pkthdr.len = sctp_calculate_len(m);
2171         } else {
2172                 sctphdr->checksum = 0;
2173                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2174                 sctphdr->checksum = csum;
2175         }
2176         if (to->sa_family == AF_INET) {
2177                 struct ip *ip;
2178                 struct route iproute;
2179                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2180                 if (m == NULL) {
2181                         /* failed to prepend data, give up */
2182                         return (ENOMEM);
2183                 }
2184                 ip = mtod(m, struct ip *);
2185                 ip->ip_v = IPVERSION;
2186                 ip->ip_hl = (sizeof(struct ip) >> 2);
2187                 if (nofragment_flag) {
2188 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2189 #if defined( __OpenBSD__) || defined(__NetBSD__)
2190                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2191                         ip->ip_off = htons(IP_DF);
2192 #else
2193                         ip->ip_off = IP_DF;
2194 #endif
2195 #else
2196                         ip->ip_off = htons(IP_DF);
2197 #endif
2198                 } else
2199                         ip->ip_off = 0;
2200
2201 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2202 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2203                 ip->ip_id = htons(ip_randomid());
2204 #else
2205                 ip->ip_id = htons(ip_id++);
2206 #endif
2207
2208 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2209                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2210 #else
2211                 ip->ip_ttl = inp->inp_ip_ttl;
2212 #endif
2213 #if defined(__OpenBSD__) || defined(__NetBSD__)
2214                 ip->ip_len = htons(m->m_pkthdr.len);
2215 #else
2216                 ip->ip_len = m->m_pkthdr.len;
2217 #endif
2218                 if (stcb) {
2219                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2220                                 /* Enable ECN */
2221 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2222                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2223                                                       sctp_get_ect(stcb, chk));
2224 #elif defined(__NetBSD__)
2225                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2226                                                       sctp_get_ect(stcb, chk));
2227 #else
2228                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2229                                                       sctp_get_ect(stcb, chk));
2230 #endif
2231                         } else {
2232                                 /* No ECN */
2233 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2234                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2235 #elif defined(__NetBSD__)
2236                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2237 #else
2238                                 ip->ip_tos = inp->inp_ip_tos;
2239 #endif
2240                         }
2241                 } else {
2242                         /* no association at all */
2243 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2244                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2245 #else
2246                         ip->ip_tos = inp->inp_ip_tos;
2247 #endif
2248                 }
2249                 ip->ip_p = IPPROTO_SCTP;
2250                 ip->ip_sum = 0;
2251                 if (net == NULL) {
2252                         ro = &iproute;
2253                         memset(&iproute, 0, sizeof(iproute));
2254                         memcpy(&ro->ro_dst, to, to->sa_len);
2255                 } else {
2256                         ro = (struct route *)&net->ro;
2257                 }
2258                 /* Now the address selection part */
2259                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2260
2261                 /* call the routine to select the src address */
2262                 if (net) {
2263                         if (net->src_addr_selected == 0) {
2264                                 /* Cache the source address */
2265                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2266                                     stcb,
2267                                     ro, net, out_of_asoc_ok);
2268                                 if (ro->ro_rt)
2269                                         net->src_addr_selected = 1;
2270                         }
2271                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2272                 } else {
2273                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2274                             stcb, ro, net, out_of_asoc_ok);
2275                 }
2276                 /*
2277                  * If source address selection fails and we find no route then
2278                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2279                  * type error. We probably should catch that somewhere and
2280                  * abort the association right away (assuming this is an INIT
2281                  * being sent).
2282                  */
2283                 if ((ro->ro_rt == NULL)) {
2284                         /*
2285                          * src addr selection failed to find a route (or valid
2286                          * source addr), so we can't get there from here!
2287                          */
2288 #ifdef SCTP_DEBUG
2289                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2290                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2291                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2292                         }
2293 #endif /* SCTP_DEBUG */
2294                         if (net) {
2295                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2296                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2297                                                         stcb,
2298                                                         SCTP_FAILED_THRESHOLD,
2299                                                         (void *)net);
2300                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2301                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2302                                 if (stcb) {
2303                                         if (net == stcb->asoc.primary_destination) {
2304                                                 /* need a new primary */
2305                                                 struct sctp_nets *alt;
2306                                                 alt = sctp_find_alternate_net(stcb, net);
2307                                                 if (alt != net) {
2308                                                         if (sctp_set_primary_addr(stcb,
2309                                                                               NULL,
2310                                                                                  alt) == 0) {
2311                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2312                                                                 net->src_addr_selected = 0;
2313                                                         }
2314                                                 }
2315                                         }
2316                                 }
2317                         }
2318                         sctp_m_freem(m);
2319                         return (EHOSTUNREACH);
2320                 } else {
2321                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2322                 }
2323
2324                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2325 #ifdef SCTP_DEBUG
2326                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2327                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2328                                (u_int)(ntohl(ip->ip_src.s_addr)));
2329                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2330                         kprintf("RTP route is %p through\n", ro->ro_rt);
2331                 }
2332 #endif
2333                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2334                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2335                 }
2336                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2337                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2338 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2339     || defined(__DragonFly__)
2340                                 , NULL
2341 #endif
2342 #if defined(__NetBSD__)
2343                                 ,(struct socket *)inp->sctp_socket
2344 #endif
2345
2346 );
2347                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2348                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2349                 }
2350                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2351 #ifdef SCTP_DEBUG
2352                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2353                         kprintf("Ip output returns %d\n", ret);
2354                 }
2355 #endif
2356                 if (net == NULL) {
2357                         /* free tempy routes */
2358                         if (ro->ro_rt)
2359                                 RTFREE(ro->ro_rt);
2360                 } else {
2361                         /* PMTU check versus smallest asoc MTU goes here */
2362                         if (ro->ro_rt != NULL) {
2363                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2364                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2365                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2366                                             ro->ro_rt->rt_rmx.rmx_mtu);
2367                                 }
2368                         } else {
2369                                 /* route was freed */
2370                                 net->src_addr_selected = 0;
2371                         }
2372                 }
2373                 return (ret);
2374         }
2375 #ifdef INET6
2376         else if (to->sa_family == AF_INET6) {
2377                 struct ip6_hdr *ip6h;
2378 #ifdef NEW_STRUCT_ROUTE
2379                 struct route ip6route;
2380 #else
2381                 struct route_in6 ip6route;
2382 #endif
2383                 struct ifnet *ifp;
2384                 u_char flowTop;
2385                 uint16_t flowBottom;
2386                 u_char tosBottom, tosTop;
2387                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2388                 struct sockaddr_in6 lsa6_storage;
2389                 int prev_scope=0;
2390                 int error;
2391                 u_short prev_port=0;
2392
2393                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2394                 if (m == NULL) {
2395                         /* failed to prepend data, give up */
2396                         return (ENOMEM);
2397                 }
2398                 ip6h = mtod(m, struct ip6_hdr *);
2399
2400                 /*
2401                  * We assume here that inp_flow is in host byte order within
2402                  * the TCB!
2403                  */
2404                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2405                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2406
2407                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2408
2409                 /* protect *sin6 from overwrite */
2410                 sin6 = (struct sockaddr_in6 *)to;
2411                 tmp = *sin6;
2412                 sin6 = &tmp;
2413
2414                 /* KAME hack: embed scopeid */
2415 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2416                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2417 #else
2418                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2419 #endif
2420                         return (EINVAL);
2421                 if (net == NULL) {
2422                         memset(&ip6route, 0, sizeof(ip6route));
2423                         ro = (struct route *)&ip6route;
2424                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2425                 } else {
2426                         ro = (struct route *)&net->ro;
2427                 }
2428                 if (stcb != NULL) {
2429                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2430                                 /* Enable ECN */
2431                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2432                         } else {
2433                                 /* No ECN */
2434                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2435                         }
2436                 } else {
2437                         /* we could get no asoc if it is a O-O-T-B packet */
2438                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2439                 }
2440                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2441                 ip6h->ip6_nxt = IPPROTO_SCTP;
2442                 ip6h->ip6_plen = m->m_pkthdr.len;
2443                 ip6h->ip6_dst = sin6->sin6_addr;
2444
2445                 /*
2446                  * Add SRC address selection here:
2447                  * we can only reuse to a limited degree the kame src-addr-sel,
2448                  * since we can try their selection but it may not be bound.
2449                  */
2450                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2451                 lsa6_tmp.sin6_family = AF_INET6;
2452                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2453                 lsa6 = &lsa6_tmp;
2454                 if (net) {
2455                         if (net->src_addr_selected == 0) {
2456                                 /* Cache the source address */
2457                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2458                                     stcb, ro, net, out_of_asoc_ok);
2459
2460                                 if (ro->ro_rt)
2461                                         net->src_addr_selected = 1;
2462                         }
2463                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2464                 } else {
2465                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2466                             inp, stcb, ro, net, out_of_asoc_ok);
2467                 }
2468                 lsa6->sin6_port = inp->sctp_lport;
2469
2470                 if ((ro->ro_rt ==  NULL)) {
2471                         /*
2472                          * src addr selection failed to find a route (or valid
2473                          * source addr), so we can't get there from here!
2474                          */
2475 #ifdef SCTP_DEBUG
2476                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2477                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2478                         }
2479 #endif
2480                         sctp_m_freem(m);
2481                         if (net) {
2482                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2483                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2484                                                         stcb,
2485                                                         SCTP_FAILED_THRESHOLD,
2486                                                         (void *)net);
2487                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2488                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2489                                 if (stcb) {
2490                                         if (net == stcb->asoc.primary_destination) {
2491                                                 /* need a new primary */
2492                                                 struct sctp_nets *alt;
2493                                                 alt = sctp_find_alternate_net(stcb, net);
2494                                                 if (alt != net) {
2495                                                         if (sctp_set_primary_addr(stcb,
2496                                                                               NULL,
2497                                                                                  alt) == 0) {
2498                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2499                                                                 net->src_addr_selected = 0;
2500                                                         }
2501                                                 }
2502                                         }
2503                                 }
2504                         }
2505                         return (EHOSTUNREACH);
2506                 }
2507
2508 #ifndef SCOPEDROUTING
2509                 /*
2510                  * XXX: sa6 may not have a valid sin6_scope_id in
2511                  * the non-SCOPEDROUTING case.
2512                  */
2513                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2514                 lsa6_storage.sin6_family = AF_INET6;
2515                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2516                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2517                                               NULL)) != 0) {
2518                         sctp_m_freem(m);
2519                         return (error);
2520                 }
2521                 /* XXX */
2522                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2523                 lsa6_storage.sin6_port = inp->sctp_lport;
2524                 lsa6 = &lsa6_storage;
2525 #endif /* SCOPEDROUTING */
2526                 ip6h->ip6_src = lsa6->sin6_addr;
2527
2528                 /*
2529                  * We set the hop limit now since there is a good chance that
2530                  * our ro pointer is now filled
2531                  */
2532                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2533                                                 (ro ?
2534                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2535                                                  (NULL)));
2536                 o_flgs = 0;
2537                 ifp = ro->ro_rt->rt_ifp;
2538 #ifdef SCTP_DEBUG
2539                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2540                         /* Copy to be sure something bad is not happening */
2541                         sin6->sin6_addr = ip6h->ip6_dst;
2542                         lsa6->sin6_addr = ip6h->ip6_src;
2543
2544                         kprintf("Calling ipv6 output routine from low level\n");
2545                         kprintf("src: ");
2546                         sctp_print_address((struct sockaddr *)lsa6);
2547                         kprintf("dst: ");
2548                         sctp_print_address((struct sockaddr *)sin6);
2549                 }
2550 #endif /* SCTP_DEBUG */
2551                 if (net) {
2552                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2553                         /* preserve the port and scope for link local send */
2554                         prev_scope = sin6->sin6_scope_id;
2555                         prev_port = sin6->sin6_port;
2556                 }
2557                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2558 #ifdef NEW_STRUCT_ROUTE
2559                                  ro,
2560 #else
2561                                  (struct route_in6 *)ro,
2562 #endif
2563                                  o_flgs,
2564                                  ((struct in6pcb *)inp)->in6p_moptions,
2565 #if defined(__NetBSD__)
2566                                  (struct socket *)inp->sctp_socket,
2567 #endif
2568                                  &ifp
2569 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2570                     , NULL
2571 #endif
2572                         );
2573                 if (net) {
2574                         /* for link local this must be done */
2575                         sin6->sin6_scope_id = prev_scope;
2576                         sin6->sin6_port = prev_port;
2577                 }
2578 #ifdef SCTP_DEBUG
2579                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2580                         kprintf("return from send is %d\n", ret);
2581                 }
2582 #endif /* SCTP_DEBUG_OUTPUT */
2583                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2584                 if (net == NULL) {
2585                         /* Now if we had a temp route free it */
2586                         if (ro->ro_rt) {
2587                                 RTFREE(ro->ro_rt);
2588                         }
2589                 } else {
2590                         /* PMTU check versus smallest asoc MTU goes here */
2591                         if (ro->ro_rt == NULL) {
2592                                 /* Route was freed */
2593                                 net->src_addr_selected = 0;
2594                         }
2595                         if (ro->ro_rt != NULL) {
2596                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2597                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2598                                         sctp_mtu_size_reset(inp,
2599                                                             &stcb->asoc,
2600                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2601                                 }
2602                         } else if (ifp) {
2603 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2604 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2605 #endif /* SCTP_BASE_FREEBSD */
2606                                 if (ND_IFINFO(ifp)->linkmtu &&
2607                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2608                                         sctp_mtu_size_reset(inp,
2609                                                             &stcb->asoc,
2610                                                             ND_IFINFO(ifp)->linkmtu);
2611                                 }
2612                         }
2613                 }
2614                 return (ret);
2615         }
2616 #endif
2617         else {
2618 #ifdef SCTP_DEBUG
2619                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2620                         kprintf("Unknown protocol (TSNH) type %d\n", ((struct sockaddr *)to)->sa_family);
2621                 }
2622 #endif
2623                 sctp_m_freem(m);
2624                 return (EFAULT);
2625         }
2626 }
2627
2628 static int
2629 sctp_is_address_in_scope(struct ifaddr *ifa,
2630                          int ipv4_addr_legal,
2631                          int ipv6_addr_legal,
2632                          int loopback_scope,
2633                          int ipv4_local_scope,
2634                          int local_scope,
2635                          int site_scope)
2636 {
2637         if ((loopback_scope == 0) &&
2638             (ifa->ifa_ifp) &&
2639             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2640                 /* skip loopback if not in scope *
2641                  */
2642                 return (0);
2643         }
2644         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2645                 struct sockaddr_in *sin;
2646                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2647                 if (sin->sin_addr.s_addr == 0) {
2648                         /* not in scope , unspecified */
2649                         return (0);
2650                 }
2651                 if ((ipv4_local_scope == 0) &&
2652                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2653                         /* private address not in scope */
2654                         return (0);
2655                 }
2656         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2657                 struct sockaddr_in6 *sin6;
2658                 struct in6_ifaddr *ifa6;
2659
2660                 ifa6 = (struct in6_ifaddr *)ifa;
2661                 /* ok to use deprecated addresses? */
2662                 if (!ip6_use_deprecated) {
2663                         if (ifa6->ia6_flags &
2664                             IN6_IFF_DEPRECATED) {
2665                                 return (0);
2666                         }
2667                 }
2668                 if (ifa6->ia6_flags &
2669                     (IN6_IFF_DETACHED |
2670                      IN6_IFF_ANYCAST |
2671                      IN6_IFF_NOTREADY)) {
2672                         return (0);
2673                 }
2674                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2675                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2676                         /* skip unspecifed addresses */
2677                         return (0);
2678                 }
2679                 if (/*(local_scope == 0) && */
2680                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2681                         return (0);
2682                 }
2683                 if ((site_scope == 0) &&
2684                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2685                         return (0);
2686                 }
2687         } else {
2688                 return (0);
2689         }
2690         return (1);
2691 }
2692
2693
2694 void
2695 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2696 {
2697         struct mbuf *m, *m_at, *m_last;
2698         struct sctp_nets *net;
2699         struct sctp_init_msg *initm;
2700         struct sctp_supported_addr_param *sup_addr;
2701         struct sctp_ecn_supported_param *ecn;
2702         struct sctp_prsctp_supported_param *prsctp;
2703         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2704         struct sctp_supported_chunk_types_param *pr_supported;
2705         int cnt_inits_to=0;
2706         int padval, ret;
2707
2708         /* INIT's always go to the primary (and usually ONLY address) */
2709         m_last = NULL;
2710         net = stcb->asoc.primary_destination;
2711         if (net == NULL) {
2712                 net = TAILQ_FIRST(&stcb->asoc.nets);
2713                 if (net == NULL) {
2714                         /* TSNH */
2715                         return;
2716                 }
2717                 /* we confirm any address we send an INIT to */
2718                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2719                 sctp_set_primary_addr(stcb, NULL, net);
2720         } else {
2721                 /* we confirm any address we send an INIT to */
2722                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2723         }
2724 #ifdef SCTP_DEBUG
2725         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2726                 kprintf("Sending INIT to ");
2727                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2728         }
2729 #endif
2730         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2731                 /* special hook, if we are sending to link local
2732                  * it will not show up in our private address count.
2733                  */
2734                 struct sockaddr_in6 *sin6l;
2735                 sin6l = &net->ro._l_addr.sin6;
2736                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2737                         cnt_inits_to = 1;
2738         }
2739         if (callout_pending(&net->rxt_timer.timer)) {
2740                 /* This case should not happen */
2741                 return;
2742         }
2743         /* start the INIT timer */
2744         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2745                 /* we are hosed since I can't start the INIT timer? */
2746                 return;
2747         }
2748         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2749         if (m == NULL) {
2750                 /* No memory, INIT timer will re-attempt. */
2751                 return;
2752         }
2753         /* make it into a M_EXT */
2754         MCLGET(m, MB_DONTWAIT);
2755         if ((m->m_flags & M_EXT) != M_EXT) {
2756                 /* Failed to get cluster buffer */
2757                 sctp_m_freem(m);
2758                 return;
2759         }
2760         m->m_data += SCTP_MIN_OVERHEAD;
2761         m->m_len = sizeof(struct sctp_init_msg);
2762         /* Now lets put the SCTP header in place */
2763         initm = mtod(m, struct sctp_init_msg *);
2764         initm->sh.src_port = inp->sctp_lport;
2765         initm->sh.dest_port = stcb->rport;
2766         initm->sh.v_tag = 0;
2767         initm->sh.checksum = 0; /* calculate later */
2768         /* now the chunk header */
2769         initm->msg.ch.chunk_type = SCTP_INITIATION;
2770         initm->msg.ch.chunk_flags = 0;
2771         /* fill in later from mbuf we build */
2772         initm->msg.ch.chunk_length = 0;
2773         /* place in my tag */
2774         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2775         /* set up some of the credits. */
2776         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2777             SCTP_MINIMAL_RWND));
2778
2779         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2780         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2781         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2782         /* now the address restriction */
2783         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2784             sizeof(*initm));
2785         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2786         /* we support 2 types IPv6/IPv4 */
2787         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2788                                           sizeof(uint16_t));
2789         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2790         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2791         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2792
2793 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2794         if (inp->sctp_ep.adaption_layer_indicator) {
2795                 struct sctp_adaption_layer_indication *ali;
2796                 ali = (struct sctp_adaption_layer_indication *)(
2797                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2798                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2799                 ali->ph.param_length = htons(sizeof(*ali));
2800                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2801                 m->m_len += sizeof(*ali);
2802                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2803                     sizeof(*ali));
2804         } else {
2805                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2806                     sizeof(*sup_addr) + sizeof(uint16_t));
2807         }
2808
2809         /* now any cookie time extensions */
2810         if (stcb->asoc.cookie_preserve_req) {
2811                 struct sctp_cookie_perserve_param *cookie_preserve;
2812                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2813                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2814                 cookie_preserve->ph.param_length = htons(
2815                     sizeof(*cookie_preserve));
2816                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2817                 m->m_len += sizeof(*cookie_preserve);
2818                 ecn = (struct sctp_ecn_supported_param *)(
2819                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2820                 stcb->asoc.cookie_preserve_req = 0;
2821         }
2822
2823         /* ECN parameter */
2824         if (sctp_ecn == 1) {
2825                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2826                 ecn->ph.param_length = htons(sizeof(*ecn));
2827                 m->m_len += sizeof(*ecn);
2828                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2829                     sizeof(*ecn));
2830         } else {
2831                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2832         }
2833         /* And now tell the peer we do pr-sctp */
2834         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2835         prsctp->ph.param_length = htons(sizeof(*prsctp));
2836         m->m_len += sizeof(*prsctp);
2837
2838
2839         /* And now tell the peer we do all the extensions */
2840         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2841            sizeof(*prsctp));
2842
2843         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2844         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2845         pr_supported->chunk_types[0] = SCTP_ASCONF;
2846         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2847         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2848         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2849         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2850         pr_supported->chunk_types[5] = 0; /* pad */
2851         pr_supported->chunk_types[6] = 0; /* pad */
2852         pr_supported->chunk_types[7] = 0; /* pad */
2853
2854         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2855         /* ECN nonce: And now tell the peer we support ECN nonce */
2856
2857         if (sctp_ecn_nonce) {
2858                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2859                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2860                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2861                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2862                 m->m_len += sizeof(*ecn_nonce);
2863         }
2864
2865         m_at = m;
2866         /* now the addresses */
2867         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2868                 struct ifnet *ifn;
2869                 int cnt;
2870
2871                 cnt = cnt_inits_to;
2872                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2873                         struct ifaddr_container *ifac;
2874
2875                         if ((stcb->asoc.loopback_scope == 0) &&
2876                             (ifn->if_type == IFT_LOOP)) {
2877                                 /*
2878                                  * Skip loopback devices if loopback_scope
2879                                  * not set
2880                                  */
2881                                 continue;
2882                         }
2883                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2884                                 struct ifaddr *ifa = ifac->ifa;
2885
2886                                 if (sctp_is_address_in_scope(ifa,
2887                                     stcb->asoc.ipv4_addr_legal,
2888                                     stcb->asoc.ipv6_addr_legal,
2889                                     stcb->asoc.loopback_scope,
2890                                     stcb->asoc.ipv4_local_scope,
2891                                     stcb->asoc.local_scope,
2892                                     stcb->asoc.site_scope) == 0) {
2893                                         continue;
2894                                 }
2895                                 cnt++;
2896                         }
2897                 }
2898                 if (cnt > 1) {
2899                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2900                                 struct ifaddr_container *ifac;
2901
2902                                 if ((stcb->asoc.loopback_scope == 0) &&
2903                                     (ifn->if_type == IFT_LOOP)) {
2904                                         /*
2905                                          * Skip loopback devices if loopback_scope
2906                                          * not set
2907                                          */
2908                                         continue;
2909                                 }
2910                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2911                                         struct ifaddr *ifa = ifac->ifa;
2912
2913                                         if (sctp_is_address_in_scope(ifa,
2914                                             stcb->asoc.ipv4_addr_legal,
2915                                             stcb->asoc.ipv6_addr_legal,
2916                                             stcb->asoc.loopback_scope,
2917                                             stcb->asoc.ipv4_local_scope,
2918                                             stcb->asoc.local_scope,
2919                                             stcb->asoc.site_scope) == 0) {
2920                                                 continue;
2921                                         }
2922                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2923                                 }
2924                         }
2925                 }
2926         } else {
2927                 struct sctp_laddr *laddr;
2928                 int cnt;
2929                 cnt = cnt_inits_to;
2930                 /* First, how many ? */
2931                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2932                         if (laddr->ifa == NULL) {
2933                                 continue;
2934                         }
2935                         if (laddr->ifa->ifa_addr == NULL)
2936                                 continue;
2937                         if (sctp_is_address_in_scope(laddr->ifa,
2938                             stcb->asoc.ipv4_addr_legal,
2939                             stcb->asoc.ipv6_addr_legal,
2940                             stcb->asoc.loopback_scope,
2941                             stcb->asoc.ipv4_local_scope,
2942                             stcb->asoc.local_scope,
2943                             stcb->asoc.site_scope) == 0) {
2944                                 continue;
2945                         }
2946                         cnt++;
2947                 }
2948                 /* To get through a NAT we only list addresses if
2949                  * we have more than one. That way if you just
2950                  * bind a single address we let the source of the init
2951                  * dictate our address.
2952                  */
2953                 if (cnt > 1) {
2954                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2955                                 if (laddr->ifa == NULL) {
2956                                         continue;
2957                                 }
2958                                 if (laddr->ifa->ifa_addr == NULL) {
2959                                         continue;
2960                                 }
2961
2962                                 if (sctp_is_address_in_scope(laddr->ifa,
2963                                     stcb->asoc.ipv4_addr_legal,
2964                                     stcb->asoc.ipv6_addr_legal,
2965                                     stcb->asoc.loopback_scope,
2966                                     stcb->asoc.ipv4_local_scope,
2967                                     stcb->asoc.local_scope,
2968                                     stcb->asoc.site_scope) == 0) {
2969                                         continue;
2970                                 }
2971                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2972                         }
2973                 }
2974         }
2975         /* calulate the size and update pkt header and chunk header */
2976         m->m_pkthdr.len = 0;
2977         for (m_at = m; m_at; m_at = m_at->m_next) {
2978                 if (m_at->m_next == NULL)
2979                         m_last = m_at;
2980                 m->m_pkthdr.len += m_at->m_len;
2981         }
2982         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2983             sizeof(struct sctphdr)));
2984         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2985          * ignore the return here since the timer will drive
2986          * a retranmission.
2987          */
2988
2989         /* I don't expect this to execute but we will be safe here */
2990         padval = m->m_pkthdr.len % 4;
2991         if ((padval) && (m_last)) {
2992                 /* The compiler worries that m_last may not be
2993                  * set even though I think it is impossible :->
2994                  * however we add m_last here just in case.
2995                  */
2996                 int ret;
2997                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2998                 if (ret) {
2999                         /* Houston we have a problem, no space */
3000                         sctp_m_freem(m);
3001                         return;
3002                 }
3003                 m->m_pkthdr.len += padval;
3004         }
3005 #ifdef SCTP_DEBUG
3006         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3007                 kprintf("Calling lowlevel output stcb:%p net:%p\n", stcb, net);
3008         }
3009 #endif
3010         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3011                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3012 #ifdef SCTP_DEBUG
3013         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3014                 kprintf("Low level output returns %d\n", ret);
3015         }
3016 #endif
3017         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3018         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3019 }
3020
3021 struct mbuf *
3022 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3023     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3024 {
3025         /* Given a mbuf containing an INIT or INIT-ACK
3026          * with the param_offset being equal to the
3027          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3028          * parse through the parameters to the end of the mbuf verifying
3029          * that all parameters are known.
3030          *
3031          * For unknown parameters build and return a mbuf with
3032          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3033          * to stop processing this chunk stop, and set *abort_processing
3034          * to 1.
3035          *
3036          * By having param_offset be pre-set to where parameters begin
3037          * it is hoped that this routine may be reused in the future
3038          * by new features.
3039          */
3040         struct sctp_paramhdr *phdr, params;
3041
3042         struct mbuf *mat, *op_err;
3043         char tempbuf[2048];
3044         int at, limit, pad_needed;
3045         uint16_t ptype, plen;
3046         int err_at;
3047
3048         *abort_processing = 0;
3049         mat = in_initpkt;
3050         err_at = 0;
3051         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3052 #ifdef SCTP_DEBUG
3053         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3054                 kprintf("Limit is %d bytes\n", limit);
3055         }
3056 #endif
3057         at = param_offset;
3058         op_err = NULL;
3059
3060         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3061         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3062                 ptype = ntohs(phdr->param_type);
3063                 plen = ntohs(phdr->param_length);
3064                 limit -= SCTP_SIZE32(plen);
3065                 if (plen < sizeof(struct sctp_paramhdr)) {
3066 #ifdef SCTP_DEBUG
3067         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3068                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3069         }
3070 #endif
3071                         *abort_processing = 1;
3072                         break;
3073                 }
3074                 /* All parameters for all chunks that we
3075                  * know/understand are listed here. We process
3076                  * them other places and make appropriate
3077                  * stop actions per the upper bits. However
3078                  * this is the generic routine processor's can
3079                  * call to get back an operr.. to either incorporate (init-ack)
3080                  * or send.
3081                  */
3082                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3083                     (ptype == SCTP_IPV4_ADDRESS) ||
3084                     (ptype == SCTP_IPV6_ADDRESS) ||
3085                     (ptype == SCTP_STATE_COOKIE) ||
3086                     (ptype == SCTP_UNRECOG_PARAM) ||
3087                     (ptype == SCTP_COOKIE_PRESERVE) ||
3088                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3089                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3090                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3091                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3092                     (ptype == SCTP_ECN_CAPABLE) ||
3093                     (ptype == SCTP_ULP_ADAPTION) ||
3094                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3095                     (ptype == SCTP_SET_PRIM_ADDR) ||
3096                     (ptype == SCTP_SUCCESS_REPORT) ||
3097                     (ptype == SCTP_ULP_ADAPTION) ||
3098                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3099                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3100                         ) {
3101                         /* no skip it */
3102                         at += SCTP_SIZE32(plen);
3103                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3104                         /* We can NOT handle HOST NAME addresses!! */
3105 #ifdef SCTP_DEBUG
3106         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3107                 kprintf("Can't handle hostname addresses.. abort processing\n");
3108         }
3109 #endif
3110                         *abort_processing = 1;
3111                         if (op_err == NULL) {
3112                                 /* Ok need to try to get a mbuf */
3113                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3114                                 if (op_err) {
3115                                         op_err->m_len = 0;
3116                                         op_err->m_pkthdr.len = 0;
3117                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3118                                         op_err->m_data += sizeof(struct ip6_hdr);
3119                                         op_err->m_data += sizeof(struct sctphdr);
3120                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3121                                 }
3122                         }
3123                         if (op_err) {
3124                                 /* If we have space */
3125                                 struct sctp_paramhdr s;
3126                                 if (err_at % 4) {
3127                                         u_int32_t cpthis=0;
3128                                         pad_needed = 4 - (err_at % 4);
3129                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3130                                         err_at += pad_needed;
3131                                 }
3132                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3133                                 s.param_length = htons(sizeof(s) + plen);
3134                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3135                                 err_at += sizeof(s);
3136                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3137                                 if (phdr == NULL) {
3138                                         sctp_m_freem(op_err);
3139                                         /* we are out of memory but we
3140                                          * still need to have a look at what to
3141                                          * do (the system is in trouble though).
3142                                          */
3143                                         return (NULL);
3144                                 }
3145                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3146                                 err_at += plen;
3147                         }
3148                         return (op_err);
3149                 } else {
3150                         /* we do not recognize the parameter
3151                          * figure out what we do.
3152                          */
3153 #ifdef SCTP_DEBUG
3154                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3155                                 kprintf("Got parameter type %x - unknown\n",
3156                                        (u_int)ptype);
3157                         }
3158 #endif
3159                         if ((ptype & 0x4000) == 0x4000) {
3160                                 /* Report bit is set?? */
3161 #ifdef SCTP_DEBUG
3162                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3163                                         kprintf("Report bit is set\n");
3164                                 }
3165 #endif
3166                                 if (op_err == NULL) {
3167                                         /* Ok need to try to get an mbuf */
3168                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3169                                         if (op_err) {
3170                                                 op_err->m_len = 0;
3171                                                 op_err->m_pkthdr.len = 0;
3172                                                 op_err->m_data += sizeof(struct ip6_hdr);
3173                                                 op_err->m_data += sizeof(struct sctphdr);
3174                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3175                                         }
3176                                 }
3177                                 if (op_err) {
3178                                         /* If we have space */
3179                                         struct sctp_paramhdr s;
3180                                         if (err_at % 4) {
3181                                                 u_int32_t cpthis=0;
3182                                                 pad_needed = 4 - (err_at % 4);
3183                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3184                                                 err_at += pad_needed;
3185                                         }
3186                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3187                                         s.param_length = htons(sizeof(s) + plen);
3188                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3189                                         err_at += sizeof(s);
3190                                         if (plen > sizeof(tempbuf)) {
3191                                                 plen = sizeof(tempbuf);
3192                                         }
3193                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3194                                         if (phdr == NULL) {
3195                                                 sctp_m_freem(op_err);
3196                                                 /* we are out of memory but we
3197                                                  * still need to have a look at what to
3198                                                  * do (the system is in trouble though).
3199                                                  */
3200                                                 goto more_processing;
3201                                         }
3202                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3203                                         err_at += plen;
3204                                 }
3205                         }
3206                 more_processing:
3207                         if ((ptype & 0x8000) == 0x0000) {
3208 #ifdef SCTP_DEBUG
3209                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3210                                         kprintf("Abort bit is now setting1\n");
3211                                 }
3212 #endif
3213                                 return (op_err);
3214                         } else {
3215                                 /* skip this chunk and continue processing */
3216                                 at += SCTP_SIZE32(plen);
3217                         }
3218
3219                 }
3220                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3221         }
3222         return (op_err);
3223 }
3224
3225 static int
3226 sctp_are_there_new_addresses(struct sctp_association *asoc,
3227     struct mbuf *in_initpkt, int iphlen, int offset)
3228 {
3229         /*
3230          * Given a INIT packet, look through the packet to verify that
3231          * there are NO new addresses. As we go through the parameters
3232          * add reports of any un-understood parameters that require an
3233          * error.  Also we must return (1) to drop the packet if we see
3234          * a un-understood parameter that tells us to drop the chunk.
3235          */
3236         struct sockaddr_in sin4, *sa4;
3237         struct sockaddr_in6 sin6, *sa6;
3238         struct sockaddr *sa_touse;
3239         struct sockaddr *sa;
3240         struct sctp_paramhdr *phdr, params;
3241         struct ip *iph;
3242         struct mbuf *mat;
3243         uint16_t ptype, plen;
3244         int err_at;
3245         uint8_t fnd;
3246         struct sctp_nets *net;
3247
3248         memset(&sin4, 0, sizeof(sin4));
3249         memset(&sin6, 0, sizeof(sin6));
3250         sin4.sin_family = AF_INET;
3251         sin4.sin_len = sizeof(sin4);
3252         sin6.sin6_family = AF_INET6;
3253         sin6.sin6_len = sizeof(sin6);
3254
3255         sa_touse = NULL;
3256         /* First what about the src address of the pkt ? */
3257         iph = mtod(in_initpkt, struct ip *);
3258         if (iph->ip_v == IPVERSION) {
3259                 /* source addr is IPv4 */
3260                 sin4.sin_addr = iph->ip_src;
3261                 sa_touse = (struct sockaddr *)&sin4;
3262         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3263                 /* source addr is IPv6 */
3264                 struct ip6_hdr *ip6h;
3265                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3266                 sin6.sin6_addr = ip6h->ip6_src;
3267                 sa_touse = (struct sockaddr *)&sin6;
3268         } else {
3269                 return (1);
3270         }
3271
3272         fnd = 0;
3273         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3274                 sa = (struct sockaddr *)&net->ro._l_addr;
3275                 if (sa->sa_family == sa_touse->sa_family) {
3276                         if (sa->sa_family == AF_INET) {
3277                             sa4 = (struct sockaddr_in *)sa;
3278                                 if (sa4->sin_addr.s_addr ==
3279                                     sin4.sin_addr.s_addr) {
3280                                         fnd = 1;
3281                                         break;
3282                                 }
3283                         } else if (sa->sa_family == AF_INET6) {
3284                                 sa6 = (struct sockaddr_in6 *)sa;
3285                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3286                                     &sin6.sin6_addr)) {
3287                                         fnd = 1;
3288                                         break;
3289                                 }
3290                         }
3291                 }
3292         }
3293         if (fnd == 0) {
3294                 /* New address added! no need to look futher. */
3295                 return (1);
3296         }
3297         /* Ok so far lets munge through the rest of the packet */
3298         mat = in_initpkt;
3299         err_at = 0;
3300         sa_touse = NULL;
3301         offset += sizeof(struct sctp_init_chunk);
3302         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3303         while (phdr) {
3304                 ptype = ntohs(phdr->param_type);
3305                 plen = ntohs(phdr->param_length);
3306                 if (ptype == SCTP_IPV4_ADDRESS) {
3307                         struct sctp_ipv4addr_param *p4, p4_buf;
3308
3309                         phdr = sctp_get_next_param(mat, offset,
3310                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3311                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3312                             phdr == NULL) {
3313                                 return (1);
3314                         }
3315                         p4 = (struct sctp_ipv4addr_param *)phdr;
3316                         sin4.sin_addr.s_addr = p4->addr;
3317                         sa_touse = (struct sockaddr *)&sin4;
3318                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3319                         struct sctp_ipv6addr_param *p6, p6_buf;
3320
3321                         phdr = sctp_get_next_param(mat, offset,
3322                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3323                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3324                             phdr == NULL) {
3325                                 return (1);
3326                         }
3327                         p6 = (struct sctp_ipv6addr_param *)phdr;
3328                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3329                             sizeof(p6->addr));
3330                         sa_touse = (struct sockaddr *)&sin4;
3331                 }
3332
3333                 if (sa_touse) {
3334                         /* ok, sa_touse points to one to check */
3335                         fnd = 0;
3336                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3337                                 sa = (struct sockaddr *)&net->ro._l_addr;
3338                                 if (sa->sa_family != sa_touse->sa_family) {
3339                                         continue;
3340                                 }
3341                                 if (sa->sa_family == AF_INET) {
3342                                         sa4 = (struct sockaddr_in *)sa;
3343                                         if (sa4->sin_addr.s_addr ==
3344                                             sin4.sin_addr.s_addr) {
3345                                                 fnd = 1;
3346                                                 break;
3347                                         }
3348                                 } else if (sa->sa_family == AF_INET6) {
3349                                         sa6 = (struct sockaddr_in6 *)sa;
3350                                         if (SCTP6_ARE_ADDR_EQUAL(
3351                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3352                                                 fnd = 1;
3353                                                 break;
3354                                         }
3355                                 }
3356                         }
3357                         if (!fnd) {
3358                                 /* New addr added! no need to look further */
3359                                 return (1);
3360                         }
3361                 }
3362                 offset += SCTP_SIZE32(plen);
3363                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3364         }
3365         return (0);
3366 }
3367
3368 /*
3369  * Given a MBUF chain that was sent into us containing an
3370  * INIT. Build a INIT-ACK with COOKIE and send back.
3371  * We assume that the in_initpkt has done a pullup to
3372  * include IPv6/4header, SCTP header and initial part of
3373  * INIT message (i.e. the struct sctp_init_msg).
3374  */
3375 void
3376 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3377     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3378     struct sctp_init_chunk *init_chk)
3379 {
3380         struct sctp_association *asoc;
3381         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3382         struct sctp_init_msg *initackm_out;
3383         struct sctp_ecn_supported_param *ecn;
3384         struct sctp_prsctp_supported_param *prsctp;
3385         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3386         struct sctp_supported_chunk_types_param *pr_supported;
3387         struct sockaddr_storage store;
3388         struct sockaddr_in *sin;
3389         struct sockaddr_in6 *sin6;
3390         struct route *ro;
3391         struct ip *iph;
3392         struct ip6_hdr *ip6;
3393         struct sockaddr *to;
3394         struct sctp_state_cookie stc;
3395         struct sctp_nets *net=NULL;
3396         int cnt_inits_to=0;
3397         uint16_t his_limit, i_want;
3398         int abort_flag, padval, sz_of;
3399
3400         if (stcb) {
3401                 asoc = &stcb->asoc;
3402         } else {
3403                 asoc = NULL;
3404         }
3405         m_last = NULL;
3406         if ((asoc != NULL) &&
3407             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3408             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3409                 /* new addresses, out of here in non-cookie-wait states */
3410                 /*
3411                  * Send a ABORT, we don't add the new address error clause though
3412                  * we even set the T bit and copy in the 0 tag.. this looks no
3413                  * different than if no listner was present.
3414                  */
3415                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3416                 return;
3417         }
3418         abort_flag = 0;
3419         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3420             (offset+sizeof(struct sctp_init_chunk)),
3421             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3422         if (abort_flag) {
3423                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3424                 return;
3425         }
3426         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3427         if (m == NULL) {
3428                 /* No memory, INIT timer will re-attempt. */
3429                 if (op_err)
3430                         sctp_m_freem(op_err);
3431                 return;
3432         }
3433         MCLGET(m, MB_DONTWAIT);
3434         if ((m->m_flags & M_EXT) != M_EXT) {
3435                 /* Failed to get cluster buffer */
3436                 if (op_err)
3437                         sctp_m_freem(op_err);
3438                 sctp_m_freem(m);
3439                 return;
3440         }
3441         m->m_data += SCTP_MIN_OVERHEAD;
3442         m->m_pkthdr.rcvif = 0;
3443         m->m_len = sizeof(struct sctp_init_msg);
3444
3445         /* the time I built cookie */
3446         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3447
3448         /* populate any tie tags */
3449         if (asoc != NULL) {
3450                 /* unlock before tag selections */
3451                 SCTP_TCB_UNLOCK(stcb);
3452                 if (asoc->my_vtag_nonce == 0)
3453                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3454                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3455
3456                 if (asoc->peer_vtag_nonce == 0)
3457                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3458                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3459
3460                 stc.cookie_life = asoc->cookie_life;
3461                 net = asoc->primary_destination;
3462                 /* now we must relock */
3463                 SCTP_INP_RLOCK(inp);
3464                 /* we may be in trouble here if the inp got freed
3465                  * most likely this set of tests will protect
3466                  * us but there is a chance not.
3467                  */
3468                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3469                         if (op_err)
3470                                 sctp_m_freem(op_err);
3471                         sctp_m_freem(m);
3472                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3473                         return;
3474                 }
3475                 SCTP_TCB_LOCK(stcb);
3476                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3477         } else {
3478                 stc.tie_tag_my_vtag = 0;
3479                 stc.tie_tag_peer_vtag = 0;
3480                 /* life I will award this cookie */
3481                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3482         }
3483
3484         /* copy in the ports for later check */
3485         stc.myport = sh->dest_port;
3486         stc.peerport = sh->src_port;
3487
3488         /*
3489          * If we wanted to honor cookie life extentions, we would add
3490          * to stc.cookie_life. For now we should NOT honor any extension
3491          */
3492         stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3493         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3494                 struct inpcb *in_inp;
3495                 /* Its a V6 socket */
3496                 in_inp = (struct inpcb *)inp;
3497                 stc.ipv6_addr_legal = 1;
3498                 /* Now look at the binding flag to see if V4 will be legal */
3499                 if (
3500 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
3501                     (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3502 #elif defined(__OpenBSD__)
3503                     (0) /* For openbsd we do dual bind only */
3504 #else
3505                     (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3506 #endif
3507                     == 0) {
3508                         stc.ipv4_addr_legal = 1;
3509                 } else {
3510                         /* V4 addresses are NOT legal on the association */
3511                         stc.ipv4_addr_legal = 0;
3512                 }
3513         } else {
3514                 /* Its a V4 socket, no - V6 */
3515                 stc.ipv4_addr_legal = 1;
3516                 stc.ipv6_addr_legal = 0;
3517         }
3518
3519 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3520         stc.ipv4_scope = 1;
3521 #else
3522         stc.ipv4_scope = 0;
3523 #endif
3524         /* now for scope setup */
3525         memset((caddr_t)&store, 0, sizeof(store));
3526         sin = (struct sockaddr_in *)&store;
3527         sin6 = (struct sockaddr_in6 *)&store;
3528         if (net == NULL) {
3529                 to = (struct sockaddr *)&store;
3530                 iph = mtod(init_pkt, struct ip *);
3531                 if (iph->ip_v == IPVERSION) {
3532                         struct in_addr addr;
3533                         struct route iproute;
3534
3535                         sin->sin_family = AF_INET;
3536                         sin->sin_len = sizeof(struct sockaddr_in);
3537                         sin->sin_port = sh->src_port;
3538                         sin->sin_addr = iph->ip_src;
3539                         /* lookup address */
3540                         stc.address[0] = sin->sin_addr.s_addr;
3541                         stc.address[1] = 0;
3542                         stc.address[2] = 0;
3543                         stc.address[3] = 0;
3544                         stc.addr_type = SCTP_IPV4_ADDRESS;
3545                         /* local from address */
3546                         memset(&iproute, 0, sizeof(iproute));
3547                         ro = &iproute;
3548                         memcpy(&ro->ro_dst, sin, sizeof(*sin));
3549                         addr = sctp_ipv4_source_address_selection(inp, NULL,
3550                             ro, NULL, 0);
3551                         if (ro->ro_rt) {
3552                                 RTFREE(ro->ro_rt);
3553                         }
3554                         stc.laddress[0] = addr.s_addr;
3555                         stc.laddress[1] = 0;
3556                         stc.laddress[2] = 0;
3557                         stc.laddress[3] = 0;
3558                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3559                         /* scope_id is only for v6 */
3560                         stc.scope_id = 0;
3561 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3562                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3563                                 stc.ipv4_scope = 1;
3564                         }
3565 #else
3566                         stc.ipv4_scope = 1;
3567 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3568                         /* Must use the address in this case */
3569                         if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3570                                 stc.loopback_scope = 1;
3571                                 stc.ipv4_scope = 1;
3572                                 stc.site_scope = 1;
3573                                 stc.local_scope = 1;
3574                         }
3575                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3576                         struct in6_addr addr;
3577 #ifdef NEW_STRUCT_ROUTE
3578                         struct route iproute6;
3579 #else
3580                         struct route_in6 iproute6;
3581 #endif
3582                         ip6 = mtod(init_pkt, struct ip6_hdr *);
3583                         sin6->sin6_family = AF_INET6;
3584                         sin6->sin6_len = sizeof(struct sockaddr_in6);
3585                         sin6->sin6_port = sh->src_port;
3586                         sin6->sin6_addr = ip6->ip6_src;
3587                         /* lookup address */
3588                         memcpy(&stc.address, &sin6->sin6_addr,
3589                             sizeof(struct in6_addr));
3590                         sin6->sin6_scope_id = 0;
3591                         stc.addr_type = SCTP_IPV6_ADDRESS;
3592                         stc.scope_id = 0;
3593                         if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3594                                 stc.loopback_scope = 1;
3595                                 stc.local_scope = 1;
3596                                 stc.site_scope = 1;
3597                                 stc.ipv4_scope = 1;
3598                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3599                                 /*
3600                                  * If the new destination is a LINK_LOCAL
3601                                  * we must have common both site and local
3602                                  * scope. Don't set local scope though since
3603                                  * we must depend on the source to be added
3604                                  * implicitly. We cannot assure just because
3605                                  * we share one link that all links are common.
3606                                  */
3607                                 stc.local_scope = 0;
3608                                 stc.site_scope = 1;
3609                                 stc.ipv4_scope = 1;
3610                                 /* we start counting for the private
3611                                  * address stuff at 1. since the link
3612                                  * local we source from won't show
3613                                  * up in our scoped cou8nt.
3614                                  */
3615                                 cnt_inits_to=1;
3616                                 /* pull out the scope_id from incoming pkt */
3617                                 in6_recoverscope(sin6, &ip6->ip6_src,
3618                                     init_pkt->m_pkthdr.rcvif);
3619 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
3620                                 in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3621                                     NULL);
3622 #else
3623                                 in6_embedscope(&sin6->sin6_addr, sin6);
3624 #endif
3625                                 stc.scope_id = sin6->sin6_scope_id;
3626                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3627                                 /*
3628                                  * If the new destination is SITE_LOCAL
3629                                  * then we must have site scope in common.
3630                                  */
3631                                 stc.site_scope = 1;
3632                         }
3633                         /* local from address */
3634                         memset(&iproute6, 0, sizeof(iproute6));
3635                         ro = (struct route *)&iproute6;
3636                         memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
3637                         addr = sctp_ipv6_source_address_selection(inp, NULL,
3638                             ro, NULL, 0);
3639                         if (ro->ro_rt) {
3640                                 RTFREE(ro->ro_rt);
3641                         }
3642                         memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3643                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3644                 }
3645         } else {
3646                 /* set the scope per the existing tcb */
3647                 struct sctp_nets *lnet;
3648
3649                 stc.loopback_scope = asoc->loopback_scope;
3650                 stc.ipv4_scope = asoc->ipv4_local_scope;
3651                 stc.site_scope = asoc->site_scope;
3652                 stc.local_scope = asoc->local_scope;
3653                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3654                         if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
3655                                 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
3656                                         /* if we have a LL address, start counting
3657                                          * at 1.
3658                                          */
3659                                         cnt_inits_to = 1;
3660                                 }
3661                         }
3662                 }
3663
3664                 /* use the net pointer */
3665                 to = (struct sockaddr *)&net->ro._l_addr;
3666                 if (to->sa_family == AF_INET) {
3667                         sin = (struct sockaddr_in *)to;
3668                         stc.address[0] = sin->sin_addr.s_addr;
3669                         stc.address[1] = 0;
3670                         stc.address[2] = 0;
3671                         stc.address[3] = 0;
3672                         stc.addr_type = SCTP_IPV4_ADDRESS;
3673                         if (net->src_addr_selected == 0) {
3674                                 /* strange case here, the INIT
3675                                  * should have did the selection.
3676                                  */
3677                                 net->ro._s_addr.sin.sin_addr =
3678                                     sctp_ipv4_source_address_selection(inp,
3679                                     stcb, (struct route *)&net->ro, net, 0);
3680                                 net->src_addr_selected = 1;
3681
3682                         }
3683
3684                         stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr;
3685                         stc.laddress[1] = 0;
3686                         stc.laddress[2] = 0;
3687                         stc.laddress[3] = 0;
3688                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3689                 } else if (to->sa_family == AF_INET6) {
3690                         sin6 = (struct sockaddr_in6 *)to;
3691                         memcpy(&stc.address, &sin6->sin6_addr,
3692                             sizeof(struct in6_addr));
3693                         stc.addr_type = SCTP_IPV6_ADDRESS;
3694                         if (net->src_addr_selected == 0) {
3695                                 /* strange case here, the INIT
3696                                  * should have did the selection.
3697                                  */
3698                                 net->ro._s_addr.sin6.sin6_addr =
3699                                     sctp_ipv6_source_address_selection(inp,
3700                                     stcb, (struct route *)&net->ro, net, 0);
3701                                 net->src_addr_selected = 1;
3702                         }
3703                         memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr,
3704                             sizeof(struct in6_addr));
3705                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3706                 }
3707         }
3708         /* Now lets put the SCTP header in place */
3709         initackm_out = mtod(m, struct sctp_init_msg *);
3710         initackm_out->sh.src_port = inp->sctp_lport;
3711         initackm_out->sh.dest_port = sh->src_port;
3712         initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3713         /* Save it off for quick ref */
3714         stc.peers_vtag = init_chk->init.initiate_tag;
3715         initackm_out->sh.checksum = 0;  /* calculate later */
3716         /* who are we */
3717         strncpy(stc.identification, SCTP_VERSION_STRING,
3718            min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3719         /* now the chunk header */
3720         initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3721         initackm_out->msg.ch.chunk_flags = 0;
3722         /* fill in later from mbuf we build */
3723         initackm_out->msg.ch.chunk_length = 0;
3724         /* place in my tag */
3725         if ((asoc != NULL) &&
3726             ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3727              (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3728                 /* re-use the v-tags and init-seq here */
3729                 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3730                 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3731         } else {
3732                 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3733                 /* get a TSN to use too */
3734                 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3735         }
3736         /* save away my tag to */
3737         stc.my_vtag = initackm_out->msg.init.initiate_tag;
3738
3739         /* set up some of the credits. */
3740         initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND));
3741         /* set what I want */
3742         his_limit = ntohs(init_chk->init.num_inbound_streams);
3743         /* choose what I want */
3744         if (asoc != NULL) {
3745                 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3746                         i_want = asoc->streamoutcnt;
3747                 } else {
3748                         i_want = inp->sctp_ep.pre_open_stream_count;
3749                 }
3750         } else {
3751                 i_want = inp->sctp_ep.pre_open_stream_count;
3752         }
3753         if (his_limit < i_want) {
3754                 /* I Want more :< */
3755                 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3756         } else {
3757                 /* I can have what I want :> */
3758                 initackm_out->msg.init.num_outbound_streams = htons(i_want);
3759         }
3760         /* tell him his limt. */
3761         initackm_out->msg.init.num_inbound_streams =
3762             htons(inp->sctp_ep.max_open_streams_intome);
3763         /* setup the ECN pointer */
3764
3765 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3766         if (inp->sctp_ep.adaption_layer_indicator) {
3767                 struct sctp_adaption_layer_indication *ali;
3768                 ali = (struct sctp_adaption_layer_indication *)(
3769                     (caddr_t)initackm_out + sizeof(*initackm_out));
3770                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3771                 ali->ph.param_length = htons(sizeof(*ali));
3772                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3773                 m->m_len += sizeof(*ali);
3774                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3775                     sizeof(*ali));
3776         } else {
3777                 ecn = (struct sctp_ecn_supported_param*)(
3778                     (caddr_t)initackm_out + sizeof(*initackm_out));
3779         }
3780
3781         /* ECN parameter */
3782         if (sctp_ecn == 1) {
3783                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3784                 ecn->ph.param_length = htons(sizeof(*ecn));
3785                 m->m_len += sizeof(*ecn);
3786
3787                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
3788                     sizeof(*ecn));
3789         } else {
3790                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
3791         }
3792         /* And now tell the peer we do  pr-sctp */
3793         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3794         prsctp->ph.param_length = htons(sizeof(*prsctp));
3795         m->m_len += sizeof(*prsctp);
3796
3797
3798         /* And now tell the peer we do all the extensions */
3799         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
3800            sizeof(*prsctp));
3801
3802         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3803         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3804         pr_supported->chunk_types[0] = SCTP_ASCONF;
3805         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3806         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3807         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3808         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3809         pr_supported->chunk_types[5] = 0; /* pad */
3810         pr_supported->chunk_types[6] = 0; /* pad */
3811         pr_supported->chunk_types[7] = 0; /* pad */
3812
3813         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3814         if (sctp_ecn_nonce) {
3815                 /* ECN nonce: And now tell the peer we support ECN nonce */
3816                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
3817                      sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3818                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3819                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3820                 m->m_len += sizeof(*ecn_nonce);
3821         }
3822
3823         m_at = m;
3824         /* now the addresses */
3825         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3826                 struct ifnet *ifn;
3827                 int cnt = cnt_inits_to;
3828
3829                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3830                         struct ifaddr_container *ifac;
3831
3832                         if ((stc.loopback_scope == 0) &&
3833                             (ifn->if_type == IFT_LOOP)) {
3834                                 /*
3835                                  * Skip loopback devices if loopback_scope
3836                                  * not set
3837                                  */
3838                                 continue;
3839                         }
3840                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3841                                 struct ifaddr *ifa = ifac->ifa;
3842
3843                                 if (sctp_is_address_in_scope(ifa,
3844                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3845                                     stc.loopback_scope, stc.ipv4_scope,
3846                                     stc.local_scope, stc.site_scope) == 0) {
3847                                         continue;
3848                                 }
3849                                 cnt++;
3850                         }
3851                 }
3852                 if (cnt > 1) {
3853                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
3854                                 struct ifaddr_container *ifac;
3855
3856                                 if ((stc.loopback_scope == 0) &&
3857                                     (ifn->if_type == IFT_LOOP)) {
3858                                         /*
3859                                          * Skip loopback devices if
3860                                          * loopback_scope not set
3861                                          */
3862                                         continue;
3863                                 }
3864                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3865                                         struct ifaddr *ifa = ifac->ifa;
3866
3867                                         if (sctp_is_address_in_scope(ifa,
3868                                             stc.ipv4_addr_legal,
3869                                             stc.ipv6_addr_legal,
3870                                             stc.loopback_scope, stc.ipv4_scope,
3871                                             stc.local_scope, stc.site_scope) == 0) {
3872                                                 continue;
3873                                         }
3874                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3875                                 }
3876                         }
3877                 }
3878         } else {
3879                 struct sctp_laddr *laddr;
3880                 int cnt;
3881                 cnt = cnt_inits_to;
3882                 /* First, how many ? */
3883                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3884                         if (laddr->ifa == NULL) {
3885                                 continue;
3886                         }
3887                         if (laddr->ifa->ifa_addr == NULL)
3888                                 continue;
3889                         if (sctp_is_address_in_scope(laddr->ifa,
3890                             stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3891                             stc.loopback_scope, stc.ipv4_scope,
3892                             stc.local_scope, stc.site_scope) == 0) {
3893                                 continue;
3894                         }
3895                         cnt++;
3896                 }
3897                 /* If we bind a single address only we won't list
3898                  * any. This way you can get through a NAT
3899                  */
3900                 if (cnt > 1) {
3901                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3902                                 if (laddr->ifa == NULL) {
3903 #ifdef SCTP_DEBUG
3904                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3905                                                 kprintf("Help I have fallen and I can't get up!\n");
3906                                         }
3907 #endif
3908                                         continue;
3909                                 }
3910                                 if (laddr->ifa->ifa_addr == NULL)
3911                                         continue;
3912                                 if (sctp_is_address_in_scope(laddr->ifa,
3913                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3914                                     stc.loopback_scope, stc.ipv4_scope,
3915                                     stc.local_scope, stc.site_scope) == 0) {
3916                                         continue;
3917                                 }
3918                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3919                         }
3920                 }
3921         }
3922
3923         /* tack on the operational error if present */
3924         if (op_err) {
3925                 if (op_err->m_pkthdr.len % 4) {
3926                         /* must add a pad to the param */
3927                         u_int32_t cpthis=0;
3928                         int padlen;
3929                         padlen = 4 - (op_err->m_pkthdr.len % 4);
3930                         m_copyback(op_err, op_err->m_pkthdr.len, padlen, (caddr_t)&cpthis);
3931                 }
3932                 while (m_at->m_next != NULL) {
3933                         m_at = m_at->m_next;
3934                 }
3935                 m_at->m_next = op_err;
3936                 while (m_at->m_next != NULL) {
3937                         m_at = m_at->m_next;
3938                 }
3939         }
3940         /* Get total size of init packet */
3941         sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3942         /* pre-calulate the size and update pkt header and chunk header */
3943         m->m_pkthdr.len = 0;
3944         for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3945                 m->m_pkthdr.len += m_tmp->m_len;
3946                 if (m_tmp->m_next == NULL) {
3947                         /* m_tmp should now point to last one */
3948                         break;
3949                 }
3950         }
3951         /*
3952          * Figure now the size of the cookie. We know the size of the
3953          * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3954          * COOKIE-STRUCTURE and SIGNATURE.
3955          */
3956
3957         /*
3958          * take our earlier INIT calc and add in the sz we just calculated
3959          * minus the size of the sctphdr (its not included in chunk size
3960          */
3961
3962         /* add once for the INIT-ACK */
3963         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3964
3965         /* add a second time for the INIT-ACK in the cookie */
3966         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3967
3968         /* Now add the cookie header and cookie message struct */
3969         sz_of += sizeof(struct sctp_state_cookie_param);
3970         /* ...and add the size of our signature */
3971         sz_of += SCTP_SIGNATURE_SIZE;
3972         initackm_out->msg.ch.chunk_length = htons(sz_of);
3973
3974         /* Now we must build a cookie */
3975         m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3976             sizeof(struct sctphdr), &stc);
3977         if (m_cookie == NULL) {
3978                 /* memory problem */
3979                 sctp_m_freem(m);
3980                 return;
3981         }
3982         /* Now append the cookie to the end and update the space/size */
3983         m_tmp->m_next = m_cookie;
3984
3985         /*
3986          * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3987          * return here since the timer will drive a retranmission.
3988          */
3989         padval = m->m_pkthdr.len % 4;
3990         if ((padval) && (m_last)) {
3991                 /* see my previous comments on m_last */
3992                 int ret;
3993                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
3994                 if (ret) {
3995                         /* Houston we have a problem, no space */
3996                         sctp_m_freem(m);
3997                         return;
3998                 }
3999                 m->m_pkthdr.len += padval;
4000         }
4001         sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
4002 }
4003
4004
4005 static void
4006 sctp_insert_on_wheel(struct sctp_association *asoc,
4007                      struct sctp_stream_out *strq)
4008 {
4009         struct sctp_stream_out *stre, *strn;
4010         stre = TAILQ_FIRST(&asoc->out_wheel);
4011         if (stre == NULL) {
4012                 /* only one on wheel */
4013                 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
4014                 return;
4015         }
4016         for (; stre; stre = strn) {
4017                 strn = TAILQ_NEXT(stre, next_spoke);
4018                 if (stre->stream_no > strq->stream_no) {
4019                         TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
4020                         return;
4021                 } else if (stre->stream_no == strq->stream_no) {
4022                         /* huh, should not happen */
4023                         return;
4024                 } else if (strn == NULL) {
4025                         /* next one is null */
4026                         TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
4027                                            next_spoke);
4028                 }
4029         }
4030 }
4031
4032 static void
4033 sctp_remove_from_wheel(struct sctp_association *asoc,
4034                        struct sctp_stream_out *strq)
4035 {
4036         /* take off and then setup so we know it is not on the wheel */
4037         TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
4038         strq->next_spoke.tqe_next = NULL;
4039         strq->next_spoke.tqe_prev = NULL;
4040 }
4041
4042
4043 static void
4044 sctp_prune_prsctp(struct sctp_tcb *stcb,
4045                   struct sctp_association *asoc,
4046                   struct sctp_sndrcvinfo *srcv,
4047                   int dataout
4048         )
4049 {
4050         int freed_spc=0;
4051         struct sctp_tmit_chunk *chk, *nchk;
4052         if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
4053                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4054                         /*
4055                          * Look for chunks marked with the PR_SCTP
4056                          * flag AND the buffer space flag. If the one
4057                          * being sent is equal or greater priority then
4058                          * purge the old one and free some space.
4059                          */
4060                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4061                                            SCTP_PR_SCTP_BUFFER)) ==
4062                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4063                                 /*
4064                                  * This one is PR-SCTP AND buffer space
4065                                  * limited type
4066                                  */
4067                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4068                                         /* Lower numbers equates to
4069                                          * higher priority so if the
4070                                          * one we are looking at has a
4071                                          * larger or equal priority we
4072                                          * want to drop the data and
4073                                          * NOT retransmit it.
4074                                          */
4075                                         if (chk->data) {
4076                                                 /* We release the
4077                                                  * book_size if the
4078                                                  * mbuf is here
4079                                                  */
4080                                                 int ret_spc;
4081                                                 int cause;
4082                                                 if (chk->sent > SCTP_DATAGRAM_UNSENT)
4083                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
4084                                                 else
4085                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
4086                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4087                                                                                       cause,
4088                                                                                       &asoc->sent_queue);
4089                                                 freed_spc += ret_spc;
4090                                                 if (freed_spc >= dataout) {
4091                                                         return;
4092                                                 }
4093                                         } /* if chunk was present */
4094                                 } /* if of sufficent priority */
4095                         } /* if chunk has enabled */
4096                 } /* tailqforeach */
4097
4098                 chk = TAILQ_FIRST(&asoc->send_queue);
4099                 while (chk) {
4100                         nchk = TAILQ_NEXT(chk, sctp_next);
4101                         /* Here we must move to the sent queue and mark */
4102                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4103                                            SCTP_PR_SCTP_BUFFER)) ==
4104                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4105                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4106                                         if (chk->data) {
4107                                                 /* We release the
4108                                                  * book_size if the
4109                                                  * mbuf is here
4110                                                  */
4111                                                 int ret_spc;
4112                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4113                                                     SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
4114                                                     &asoc->send_queue);
4115
4116                                                 freed_spc += ret_spc;
4117                                                 if (freed_spc >= dataout) {
4118                                                         return;
4119                                                 }
4120                                         } /* end if chk->data */
4121                                 } /* end if right class */
4122                         } /* end if chk pr-sctp */
4123                         chk = nchk;
4124                 } /* end while (chk) */
4125         } /* if enabled in asoc */
4126 }
4127
4128 static void
4129 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4130                    struct sctp_tcb *stcb,
4131                    struct sctp_sndrcvinfo *srcv,
4132                    struct sctp_stream_out *strq,
4133                    struct sctp_nets *net)
4134 {
4135         bzero(template, sizeof(struct sctp_tmit_chunk));
4136         template->sent = SCTP_DATAGRAM_UNSENT;
4137         if ((stcb->asoc.peer_supports_prsctp) &&
4138             (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4139             (srcv->sinfo_timetolive > 0)
4140                 ) {
4141                 /* If:
4142                  *  Peer supports PR-SCTP
4143                  *  The flags is set against this send for PR-SCTP
4144                  *  And timetolive is a postive value, zero is reserved
4145                  *     to mean a reliable send for both buffer/time
4146                  *     related one.
4147                  */
4148                 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4149                         /*
4150                          * Time to live is a priority stored in tv_sec
4151                          * when doing the buffer drop thing.
4152                          */
4153                         template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4154                 } else {
4155                         struct timeval tv;
4156
4157                         SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4158                         tv.tv_sec = srcv->sinfo_timetolive / 1000;
4159                         tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4160 #ifndef __FreeBSD__
4161                         timeradd(&template->rec.data.timetodrop, &tv,
4162                             &template->rec.data.timetodrop);
4163 #else
4164                         timevaladd(&template->rec.data.timetodrop, &tv);
4165 #endif
4166                 }
4167         }
4168         if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4169                 template->rec.data.stream_seq = strq->next_sequence_sent;
4170         } else {
4171                 template->rec.data.stream_seq = 0;
4172         }
4173         template->rec.data.TSN_seq = 0; /* not yet assigned */
4174
4175         template->rec.data.stream_number = srcv->sinfo_stream;
4176         template->rec.data.payloadtype = srcv->sinfo_ppid;
4177         template->rec.data.context = srcv->sinfo_context;
4178         template->rec.data.doing_fast_retransmit = 0;
4179         template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4180
4181         if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4182                 template->whoTo = net;
4183         } else {
4184                 if (stcb->asoc.primary_destination)
4185                         template->whoTo = stcb->asoc.primary_destination;
4186                 else {
4187                         /* TSNH */
4188                         template->whoTo = net;
4189                 }
4190         }
4191         /* the actual chunk flags */
4192         if (srcv->sinfo_flags & MSG_UNORDERED) {
4193                 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4194         } else {
4195                 template->rec.data.rcv_flags = 0;
4196         }
4197         /* no flags yet, FRAGMENT_OK goes here */
4198         template->flags = 0;
4199         /* PR sctp flags */
4200         if (stcb->asoc.peer_supports_prsctp) {
4201                 if (srcv->sinfo_timetolive > 0) {
4202                         /*
4203                          * We only set the flag if timetolive (or
4204                          * priority) was set to a positive number.
4205                          * Zero is reserved specifically to be
4206                          * EXCLUDED and sent reliable.
4207                          */
4208                         if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4209                                 template->flags |= SCTP_PR_SCTP_ENABLED;
4210                         }
4211                         if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4212                                 template->flags |= SCTP_PR_SCTP_BUFFER;
4213                         }
4214                 }
4215         }
4216         template->asoc = &stcb->asoc;
4217 }
4218
4219
4220 int
4221 sctp_get_frag_point(struct sctp_tcb *stcb,
4222                     struct sctp_association *asoc)
4223 {
4224         int siz, ovh;
4225
4226         /* For endpoints that have both 6 and 4 addresses
4227          * we must reserver room for the 6 ip header, for
4228          * those that are only dealing with V4 we use
4229          * a larger frag point.
4230          */
4231         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4232                 ovh = SCTP_MED_OVERHEAD;
4233         } else {
4234                 ovh = SCTP_MED_V4_OVERHEAD;
4235         }
4236
4237         if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4238                 siz = asoc->smallest_mtu - ovh;
4239         else
4240                 siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4241 /*
4242   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4243                 /* A data chunk MUST fit in a cluster */
4244 /*              siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4245 /*      }*/
4246
4247         if (siz % 4) {
4248                 /* make it an even word boundary please */
4249                 siz -= (siz % 4);
4250         }
4251         return (siz);
4252 }
4253 extern unsigned int sctp_max_chunks_on_queue;
4254
4255 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4256
4257 static int
4258 sctp_msg_append(struct sctp_tcb *stcb,
4259                 struct sctp_nets *net,
4260                 struct mbuf *m,
4261                 struct sctp_sndrcvinfo *srcv,
4262                 int flags)
4263 {
4264         struct socket *so;
4265         struct sctp_association *asoc;
4266         struct sctp_stream_out *strq;
4267         struct sctp_tmit_chunk *chk;
4268         struct sctpchunk_listhead tmp;
4269         struct sctp_tmit_chunk template;
4270         struct mbuf *n, *mnext;
4271         struct mbuf *mm;
4272         unsigned int dataout, siz;
4273         int mbcnt = 0;
4274         int mbcnt_e = 0;
4275         int error = 0;
4276
4277         if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4278                 /* Software fault, you blew it on the call */
4279 #ifdef SCTP_DEBUG
4280                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4281                         kprintf("software error in sctp_msg_append:1\n");
4282                         kprintf("stcb:%p net:%p m:%p srcv:%p\n",
4283                                stcb, net, m, srcv);
4284                 }
4285 #endif
4286                 if (m)
4287                         sctp_m_freem(m);
4288                 return (EFAULT);
4289         }
4290         so = stcb->sctp_socket;
4291         asoc = &stcb->asoc;
4292         if (srcv->sinfo_flags & MSG_ABORT) {
4293                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4294                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4295                         /* It has to be up before we abort */
4296                         /* how big is the user initiated abort? */
4297                         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4298                                 dataout = m->m_pkthdr.len;
4299                         } else {
4300                                 /* we must count */
4301                                 dataout = 0;
4302                                 for (n = m; n; n = n->m_next) {
4303                                         dataout += n->m_len;
4304                                 }
4305                         }
4306                         M_PREPEND(m, sizeof(struct sctp_paramhdr), MB_DONTWAIT);
4307                         if (m) {
4308                                 struct sctp_paramhdr *ph;
4309                                 m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4310                                 ph = mtod(m, struct sctp_paramhdr *);
4311                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4312                                 ph->param_length = htons(m->m_len);
4313                         }
4314                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4315                         m = NULL;
4316                 } else {
4317                         /* Only free if we don't send an abort */
4318                         ;
4319                 }
4320                 goto out;
4321         }
4322         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4323             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4324             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4325             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4326                 /* got data while shutting down */
4327                 error = ECONNRESET;
4328                 goto out;
4329         }
4330
4331         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4332                 /* Invalid stream number */
4333                 error = EINVAL;
4334                 goto out;
4335         }
4336         if (asoc->strmout == NULL) {
4337                 /* huh? software error */
4338 #ifdef SCTP_DEBUG
4339                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4340                         kprintf("software error in sctp_msg_append:2\n");
4341                 }
4342 #endif
4343                 error = EFAULT;
4344                 goto out;
4345         }
4346         strq = &asoc->strmout[srcv->sinfo_stream];
4347         /* how big is it ? */
4348         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4349                 dataout = m->m_pkthdr.len;
4350         } else {
4351                 /* we must count */
4352                 dataout = 0;
4353                 for (n = m; n; n = n->m_next) {
4354                         dataout += n->m_len;
4355                 }
4356         }
4357 #ifdef SCTP_DEBUG
4358         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4359                 kprintf("Attempt to send out %d bytes\n",
4360                        dataout);
4361         }
4362 #endif
4363
4364         /* lock the socket buf */
4365         SOCKBUF_LOCK(&so->so_snd);
4366         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
4367         if (error)
4368                 goto out_locked;
4369
4370         if (dataout > so->so_snd.ssb_hiwat) {
4371                 /* It will NEVER fit */
4372                 error = EMSGSIZE;
4373                 goto release;
4374         }
4375         if ((srcv->sinfo_flags & MSG_EOF) &&
4376             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4377             (dataout == 0)
4378                 ) {
4379                 goto zap_by_it_all;
4380         }
4381         if ((so->so_snd.ssb_hiwat <
4382              (dataout + asoc->total_output_queue_size)) ||
4383             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4384             (asoc->total_output_mbuf_queue_size >
4385              so->so_snd.ssb_mbmax)
4386                 ) {
4387                 /* XXX Buffer space hunt for data to skip */
4388                 if (asoc->peer_supports_prsctp) {
4389                         sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4390                 }
4391                 while ((so->so_snd.ssb_hiwat <
4392                     (dataout + asoc->total_output_queue_size)) ||
4393                     (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4394                     (asoc->total_output_mbuf_queue_size >
4395                     so->so_snd.ssb_mbmax)) {
4396                         struct sctp_inpcb *inp;
4397                         /* Now did we free up enough room? */
4398                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
4399                                 /* Non-blocking io in place */
4400                                 error = EWOULDBLOCK;
4401                                 goto release;
4402                         }
4403                         /*
4404                          * We store off a pointer to the endpoint.
4405                          * Since on return from this we must check to
4406                          * see if an so_error is set. If so we may have
4407                          * been reset and our stcb destroyed. Returning
4408                          * an error will cause the correct error return
4409                          * through and fix this all.
4410                          */
4411                         inp = stcb->sctp_ep;
4412                         /*
4413                          * Not sure how else to do this since
4414                          * the level we suspended at is not
4415                          * known deep down where we are. I will
4416                          * drop to spl0() so that others can
4417                          * get in.
4418                          */
4419
4420                         inp->sctp_tcb_at_block = (void *)stcb;
4421                         inp->error_on_block = 0;
4422                         ssb_unlock(&so->so_snd);
4423                         error = ssb_wait(&so->so_snd);
4424                         /*
4425                          * XXX: This is ugly but I have
4426                          * recreated most of what goes on to
4427                          * block in the sb. UGHH
4428                          * May want to add the bit about being
4429                          * no longer connected.. but this then
4430                          * further dooms the UDP model NOT to
4431                          * allow this.
4432                          */
4433                         inp->sctp_tcb_at_block = 0;
4434                         if (inp->error_on_block)
4435                                 error = inp->error_on_block;
4436                         if (so->so_error)
4437                                 error = so->so_error;
4438                         if (error) {
4439                                 goto out_locked;
4440                         }
4441                         error = ssb_lock(&so->so_snd, M_WAITOK);
4442                         if (error)
4443                                 goto out_locked;
4444                         /* Otherwise we cycle back and recheck
4445                          * the space
4446                          */
4447 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4448                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4449 #else
4450                         if (so->so_state & SS_CANTSENDMORE) {
4451 #endif
4452                                 error = EPIPE;
4453                                 goto release;
4454                         }
4455                         if (so->so_error) {
4456                                 error = so->so_error;
4457                                 goto release;
4458                         }
4459                 }
4460         }
4461         /* If we have a packet header fix it if it was broke */
4462         if (m->m_flags & M_PKTHDR) {
4463                 m->m_pkthdr.len = dataout;
4464         }
4465         /* use the smallest one, user set value or
4466          * smallest mtu of the asoc
4467          */
4468         siz = sctp_get_frag_point(stcb, asoc);
4469         SOCKBUF_UNLOCK(&so->so_snd);
4470         if ((dataout) && (dataout <= siz)) {
4471                 /* Fast path */
4472                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4473                 if (chk == NULL) {
4474                         error = ENOMEM;
4475                         SOCKBUF_LOCK(&so->so_snd);
4476                         goto release;
4477                 }
4478                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4479                 chk->whoTo->ref_count++;
4480                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4481
4482                 /* no flags yet, FRAGMENT_OK goes here */
4483                 sctppcbinfo.ipi_count_chunk++;
4484                 sctppcbinfo.ipi_gencnt_chunk++;
4485                 asoc->chunks_on_out_queue++;
4486                 chk->data = m;
4487                 m = NULL;
4488                 /* Total in the MSIZE */
4489                 for (mm = chk->data; mm; mm = mm->m_next) {
4490                         mbcnt += MSIZE;
4491                         if (mm->m_flags & M_EXT) {
4492                                 mbcnt += chk->data->m_ext.ext_size;
4493                         }
4494                 }
4495                 /* fix up the send_size if it is not present */
4496                 chk->send_size = dataout;
4497                 chk->book_size = chk->send_size;
4498                 chk->mbcnt = mbcnt;
4499                 /* ok, we are commited */
4500                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4501                         /* bump the ssn if we are unordered. */
4502                         strq->next_sequence_sent++;
4503                 }
4504                 chk->data->m_nextpkt = 0;
4505                 asoc->stream_queue_cnt++;
4506                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4507                 /* now check if this stream is on the wheel */
4508                 if ((strq->next_spoke.tqe_next == NULL) &&
4509                     (strq->next_spoke.tqe_prev == NULL)) {
4510                         /* Insert it on the wheel since it is not
4511                          * on it currently
4512                          */
4513                         sctp_insert_on_wheel(asoc, strq);
4514                 }
4515         } else if ((dataout) && (dataout > siz)) {
4516                 /* Slow path */
4517                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4518                     (dataout > siz)) {
4519                         error = EMSGSIZE;
4520                         SOCKBUF_LOCK(&so->so_snd);
4521                         goto release;
4522                 }
4523                 /* setup the template */
4524                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4525
4526                 n = m;
4527                 while (dataout > siz) {
4528                         /*
4529                          * We can wait since this is called from the user
4530                          * send side
4531                          */
4532                         n->m_nextpkt = m_split(n, siz, MB_WAIT);
4533                         if (n->m_nextpkt == NULL) {
4534                                 error = EFAULT;
4535                                 SOCKBUF_LOCK(&so->so_snd);
4536                                 goto release;
4537                         }
4538                         dataout -= siz;
4539                         n = n->m_nextpkt;
4540                 }
4541                 /*
4542                  * ok, now we have a chain on m where m->m_nextpkt points to
4543                  * the next chunk and m/m->m_next chain is the piece to send.
4544                  * We must go through the chains and thread them on to
4545                  * sctp_tmit_chunk chains and place them all on the stream
4546                  * queue, breaking the m->m_nextpkt pointers as we go.
4547                  */
4548                 n = m;
4549                 TAILQ_INIT(&tmp);
4550                 while (n) {
4551                         /*
4552                          * first go through and allocate a sctp_tmit chunk
4553                          * for each chunk piece
4554                          */
4555                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4556                         if (chk == NULL) {
4557                                 /*
4558                                  * ok we must spin through and dump anything
4559                                  * we have allocated and then jump to the
4560                                  * no_membad
4561                                  */
4562                                 chk = TAILQ_FIRST(&tmp);
4563                                 while (chk) {
4564                                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4565                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4566                                         sctppcbinfo.ipi_count_chunk--;
4567                                         asoc->chunks_on_out_queue--;
4568                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4569                                                 panic("Chunk count is negative");
4570                                         }
4571                                         sctppcbinfo.ipi_gencnt_chunk++;
4572                                         chk = TAILQ_FIRST(&tmp);
4573                                 }
4574                                 error = ENOMEM;
4575                                 SOCKBUF_LOCK(&so->so_snd);
4576                                 goto release;
4577                         }
4578                         sctppcbinfo.ipi_count_chunk++;
4579                         asoc->chunks_on_out_queue++;
4580
4581                         sctppcbinfo.ipi_gencnt_chunk++;
4582                         *chk = template;
4583                         chk->whoTo->ref_count++;
4584                         chk->data = n;
4585                         /* Total in the MSIZE */
4586                         mbcnt_e = 0;
4587                         for (mm = chk->data; mm; mm = mm->m_next) {
4588                                 mbcnt_e += MSIZE;
4589                                 if (mm->m_flags & M_EXT) {
4590                                         mbcnt_e += chk->data->m_ext.ext_size;
4591                                 }
4592                         }
4593                         /* now fix the chk->send_size */
4594                         if (chk->data->m_flags & M_PKTHDR) {
4595                                 chk->send_size = chk->data->m_pkthdr.len;
4596                         } else {
4597                                 struct mbuf *nn;
4598                                 chk->send_size = 0;
4599                                 for (nn = chk->data; nn; nn = nn->m_next) {
4600                                         chk->send_size += nn->m_len;
4601                                 }
4602                         }
4603                         chk->book_size = chk->send_size;
4604                         chk->mbcnt = mbcnt_e;
4605                         mbcnt += mbcnt_e;
4606                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4607                                 asoc->sent_queue_cnt_removeable++;
4608                         }
4609                         n = n->m_nextpkt;
4610                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4611                 }
4612                 m = NULL;
4613                 /* now that we have enough space for all de-couple the
4614                  * chain of mbufs by going through our temp array
4615                  * and breaking the pointers.
4616                  */
4617                 /* ok, we are commited */
4618                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4619                         /* bump the ssn if we are unordered. */
4620                         strq->next_sequence_sent++;
4621                 }
4622                 /* Mark the first/last flags. This will
4623                  * result int a 3 for a single item on the list
4624                  */
4625                 chk = TAILQ_FIRST(&tmp);
4626                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4627                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4628                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4629                 /* now break any chains on the queue and
4630                  * move it to the streams actual queue.
4631                  */
4632                 chk = TAILQ_FIRST(&tmp);
4633                 while (chk) {
4634                         chk->data->m_nextpkt = 0;
4635                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4636                         asoc->stream_queue_cnt++;
4637                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4638                         chk = TAILQ_FIRST(&tmp);
4639                 }
4640                 /* now check if this stream is on the wheel */
4641                 if ((strq->next_spoke.tqe_next == NULL) &&
4642                     (strq->next_spoke.tqe_prev == NULL)) {
4643                         /* Insert it on the wheel since it is not
4644                          * on it currently
4645                          */
4646                         sctp_insert_on_wheel(asoc, strq);
4647                 }
4648         }
4649         SOCKBUF_LOCK(&so->so_snd);
4650         /* has a SHUTDOWN been (also) requested by the user on this asoc? */
4651 zap_by_it_all:
4652
4653         if ((srcv->sinfo_flags & MSG_EOF) &&
4654             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4655
4656                 int some_on_streamwheel = 0;
4657
4658                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4659                         /* Check to see if some data queued */
4660                         struct sctp_stream_out *outs;
4661                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4662                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
4663                                         some_on_streamwheel = 1;
4664                                         break;
4665                                 }
4666                         }
4667                 }
4668
4669                 if (TAILQ_EMPTY(&asoc->send_queue) &&
4670                     TAILQ_EMPTY(&asoc->sent_queue) &&
4671                     (some_on_streamwheel == 0)) {
4672                         /* there is nothing queued to send, so I'm done... */
4673                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4674                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4675                                 /* only send SHUTDOWN the first time through */
4676 #ifdef SCTP_DEBUG
4677                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4678                                         kprintf("%s:%d sends a shutdown\n",
4679                                                __FILE__,
4680                                                __LINE__
4681                                                 );
4682                                 }
4683 #endif
4684                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4685                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4686                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4687                                                  asoc->primary_destination);
4688                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4689                                                  asoc->primary_destination);
4690                         }
4691                 } else {
4692                         /*
4693                          * we still got (or just got) data to send, so set
4694                          * SHUTDOWN_PENDING
4695                          */
4696                         /*
4697                          * XXX sockets draft says that MSG_EOF should be sent
4698                          * with no data.  currently, we will allow user data
4699                          * to be sent first and move to SHUTDOWN-PENDING
4700                          */
4701                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4702                 }
4703         }
4704 #ifdef SCTP_MBCNT_LOGGING
4705         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4706                        asoc->total_output_queue_size,
4707                        dataout,
4708                        asoc->total_output_mbuf_queue_size,
4709                        mbcnt);
4710 #endif
4711         asoc->total_output_queue_size += dataout;
4712         asoc->total_output_mbuf_queue_size += mbcnt;
4713         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4714             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4715                 so->so_snd.ssb_cc += dataout;
4716                 so->so_snd.ssb_mbcnt += mbcnt;
4717         }
4718
4719 #ifdef SCTP_DEBUG
4720         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4721                 kprintf("++total out:%d total_mbuf_out:%d\n",
4722                        (int)asoc->total_output_queue_size,
4723                        (int)asoc->total_output_mbuf_queue_size);
4724         }
4725 #endif
4726
4727 release:
4728         ssb_unlock(&so->so_snd);
4729 out_locked:
4730         SOCKBUF_UNLOCK(&so->so_snd);
4731 out:
4732         if (m && m->m_nextpkt) {
4733                 n = m;
4734                 while (n) {
4735                         mnext = n->m_nextpkt;
4736                         n->m_nextpkt = NULL;
4737                         sctp_m_freem(n);
4738                         n = mnext;
4739                 }
4740         } else if (m)
4741                 sctp_m_freem(m);
4742
4743         return (error);
4744 }
4745
4746 static struct mbuf *
4747 sctp_copy_mbufchain(struct mbuf *clonechain,
4748                     struct mbuf *outchain)
4749 {
4750         struct mbuf *appendchain;
4751 #if defined(__FreeBSD__) || defined(__NetBSD__)
4752         /* Supposedly m_copypacket is an optimization, use it if we can */
4753         if (clonechain->m_flags & M_PKTHDR) {
4754                 appendchain = m_copypacket(clonechain, MB_DONTWAIT);
4755                 sctp_pegs[SCTP_CACHED_SRC]++;
4756         } else
4757                 appendchain = m_copy(clonechain, 0, M_COPYALL);
4758 #elif defined(__APPLE__)
4759         appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, MB_DONTWAIT);
4760 #else
4761         appendchain = m_copy(clonechain, 0, M_COPYALL);
4762 #endif
4763
4764         if (appendchain == NULL) {
4765                 /* error */
4766                 if (outchain)
4767                         sctp_m_freem(outchain);
4768                 return (NULL);
4769         }
4770         if (outchain) {
4771                 /* tack on to the end */
4772                 struct mbuf *m;
4773                 m = outchain;
4774                 while (m) {
4775                         if (m->m_next == NULL) {
4776                                 m->m_next = appendchain;
4777                                 break;
4778                         }
4779                         m = m->m_next;
4780                 }
4781                 if (outchain->m_flags & M_PKTHDR) {
4782                         int append_tot;
4783                         struct mbuf *t;
4784                         t = appendchain;
4785                         append_tot = 0;
4786                         while (t) {
4787                                 append_tot += t->m_len;
4788                                 t = t->m_next;
4789                         }
4790                         outchain->m_pkthdr.len += append_tot;
4791                 }
4792                 return (outchain);
4793         } else {
4794                 return (appendchain);
4795         }
4796 }
4797
4798 static void
4799 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4800 {
4801         struct sctp_copy_all *ca;
4802         struct mbuf *m;
4803         int ret;
4804
4805         ca = (struct sctp_copy_all *)ptr;
4806         if (ca->m == NULL) {
4807                 return;
4808         }
4809         if (ca->inp != inp) {
4810                 /* TSNH */
4811                 return;
4812         }
4813         m = sctp_copy_mbufchain(ca->m, NULL);
4814         if (m == NULL) {
4815                 /* can't copy so we are done */
4816                 ca->cnt_failed++;
4817                 return;
4818         }
4819         ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
4820                               &ca->sndrcv, MSG_FNONBLOCKING);
4821         if (ret) {
4822                 ca->cnt_failed++;
4823         } else {
4824                 ca->cnt_sent++;
4825         }
4826 }
4827
4828 static void
4829 sctp_sendall_completes(void *ptr, u_int32_t val)
4830 {
4831         struct sctp_copy_all *ca;
4832         ca = (struct sctp_copy_all *)ptr;
4833         /* Do a notify here?
4834          * Kacheong suggests that the notify
4835          * be done at the send time.. so you would
4836          * push up a notification if any send failed.
4837          * Don't know if this is feasable since the
4838          * only failures we have is "memory" related and
4839          * if you cannot get an mbuf to send the data
4840          * you surely can't get an mbuf to send up
4841          * to notify the user you can't send the data :->
4842          */
4843
4844         /* now free everything */
4845         m_freem(ca->m);
4846         FREE(ca, M_PCB);
4847 }
4848
4849
4850 #define MC_ALIGN(m, len) do {                                           \
4851         (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);                \
4852 } while (0)
4853
4854
4855
4856 static struct mbuf *
4857 sctp_copy_out_all(struct uio *uio, int len)
4858 {
4859         struct mbuf *ret, *at;
4860         int left, willcpy, cancpy, error;
4861
4862         MGETHDR(ret, MB_WAIT, MT_HEADER);
4863         if (ret == NULL) {
4864                 /* TSNH */
4865                 return (NULL);
4866         }
4867         left = len;
4868         ret->m_len = 0;
4869         ret->m_pkthdr.len = len;
4870         MCLGET(ret, MB_WAIT);
4871         if (ret == NULL) {
4872                 return (NULL);
4873         }
4874         if ((ret->m_flags & M_EXT) == 0) {
4875                 m_freem (ret);
4876                 return (NULL);
4877         }
4878         cancpy = M_TRAILINGSPACE(ret);
4879         willcpy = min(cancpy, left);
4880         at = ret;
4881         while (left > 0) {
4882                 /* Align data to the end */
4883                 MC_ALIGN(at, willcpy);
4884                 error = uiomove(mtod(at, caddr_t), willcpy, uio);
4885                 if (error) {
4886                 err_out_now:
4887                         m_freem(ret);
4888                         return (NULL);
4889                 }
4890                 at->m_len = willcpy;
4891                 at->m_nextpkt = at->m_next = 0;
4892                 left -= willcpy;
4893                 if (left > 0) {
4894                         MGET(at->m_next, MB_WAIT, MT_DATA);
4895                         if (at->m_next == NULL) {
4896                                 goto err_out_now;
4897                         }
4898                         at = at->m_next;
4899                         at->m_len = 0;
4900                         MCLGET(at, MB_WAIT);
4901                         if (at == NULL) {
4902                                 goto err_out_now;
4903                         }
4904                         if ((at->m_flags & M_EXT) == 0) {
4905                                 goto err_out_now;
4906                         }
4907                         cancpy = M_TRAILINGSPACE(at);
4908                         willcpy = min(cancpy, left);
4909                 }
4910         }
4911         return (ret);
4912 }
4913
4914 static int
4915 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4916 {
4917         int ret;
4918         struct sctp_copy_all *ca;
4919         MALLOC(ca, struct sctp_copy_all *,
4920                sizeof(struct sctp_copy_all), M_PCB, MB_WAIT);
4921         if (ca == NULL) {
4922                 m_freem(m);
4923                 return (ENOMEM);
4924         }
4925         memset (ca, 0, sizeof(struct sctp_copy_all));
4926
4927         ca->inp = inp;
4928         ca->sndrcv = *srcv;
4929         /* take off the sendall flag, it would
4930          * be bad if we failed to do this  :-0
4931          */
4932         ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4933
4934         /* get length and mbuf chain */
4935         if (uio) {
4936                 ca->sndlen = uio->uio_resid;
4937                 ca->m = sctp_copy_out_all(uio, ca->sndlen);
4938                 if (ca->m == NULL) {
4939                         FREE(ca, M_PCB);
4940                         return (ENOMEM);
4941                 }
4942         } else {
4943                 if ((m->m_flags & M_PKTHDR) == 0) {
4944                         struct mbuf *mat;
4945                         mat = m;
4946                         ca->sndlen = 0;
4947                         while(m) {
4948                                 ca->sndlen += m->m_len;
4949                                 m = m->m_next;
4950                         }
4951                 } else {
4952                         ca->sndlen = m->m_pkthdr.len;
4953                 }
4954                 ca->m = m;
4955         }
4956
4957         ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4958                                      (void *)ca, 0, sctp_sendall_completes, inp);
4959         if (ret) {
4960 #ifdef SCTP_DEBUG
4961                 kprintf("Failed to initate iterator to takeover associations\n");
4962 #endif
4963                 FREE(ca, M_PCB);
4964                 return (EFAULT);
4965
4966         }
4967         return (0);
4968 }
4969
4970
4971 void
4972 sctp_toss_old_cookies(struct sctp_association *asoc)
4973 {
4974         struct sctp_tmit_chunk *chk, *nchk;
4975         chk = TAILQ_FIRST(&asoc->control_send_queue);
4976         while (chk) {
4977                 nchk = TAILQ_NEXT(chk, sctp_next);
4978                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4979                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4980                         if (chk->data) {
4981                                 sctp_m_freem(chk->data);
4982                                 chk->data = NULL;
4983                         }
4984                         asoc->ctrl_queue_cnt--;
4985                         if (chk->whoTo)
4986                                 sctp_free_remote_addr(chk->whoTo);
4987                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4988                         sctppcbinfo.ipi_count_chunk--;
4989                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4990                                 panic("Chunk count is negative");
4991                         }
4992                         sctppcbinfo.ipi_gencnt_chunk++;
4993                 }
4994                 chk = nchk;
4995         }
4996 }
4997
4998 void
4999 sctp_toss_old_asconf(struct sctp_tcb *stcb)
5000 {
5001         struct sctp_association *asoc;
5002         struct sctp_tmit_chunk *chk, *chk_tmp;
5003
5004         asoc = &stcb->asoc;
5005         for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
5006              chk = chk_tmp) {
5007                 /* get next chk */
5008                 chk_tmp = TAILQ_NEXT(chk, sctp_next);
5009                 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */
5010                 if (chk->rec.chunk_id == SCTP_ASCONF) {
5011                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5012                         if (chk->data) {
5013                                 sctp_m_freem(chk->data);
5014                                 chk->data = NULL;
5015                         }
5016                         asoc->ctrl_queue_cnt--;
5017                         if (chk->whoTo)
5018                                 sctp_free_remote_addr(chk->whoTo);
5019                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5020                         sctppcbinfo.ipi_count_chunk--;
5021                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5022                                 panic("Chunk count is negative");
5023                         }
5024                         sctppcbinfo.ipi_gencnt_chunk++;
5025                 }
5026         }
5027 }
5028
5029
5030 static void
5031 sctp_clean_up_datalist(struct sctp_tcb *stcb,
5032                        struct sctp_association *asoc,
5033                        struct sctp_tmit_chunk **data_list,
5034                        int bundle_at,
5035                        struct sctp_nets *net)
5036 {
5037         int i;
5038         for (i = 0; i < bundle_at; i++) {
5039                 /* off of the send queue */
5040                 if (i) {
5041                         /* Any chunk NOT 0 you zap the time
5042                          * chunk 0 gets zapped or set based on
5043                          * if a RTO measurment is needed.
5044                          */
5045                         data_list[i]->do_rtt = 0;
5046                 }
5047                 /* record time */
5048                 data_list[i]->sent_rcv_time = net->last_sent_time;
5049                 TAILQ_REMOVE(&asoc->send_queue,
5050                              data_list[i],
5051                              sctp_next);
5052                 /* on to the sent queue */
5053                 TAILQ_INSERT_TAIL(&asoc->sent_queue,
5054                                   data_list[i],
5055                                   sctp_next);
5056                 /* This does not lower until the cum-ack passes it */
5057                 asoc->sent_queue_cnt++;
5058                 asoc->send_queue_cnt--;
5059                 if ((asoc->peers_rwnd <= 0) &&
5060                     (asoc->total_flight == 0) &&
5061                     (bundle_at == 1)) {
5062                         /* Mark the chunk as being a window probe */
5063 #ifdef SCTP_DEBUG
5064                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
5065                                 kprintf("WINDOW PROBE SET\n");
5066                         }
5067 #endif
5068                         sctp_pegs[SCTP_WINDOW_PROBES]++;
5069                         data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
5070                 } else {
5071                         data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
5072                 }
5073 #ifdef SCTP_AUDITING_ENABLED
5074                 sctp_audit_log(0xC2, 3);
5075 #endif
5076                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
5077                 data_list[i]->snd_count = 1;
5078                 net->flight_size += data_list[i]->book_size;
5079                 asoc->total_flight += data_list[i]->book_size;
5080                 asoc->total_flight_count++;
5081 #ifdef SCTP_LOG_RWND
5082                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
5083                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
5084 #endif
5085                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
5086                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
5087                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5088                         /* SWS sender side engages */
5089                         asoc->peers_rwnd = 0;
5090                 }
5091         }
5092 }
5093
5094 static void
5095 sctp_clean_up_ctl(struct sctp_association *asoc)
5096 {
5097         struct sctp_tmit_chunk *chk, *nchk;
5098         for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5099             chk; chk = nchk) {
5100                 nchk = TAILQ_NEXT(chk, sctp_next);
5101                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5102                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5103                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5104                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5105                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5106                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5107                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5108                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5109                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5110                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5111                         /* Stray chunks must be cleaned up */
5112                 clean_up_anyway:
5113                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5114                         if (chk->data) {
5115                                 sctp_m_freem(chk->data);
5116                                 chk->data = NULL;
5117                         }
5118                         asoc->ctrl_queue_cnt--;
5119                         sctp_free_remote_addr(chk->whoTo);
5120                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5121                         sctppcbinfo.ipi_count_chunk--;
5122                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5123                                 panic("Chunk count is negative");
5124                         }
5125                         sctppcbinfo.ipi_gencnt_chunk++;
5126                 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
5127                         struct sctp_stream_reset_req *strreq;
5128                         /* special handling, we must look into the param */
5129                         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
5130                         if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5131                                 goto clean_up_anyway;
5132                         }
5133                 }
5134         }
5135 }
5136
5137 static int
5138 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5139                       struct sctp_stream_out *strq)
5140 {
5141         /* Move from the stream to the send_queue keeping track of the total */
5142         struct sctp_association *asoc;
5143         int tot_moved = 0;
5144         int failed = 0;
5145         int padval;
5146         struct sctp_tmit_chunk *chk, *nchk;
5147         struct sctp_data_chunk *dchkh;
5148         struct sctpchunk_listhead tmp;
5149         struct mbuf *orig;
5150
5151         asoc = &stcb->asoc;
5152         TAILQ_INIT(&tmp);
5153         chk = TAILQ_FIRST(&strq->outqueue);
5154         while (chk) {
5155                 nchk = TAILQ_NEXT(chk, sctp_next);
5156                 /* now put in the chunk header */
5157                 orig = chk->data;
5158                 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), MB_DONTWAIT);
5159                 if (chk->data == NULL) {
5160                         /* HELP */
5161                         failed++;
5162                         break;
5163                 }
5164                 if (orig != chk->data) {
5165                         /* A new mbuf was added, account for it */
5166                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5167                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5168                                 stcb->sctp_socket->so_snd.ssb_mbcnt += MSIZE;
5169                         }
5170 #ifdef SCTP_MBCNT_LOGGING
5171                         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5172                                        asoc->total_output_queue_size,
5173                                        0,
5174                                        asoc->total_output_mbuf_queue_size,
5175                                        MSIZE);
5176 #endif
5177                         stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5178                         chk->mbcnt += MSIZE;
5179                 }
5180                 chk->send_size += sizeof(struct sctp_data_chunk);
5181                 /* This should NOT have to do anything, but
5182                  * I would rather be cautious
5183                  */
5184                 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5185                         m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5186                         if (chk->data == NULL) {
5187                                 failed++;
5188                                 break;
5189                         }
5190                 }
5191                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5192                 dchkh->ch.chunk_length = htons(chk->send_size);
5193                 /* Chunks must be padded to even word boundary */
5194                 padval = chk->send_size % 4;
5195                 if (padval) {
5196                         /* For fragmented messages this should not
5197                          * run except possibly on the last chunk
5198                          */
5199                         if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5200                                 /* we are in big big trouble no mbufs :< */
5201                                 failed++;
5202                                 break;
5203                         }
5204                         chk->send_size += (4 - padval);
5205                 }
5206                 /* pull from stream queue */
5207                 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5208                 asoc->stream_queue_cnt--;
5209                 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5210                 /* add it in to the size of moved chunks */
5211                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5212                         /* we pull only one message */
5213                         break;
5214                 }
5215                 chk = nchk;
5216         }
5217         if (failed) {
5218                 /* Gak, we just lost the user message */
5219                 chk = TAILQ_FIRST(&tmp);
5220                 while (chk) {
5221                         nchk = TAILQ_NEXT(chk, sctp_next);
5222                         TAILQ_REMOVE(&tmp, chk, sctp_next);
5223
5224                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5225                                         (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5226                                         chk);
5227
5228                         if (chk->data) {
5229                                 sctp_m_freem(chk->data);
5230                                 chk->data = NULL;
5231                         }
5232                         if (chk->whoTo) {
5233                                 sctp_free_remote_addr(chk->whoTo);
5234                                 chk->whoTo = NULL;
5235                         }
5236                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5237                         sctppcbinfo.ipi_count_chunk--;
5238                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5239                                 panic("Chunk count is negative");
5240                         }
5241                         sctppcbinfo.ipi_gencnt_chunk++;
5242                         chk = nchk;
5243                 }
5244                 return (0);
5245         }
5246         /* now pull them off of temp wheel */
5247         chk = TAILQ_FIRST(&tmp);
5248         while (chk) {
5249                 nchk = TAILQ_NEXT(chk, sctp_next);
5250                 /* insert on send_queue */
5251                 TAILQ_REMOVE(&tmp, chk, sctp_next);
5252                 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5253                 asoc->send_queue_cnt++;
5254                 /* assign TSN */
5255                 chk->rec.data.TSN_seq = asoc->sending_seq++;
5256
5257                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5258                 /* Put the rest of the things in place now. Size
5259                  * was done earlier in previous loop prior to
5260                  * padding.
5261                  */
5262                 dchkh->ch.chunk_type = SCTP_DATA;
5263                 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5264                 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5265                 dchkh->dp.stream_id = htons(strq->stream_no);
5266                 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5267                 dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5268                 /* total count moved */
5269                 tot_moved += chk->send_size;
5270                 chk = nchk;
5271         }
5272         return (tot_moved);
5273 }
5274
5275 static void
5276 sctp_fill_outqueue(struct sctp_tcb *stcb,
5277                    struct sctp_nets *net)
5278 {
5279         struct sctp_association *asoc;
5280         struct sctp_tmit_chunk *chk;
5281         struct sctp_stream_out *strq, *strqn;
5282         int mtu_fromwheel, goal_mtu;
5283         unsigned int moved, seenend, cnt_mvd=0;
5284
5285         asoc = &stcb->asoc;
5286         /* Attempt to move at least 1 MTU's worth
5287          * onto the wheel for each destination address
5288          */
5289         goal_mtu = net->cwnd - net->flight_size;
5290         if ((unsigned int)goal_mtu < net->mtu) {
5291                 goal_mtu = net->mtu;
5292         }
5293         if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5294                 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5295         }
5296         seenend = moved = mtu_fromwheel = 0;
5297         if (asoc->last_out_stream == NULL) {
5298                 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5299                 if (asoc->last_out_stream == NULL) {
5300                         /* huh nothing on the wheel, TSNH */
5301                         return;
5302                 }
5303                 goto done_it;
5304         }
5305         strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5306  done_it:
5307         if (strq == NULL) {
5308                 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5309         }
5310         while (mtu_fromwheel < goal_mtu) {
5311                 if (strq == NULL) {
5312                         if (seenend == 0) {
5313                                 seenend = 1;
5314                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5315                         } else if ((moved == 0) && (seenend)) {
5316                                 /* none left on the wheel */
5317                                 sctp_pegs[SCTP_MOVED_NLEF]++;
5318                                 return;
5319                         } else if (moved) {
5320                                 /*
5321                                  * clear the flags and rotate back through
5322                                  * again
5323                                  */
5324                                 moved = 0;
5325                                 seenend = 0;
5326                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5327                         }
5328                         if (strq == NULL)
5329                                 break;
5330                         continue;
5331                 }
5332                 strqn = TAILQ_NEXT(strq, next_spoke);
5333                 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5334                         /* none left on this queue, prune a spoke?  */
5335                         sctp_remove_from_wheel(asoc, strq);
5336                         if (strq == asoc->last_out_stream) {
5337                             /* the last one we used went off the wheel */
5338                             asoc->last_out_stream = NULL;
5339                         }
5340                         strq = strqn;
5341                         continue;
5342                 }
5343                 if (chk->whoTo != net) {
5344                         /* Skip this stream, first one on stream
5345                          * does not head to our current destination.
5346                          */
5347                         strq = strqn;
5348                         continue;
5349                 }
5350                 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5351                 cnt_mvd++;
5352                 moved++;
5353                 asoc->last_out_stream = strq;
5354                 strq = strqn;
5355         }
5356         sctp_pegs[SCTP_MOVED_MAX]++;
5357 #ifdef SCTP_DEBUG
5358         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5359                 kprintf("Ok we moved %d chunks to send queue\n",
5360                        moved);
5361         }
5362 #endif
5363         if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5364                 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5365         }
5366 }
5367
5368 void
5369 sctp_fix_ecn_echo(struct sctp_association *asoc)
5370 {
5371         struct sctp_tmit_chunk *chk;
5372         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5373                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5374                         chk->sent = SCTP_DATAGRAM_UNSENT;
5375                 }
5376         }
5377 }
5378
5379 static void
5380 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5381                     struct sctp_association *asoc,
5382                     struct sctp_nets *net)
5383 {
5384         struct sctp_tmit_chunk *chk;
5385         struct sctp_nets *a_net;
5386         a_net = sctp_find_alternate_net(stcb, net);
5387         if ((a_net != net) &&
5388             ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5389                 /*
5390                  * We only proceed if a valid alternate is found that is
5391                  * not this one and is reachable. Here we must move all
5392                  * chunks queued in the send queue off of the destination
5393                  * address to our alternate.
5394                  */
5395                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5396                         if (chk->whoTo == net) {
5397                                 /* Move the chunk to our alternate */
5398                                 sctp_free_remote_addr(chk->whoTo);
5399                                 chk->whoTo = a_net;
5400                                 a_net->ref_count++;
5401                         }
5402                 }
5403         }
5404 }
5405
5406 static int sctp_from_user_send=0;
5407
5408 static int
5409 sctp_med_chunk_output(struct sctp_inpcb *inp,
5410                       struct sctp_tcb *stcb,
5411                       struct sctp_association *asoc,
5412                       int *num_out,
5413                       int *reason_code,
5414                       int control_only, int *cwnd_full, int from_where,
5415                       struct timeval *now, int *now_filled)
5416 {
5417         /*
5418          * Ok this is the generic chunk service queue.
5419          * we must do the following:
5420          *  - Service the stream queue that is next, moving any message
5421          *    (note I must get a complete message i.e. FIRST/MIDDLE and
5422          *    LAST to the out queue in one pass) and assigning TSN's
5423          *  - Check to see if the cwnd/rwnd allows any output, if so we
5424          *    go ahead and fomulate and send the low level chunks. Making
5425          *    sure to combine any control in the control chunk queue also.
5426          */
5427         struct sctp_nets *net;
5428         struct mbuf *outchain;
5429         struct sctp_tmit_chunk *chk, *nchk;
5430         struct sctphdr *shdr;
5431         /* temp arrays for unlinking */
5432         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5433         int no_fragmentflg, error;
5434         int one_chunk, hbflag;
5435         int asconf, cookie, no_out_cnt;
5436         int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5437         unsigned int mtu, r_mtu, omtu;
5438         *num_out = 0;
5439         cwnd_full_ind = 0;
5440         ctl_cnt = no_out_cnt = asconf = cookie = 0;
5441         /*
5442          * First lets prime the pump. For each destination, if there
5443          * is room in the flight size, attempt to pull an MTU's worth
5444          * out of the stream queues into the general send_queue
5445          */
5446 #ifdef SCTP_AUDITING_ENABLED
5447         sctp_audit_log(0xC2, 2);
5448 #endif
5449 #ifdef SCTP_DEBUG
5450         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5451                 kprintf("***********************\n");
5452         }
5453 #endif
5454         hbflag = 0;
5455         if (control_only)
5456                 no_data_chunks = 1;
5457         else
5458                 no_data_chunks = 0;
5459
5460         /* Nothing to possible to send? */
5461         if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5462             TAILQ_EMPTY(&asoc->send_queue) &&
5463             TAILQ_EMPTY(&asoc->out_wheel)) {
5464 #ifdef SCTP_DEBUG
5465                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5466                         kprintf("All wheels empty\n");
5467                 }
5468 #endif
5469                 return (0);
5470         }
5471         if (asoc->peers_rwnd <= 0) {
5472                 /* No room in peers rwnd */
5473                 *cwnd_full = 1;
5474                 *reason_code = 1;
5475                 if (asoc->total_flight > 0) {
5476                         /* we are allowed one chunk in flight */
5477                         no_data_chunks = 1;
5478                         sctp_pegs[SCTP_RWND_BLOCKED]++;
5479                 }
5480         }
5481 #ifdef SCTP_DEBUG
5482         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5483                 kprintf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5484                        (int)no_data_chunks,
5485                        (int)asoc->total_flight, (int)asoc->peers_rwnd);
5486         }
5487 #endif
5488         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5489 #ifdef SCTP_DEBUG
5490                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5491                         kprintf("net:%p fs:%d  cwnd:%d\n",
5492                                net, net->flight_size, net->cwnd);
5493                 }
5494 #endif
5495                 if (net->flight_size >= net->cwnd) {
5496                         /* skip this network, no room */
5497                         cwnd_full_ind++;
5498 #ifdef SCTP_DEBUG
5499                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5500                                 kprintf("Ok skip fillup->fs:%d > cwnd:%d\n",
5501                                        net->flight_size,
5502                                        net->cwnd);
5503                         }
5504 #endif
5505                         sctp_pegs[SCTP_CWND_NOFILL]++;
5506                         continue;
5507                 }
5508                 /*
5509                  * spin through the stream queues moving one message and
5510                  * assign TSN's as appropriate.
5511                  */
5512                 sctp_fill_outqueue(stcb, net);
5513         }
5514         *cwnd_full = cwnd_full_ind;
5515         /* now service each destination and send out what we can for it */
5516 #ifdef SCTP_DEBUG
5517         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5518                 int chk_cnt = 0;
5519                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5520                         chk_cnt++;
5521                 }
5522                 kprintf("We have %d chunks on the send_queue\n", chk_cnt);
5523                 chk_cnt = 0;
5524                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5525                         chk_cnt++;
5526                 }
5527                 kprintf("We have %d chunks on the sent_queue\n", chk_cnt);
5528                 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5529                         chk_cnt++;
5530                 }
5531                 kprintf("We have %d chunks on the control_queue\n", chk_cnt);
5532         }
5533 #endif
5534         /* If we have data to send, and DSACK is running, stop it
5535          * and build a SACK to dump on to bundle with output. This
5536          * actually MAY make it so the bundling does not occur if
5537          * the SACK is big but I think this is ok because basic SACK
5538          * space is pre-reserved in our fragmentation size choice.
5539          */
5540         if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5541             (no_data_chunks == 0)) {
5542                 /* We will be sending something */
5543                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5544                         /* Yep a callout is pending */
5545                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5546                                         stcb->sctp_ep,
5547                                         stcb, NULL);
5548                         sctp_send_sack(stcb);
5549                 }
5550         }
5551         /* Nothing to send? */
5552         if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5553             (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5554                 return (0);
5555         }
5556         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5557                 /* how much can we send? */
5558                 if (net->ref_count < 2) {
5559                         /* Ref-count of 1 so we cannot have data or control
5560                          * queued to this address. Skip it.
5561                          */
5562                         continue;
5563                 }
5564                 ctl_cnt = bundle_at = 0;
5565                 outchain = NULL;
5566                 no_fragmentflg = 1;
5567                 one_chunk = 0;
5568
5569                 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) {
5570                         /* if we have a route and an ifp
5571                          * check to see if we have room to
5572                          * send to this guy
5573                          */
5574                         struct ifnet *ifp;
5575                         ifp = net->ro.ro_rt->rt_ifp;
5576                         if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
5577                                 sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
5578 #ifdef SCTP_LOG_MAXBURST
5579                                 sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
5580   #endif
5581                                 continue;
5582                         }
5583                 }
5584                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5585                         mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5586                 } else {
5587                         mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5588                 }
5589                 if (mtu > asoc->peers_rwnd) {
5590                         if (asoc->total_flight > 0) {
5591                                 /* We have a packet in flight somewhere */
5592                                 r_mtu = asoc->peers_rwnd;
5593                         } else {
5594                                 /* We are always allowed to send one MTU out */
5595                                 one_chunk = 1;
5596                                 r_mtu = mtu;
5597                         }
5598                 } else {
5599                         r_mtu = mtu;
5600                 }
5601 #ifdef SCTP_DEBUG
5602                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5603                         kprintf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5604                                r_mtu, mtu, net, one_chunk);
5605                 }
5606 #endif
5607                 /************************/
5608                 /* Control transmission */
5609                 /************************/
5610                 /* Now first lets go through the control queue */
5611                 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5612                      chk; chk = nchk) {
5613                         nchk = TAILQ_NEXT(chk, sctp_next);
5614                         if (chk->whoTo != net) {
5615                                 /*
5616                                  * No, not sent to the network we are
5617                                  * looking at
5618                                  */
5619                                 continue;
5620                         }
5621                         if (chk->data == NULL) {
5622                                 continue;
5623                         }
5624                         if ((chk->data->m_flags & M_PKTHDR) == 0) {
5625                                 /*
5626                                  * NOTE: the chk queue MUST have the PKTHDR
5627                                  * flag set on it with a total in the
5628                                  * m_pkthdr.len field!! else the chunk will
5629                                  * ALWAYS be skipped
5630                                  */
5631                                 continue;
5632                         }
5633                         if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5634                                 /*
5635                                  * It must be unsent. Cookies and ASCONF's
5636                                  * hang around but there timers will force
5637                                  * when marked for resend.
5638                                  */
5639                                 continue;
5640                         }
5641                         /* Here we do NOT factor the r_mtu */
5642                         if ((chk->data->m_pkthdr.len < (int)mtu) ||
5643                             (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5644                                 /*
5645                                  * We probably should glom the mbuf chain from
5646                                  * the chk->data for control but the problem
5647                                  * is it becomes yet one more level of
5648                                  * tracking to do if for some reason output
5649                                  * fails. Then I have got to reconstruct the
5650                                  * merged control chain.. el yucko.. for now
5651                                  * we take the easy way and do the copy
5652                                  */
5653                                 outchain = sctp_copy_mbufchain(chk->data,
5654                                                                outchain);
5655                                 if (outchain == NULL) {
5656                                         return (ENOMEM);
5657                                 }
5658                                 /* update our MTU size */
5659                                 mtu -= chk->data->m_pkthdr.len;
5660                                 if (mtu < 0) {
5661                                         mtu = 0;
5662                                 }
5663                                 /* Do clear IP_DF ? */
5664                                 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5665                                         no_fragmentflg = 0;
5666                                 }
5667                                 /* Mark things to be removed, if needed */
5668                                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5669                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5670                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5671                                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5672                                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5673                                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5674                                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5675                                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5676                                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5677                                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5678
5679                                         if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5680                                                 hbflag = 1;
5681                                         /* remove these chunks at the end */
5682                                         if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5683                                                 /* turn off the timer */
5684                                                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5685                                                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5686                                                                         inp, stcb, net);
5687                                                 }
5688                                         }
5689                                         ctl_cnt++;
5690                                 } else {
5691                                         /*
5692                                          * Other chunks, since they have
5693                                          * timers running (i.e. COOKIE or
5694                                          * ASCONF) we just "trust" that it
5695                                          * gets sent or retransmitted.
5696                                          */
5697                                         ctl_cnt++;
5698                                         if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5699                                                 cookie = 1;
5700                                                 no_out_cnt = 1;
5701                                         } else if (chk->rec.chunk_id == SCTP_ASCONF) {
5702                                                 /*
5703                                                  * set hb flag since we can use
5704                                                  * these for RTO
5705                                                  */
5706                                                 hbflag = 1;
5707                                                 asconf = 1;
5708                                         }
5709                                         chk->sent = SCTP_DATAGRAM_SENT;
5710                                         chk->snd_count++;
5711                                 }
5712                                 if (mtu == 0) {
5713                                         /*
5714                                          * Ok we are out of room but we can
5715                                          * output without effecting the flight
5716                                          * size since this little guy is a
5717                                          * control only packet.
5718                                          */
5719                                         if (asconf) {
5720                                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5721                                                 asconf = 0;
5722                                         }
5723                                         if (cookie) {
5724                                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5725                                                 cookie = 0;
5726                                         }
5727                                         if (outchain->m_len == 0) {
5728                                                 /*
5729                                                  * Special case for when you
5730                                                  * get a 0 len mbuf at the
5731                                                  * head due to the lack of a
5732                                                  * MHDR at the beginning.
5733                                                  */
5734                                                 outchain->m_len = sizeof(struct sctphdr);
5735                                         } else {
5736                                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5737                                                 if (outchain == NULL) {
5738                                                         /* no memory */
5739                                                         error = ENOBUFS;
5740                                                         goto error_out_again;
5741                                                 }
5742                                         }
5743                                         shdr = mtod(outchain, struct sctphdr *);
5744                                         shdr->src_port = inp->sctp_lport;
5745                                         shdr->dest_port = stcb->rport;
5746                                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5747                                         shdr->checksum = 0;
5748
5749                                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5750                                                                                 (struct sockaddr *)&net->ro._l_addr,
5751                                                                                 outchain,
5752                                                                                 no_fragmentflg, 0, NULL, asconf))) {
5753                                                 if (error == ENOBUFS) {
5754                                                         asoc->ifp_had_enobuf = 1;
5755                                                 }
5756                                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5757                                                 if (from_where == 0) {
5758                                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5759                                                 }
5760                                         error_out_again:
5761 #ifdef SCTP_DEBUG
5762                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5763                                                         kprintf("Gak got ctrl error %d\n", error);
5764                                                 }
5765 #endif
5766                                                 /* error, could not output */
5767                                                 if (hbflag) {
5768 #ifdef SCTP_DEBUG
5769                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5770                                                                 kprintf("Update HB anyway\n");
5771                                                         }
5772 #endif
5773                                                         if (*now_filled == 0) {
5774                                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5775                                                                 *now_filled = 1;
5776                                                                 *now = net->last_sent_time;
5777                                                         } else {
5778                                                                 net->last_sent_time = *now;
5779                                                         }
5780                                                         hbflag = 0;
5781                                                 }
5782                                                 if (error == EHOSTUNREACH) {
5783                                                         /*
5784                                                          * Destination went
5785                                                          * unreachable during
5786                                                          * this send
5787                                                          */
5788 #ifdef SCTP_DEBUG
5789                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5790                                                                 kprintf("Moving data to an alterante\n");
5791                                                         }
5792 #endif
5793                                                         sctp_move_to_an_alt(stcb, asoc, net);
5794                                                 }
5795                                                 sctp_clean_up_ctl (asoc);
5796                                                 return (error);
5797                                         } else
5798                                                 asoc->ifp_had_enobuf = 0;
5799                                         /* Only HB or ASCONF advances time */
5800                                         if (hbflag) {
5801                                                 if (*now_filled == 0) {
5802                                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5803                                                         *now_filled = 1;
5804                                                         *now = net->last_sent_time;
5805                                                 } else {
5806                                                         net->last_sent_time = *now;
5807                                                 }
5808                                                 hbflag = 0;
5809                                         }
5810                                         /*
5811                                          * increase the number we sent, if a
5812                                          * cookie is sent we don't tell them
5813                                          * any was sent out.
5814                                          */
5815                                         if (!no_out_cnt)
5816                                                 *num_out +=  ctl_cnt;
5817                                         /* recalc a clean slate and setup */
5818                                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5819                                                 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5820                                         } else {
5821                                                 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5822                                         }
5823                                         no_fragmentflg = 1;
5824                                 }
5825                         }
5826                 }
5827                 /*********************/
5828                 /* Data transmission */
5829                 /*********************/
5830                 /* now lets add any data within the MTU constraints */
5831                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5832                         omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5833                 } else {
5834                         omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5835                 }
5836
5837 #ifdef SCTP_DEBUG
5838                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5839                         kprintf("Now to data transmission\n");
5840                 }
5841 #endif
5842
5843                 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5844                     (cookie)) {
5845                         for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5846                                 if (no_data_chunks) {
5847                                         /* let only control go out */
5848 #ifdef SCTP_DEBUG
5849                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5850                                                 kprintf("Either nothing to send or we are full\n");
5851                                         }
5852 #endif
5853                                         break;
5854                                 }
5855                                 if (net->flight_size >= net->cwnd) {
5856                                         /* skip this net, no room for data */
5857 #ifdef SCTP_DEBUG
5858                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5859                                                 kprintf("fs:%d > cwnd:%d\n",
5860                                                        net->flight_size, net->cwnd);
5861                                         }
5862 #endif
5863                                         sctp_pegs[SCTP_CWND_BLOCKED]++;
5864                                         *reason_code = 2;
5865                                         break;
5866                                 }
5867                                 nchk = TAILQ_NEXT(chk, sctp_next);
5868                                 if (chk->whoTo != net) {
5869                                         /* No, not sent to this net */
5870 #ifdef SCTP_DEBUG
5871                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5872                                                 kprintf("chk->whoTo:%p not %p\n",
5873                                                        chk->whoTo, net);
5874
5875                                         }
5876 #endif
5877                                         continue;
5878                                 }
5879 #ifdef SCTP_DEBUG
5880                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5881                                         kprintf("Can we pick up a chunk?\n");
5882                                 }
5883 #endif
5884                                 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5885                                         /* strange, we have a chunk that is to bit
5886                                          * for its destination and yet no fragment ok flag.
5887                                          * Something went wrong when the PMTU changed...we did
5888                                          * not mark this chunk for some reason?? I will
5889                                          * fix it here by letting IP fragment it for now and
5890                                          * printing a warning. This really should not happen ...
5891                                          */
5892 /*#ifdef SCTP_DEBUG*/
5893                                         kprintf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5894                                                chk->send_size, mtu);
5895 /*#endif*/
5896                                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5897                                 }
5898
5899                                 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5900                                     ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5901                                         /* ok we will add this one */
5902 #ifdef SCTP_DEBUG
5903                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5904                                                 kprintf("Picking up the chunk\n");
5905                                         }
5906 #endif
5907                                         outchain = sctp_copy_mbufchain(chk->data, outchain);
5908                                         if (outchain == NULL) {
5909 #ifdef SCTP_DEBUG
5910                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5911                                                         kprintf("Gakk no memory\n");
5912                                                 }
5913 #endif
5914                                                 if (!callout_pending(&net->rxt_timer.timer)) {
5915                                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5916                                                 }
5917                                                 return (ENOMEM);
5918                                         }
5919                                         /* upate our MTU size */
5920                                         /* Do clear IP_DF ? */
5921                                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5922                                                 no_fragmentflg = 0;
5923                                         }
5924                                         mtu -= chk->send_size;
5925                                         r_mtu -= chk->send_size;
5926                                         data_list[bundle_at++] = chk;
5927                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5928                                                 mtu = 0;
5929                                                 break;
5930                                         }
5931                                         if (mtu <= 0) {
5932                                                 mtu = 0;
5933                                                 break;
5934                                         }
5935                                         if ((r_mtu <= 0) || one_chunk) {
5936                                                 r_mtu = 0;
5937                                                 break;
5938                                         }
5939                                 } else {
5940                                         /*
5941                                          * Must be sent in order of the TSN's
5942                                          * (on a network)
5943                                          */
5944 #ifdef SCTP_DEBUG
5945                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5946                                                 kprintf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5947                                                        chk->send_size, mtu, r_mtu);
5948                                         }
5949 #endif
5950
5951                                         break;
5952                                 }
5953                         }/* for () */
5954                 } /* if asoc.state OPEN */
5955                 /* Is there something to send for this destination? */
5956 #ifdef SCTP_DEBUG
5957                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5958                         kprintf("ok now is chain assembled? %p\n",
5959                                outchain);
5960                 }
5961 #endif
5962
5963                 if (outchain) {
5964                         /* We may need to start a control timer or two */
5965                         if (asconf) {
5966                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5967                                 asconf = 0;
5968                         }
5969                         if (cookie) {
5970                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5971                                 cookie = 0;
5972                         }
5973                         /* must start a send timer if data is being sent */
5974                         if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5975                                 /* no timer running on this destination
5976                                  * restart it.
5977                                  */
5978 #ifdef SCTP_DEBUG
5979                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5980                                         kprintf("ok lets start a send timer .. we will transmit %p\n",
5981                                                outchain);
5982                                 }
5983 #endif
5984                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5985                         }
5986                         /* Now send it, if there is anything to send :> */
5987                         if ((outchain->m_flags & M_PKTHDR) == 0) {
5988                                 struct mbuf *t;
5989
5990                                 MGETHDR(t, MB_DONTWAIT, MT_HEADER);
5991                                 if (t == NULL) {
5992                                         sctp_m_freem(outchain);
5993                                         return (ENOMEM);
5994                                 }
5995                                 t->m_next = outchain;
5996                                 t->m_pkthdr.len = 0;
5997                                 t->m_pkthdr.rcvif = 0;
5998                                 t->m_len = 0;
5999
6000                                 outchain = t;
6001                                 while (t) {
6002                                         outchain->m_pkthdr.len += t->m_len;
6003                                         t = t->m_next;
6004                                 }
6005                         }
6006                         if (outchain->m_len == 0) {
6007                                 /* Special case for when you get a 0 len
6008                                  * mbuf at the head due to the lack
6009                                  * of a MHDR at the beginning.
6010                                  */
6011                                 MH_ALIGN(outchain, sizeof(struct sctphdr));
6012                                 outchain->m_len = sizeof(struct sctphdr);
6013                         } else {
6014                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
6015                                 if (outchain == NULL) {
6016                                         /* out of mbufs */
6017                                         error = ENOBUFS;
6018                                         goto errored_send;
6019                                 }
6020                         }
6021                         shdr = mtod(outchain, struct sctphdr *);
6022                         shdr->src_port = inp->sctp_lport;
6023                         shdr->dest_port = stcb->rport;
6024                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6025                         shdr->checksum = 0;
6026                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6027                                                                 (struct sockaddr *)&net->ro._l_addr,
6028                                                                 outchain,
6029                                                                 no_fragmentflg, bundle_at, data_list[0], asconf))) {
6030                                 /* error, we could not output */
6031                                 if (error == ENOBUFS) {
6032                                         asoc->ifp_had_enobuf = 1;
6033                                 }
6034                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6035                                 if (from_where == 0) {
6036                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
6037                                 }
6038
6039                         errored_send:
6040 #ifdef SCTP_DEBUG
6041                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6042                                         kprintf("Gak send error %d\n", error);
6043                                 }
6044 #endif
6045                                 if (hbflag) {
6046 #ifdef SCTP_DEBUG
6047                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6048                                                 kprintf("Update HB time anyway\n");
6049                                         }
6050 #endif
6051                                         if (*now_filled == 0) {
6052                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6053                                                 *now_filled = 1;
6054                                                 *now = net->last_sent_time;
6055                                         } else {
6056                                                 net->last_sent_time = *now;
6057                                         }
6058                                         hbflag = 0;
6059                                 }
6060                                 if (error == EHOSTUNREACH) {
6061                                         /*
6062                                          * Destination went unreachable during
6063                                          * this send
6064                                          */
6065 #ifdef SCTP_DEBUG
6066                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6067                                                 kprintf("Calling the movement routine\n");
6068                                         }
6069 #endif
6070                                         sctp_move_to_an_alt(stcb, asoc, net);
6071                                 }
6072                                 sctp_clean_up_ctl (asoc);
6073                                 return (error);
6074                         } else {
6075                                 asoc->ifp_had_enobuf = 0;
6076                         }
6077                         if (bundle_at || hbflag) {
6078                                 /* For data/asconf and hb set time */
6079                                 if (*now_filled == 0) {
6080                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6081                                         *now_filled = 1;
6082                                         *now = net->last_sent_time;
6083                                 } else {
6084                                         net->last_sent_time = *now;
6085                                 }
6086                         }
6087
6088                         if (!no_out_cnt) {
6089                                 *num_out += (ctl_cnt + bundle_at);
6090                         }
6091                         if (bundle_at) {
6092                                 if (!net->rto_pending) {
6093                                         /* setup for a RTO measurement */
6094                                         net->rto_pending = 1;
6095                                         data_list[0]->do_rtt = 1;
6096                                 } else {
6097                                         data_list[0]->do_rtt = 0;
6098                                 }
6099                                 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
6100                                 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
6101                         }
6102                         if (one_chunk) {
6103                                 break;
6104                         }
6105                 }
6106         }
6107         /* At the end there should be no NON timed
6108          * chunks hanging on this queue.
6109          */
6110         if ((*num_out == 0) && (*reason_code == 0)) {
6111                 *reason_code = 3;
6112         }
6113         sctp_clean_up_ctl (asoc);
6114         return (0);
6115 }
6116
6117 void
6118 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
6119 {
6120         /* Prepend a OPERATIONAL_ERROR chunk header
6121          * and put on the end of the control chunk queue.
6122          */
6123         /* Sender had better have gotten a MGETHDR or else
6124          * the control chunk will be forever skipped
6125          */
6126         struct sctp_chunkhdr *hdr;
6127         struct sctp_tmit_chunk *chk;
6128         struct mbuf *mat;
6129
6130         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6131         if (chk == NULL) {
6132                 /* no memory */
6133                 sctp_m_freem(op_err);
6134                 return;
6135         }
6136         sctppcbinfo.ipi_count_chunk++;
6137         sctppcbinfo.ipi_gencnt_chunk++;
6138         M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), MB_DONTWAIT);
6139         if (op_err == NULL) {
6140                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6141                 sctppcbinfo.ipi_count_chunk--;
6142                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6143                         panic("Chunk count is negative");
6144                 }
6145                 sctppcbinfo.ipi_gencnt_chunk++;
6146                 return;
6147         }
6148         chk->send_size = 0;
6149         mat = op_err;
6150         while (mat != NULL) {
6151                 chk->send_size += mat->m_len;
6152                 mat = mat->m_next;
6153         }
6154         chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6155         chk->sent = SCTP_DATAGRAM_UNSENT;
6156         chk->snd_count = 0;
6157         chk->flags = 0;
6158         chk->asoc = &stcb->asoc;
6159         chk->data = op_err;
6160         chk->whoTo = chk->asoc->primary_destination;
6161         chk->whoTo->ref_count++;
6162         hdr = mtod(op_err, struct sctp_chunkhdr *);
6163         hdr->chunk_type = SCTP_OPERATION_ERROR;
6164         hdr->chunk_flags = 0;
6165         hdr->chunk_length = htons(chk->send_size);
6166         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6167                           chk,
6168                           sctp_next);
6169         chk->asoc->ctrl_queue_cnt++;
6170 }
6171
6172 int
6173 sctp_send_cookie_echo(struct mbuf *m,
6174                       int offset,
6175                       struct sctp_tcb *stcb,
6176                       struct sctp_nets *net)
6177 {
6178         /*
6179          * pull out the cookie and put it at the front of the control
6180          * chunk queue.
6181          */
6182         int at;
6183         struct mbuf *cookie, *mat;
6184         struct sctp_paramhdr parm, *phdr;
6185         struct sctp_chunkhdr *hdr;
6186         struct sctp_tmit_chunk *chk;
6187         uint16_t ptype, plen;
6188         /* First find the cookie in the param area */
6189         cookie = NULL;
6190         at = offset + sizeof(struct sctp_init_chunk);
6191
6192         do {
6193                 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6194                 if (phdr == NULL) {
6195                         return (-3);
6196                 }
6197                 ptype = ntohs(phdr->param_type);
6198                 plen = ntohs(phdr->param_length);
6199                 if (ptype == SCTP_STATE_COOKIE) {
6200                         int pad;
6201                         /* found the cookie */
6202                         if ((pad = (plen % 4))) {
6203                                 plen += 4 - pad;
6204                         }
6205                         cookie = sctp_m_copym(m, at, plen, MB_DONTWAIT);
6206                         if (cookie == NULL) {
6207                                 /* No memory */
6208                                 return (-2);
6209                         }
6210                         break;
6211                 }
6212                 at += SCTP_SIZE32(plen);
6213         } while (phdr);
6214         if (cookie == NULL) {
6215                 /* Did not find the cookie */
6216                 return (-3);
6217         }
6218         /* ok, we got the cookie lets change it into a cookie echo chunk */
6219
6220         /* first the change from param to cookie */
6221         hdr = mtod(cookie, struct sctp_chunkhdr *);
6222         hdr->chunk_type = SCTP_COOKIE_ECHO;
6223         hdr->chunk_flags = 0;
6224         /* now we MUST have a PKTHDR on it */
6225         if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6226                 /* we hope this happens rarely */
6227                 MGETHDR(mat, MB_DONTWAIT, MT_HEADER);
6228                 if (mat == NULL) {
6229                         sctp_m_freem(cookie);
6230                         return (-4);
6231                 }
6232                 mat->m_len = 0;
6233                 mat->m_pkthdr.rcvif = 0;
6234                 mat->m_next = cookie;
6235                 cookie = mat;
6236         }
6237         cookie->m_pkthdr.len = plen;
6238         /* get the chunk stuff now and place it in the FRONT of the queue */
6239         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6240         if (chk == NULL) {
6241                 /* no memory */
6242                 sctp_m_freem(cookie);
6243                 return (-5);
6244         }
6245         sctppcbinfo.ipi_count_chunk++;
6246         sctppcbinfo.ipi_gencnt_chunk++;
6247         chk->send_size = cookie->m_pkthdr.len;
6248         chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6249         chk->sent = SCTP_DATAGRAM_UNSENT;
6250         chk->snd_count = 0;
6251         chk->flags = 0;
6252         chk->asoc = &stcb->asoc;
6253         chk->data = cookie;
6254         chk->whoTo = chk->asoc->primary_destination;
6255         chk->whoTo->ref_count++;
6256         TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6257         chk->asoc->ctrl_queue_cnt++;
6258         return (0);
6259 }
6260
6261 void
6262 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6263                         struct mbuf *m,
6264                         int offset,
6265                         int chk_length,
6266                         struct sctp_nets *net)
6267 {
6268         /* take a HB request and make it into a
6269          * HB ack and send it.
6270          */
6271         struct mbuf *outchain;
6272         struct sctp_chunkhdr *chdr;
6273         struct sctp_tmit_chunk *chk;
6274
6275
6276         if (net == NULL)
6277                 /* must have a net pointer */
6278                 return;
6279
6280         outchain = sctp_m_copym(m, offset, chk_length, MB_DONTWAIT);
6281         if (outchain == NULL) {
6282                 /* gak out of memory */
6283                 return;
6284         }
6285         chdr = mtod(outchain, struct sctp_chunkhdr *);
6286         chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6287         chdr->chunk_flags = 0;
6288         if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6289                 /* should not happen but we are cautious. */
6290                 struct mbuf *tmp;
6291                 MGETHDR(tmp, MB_DONTWAIT, MT_HEADER);
6292                 if (tmp == NULL) {
6293                         return;
6294                 }
6295                 tmp->m_len = 0;
6296                 tmp->m_pkthdr.rcvif = 0;
6297                 tmp->m_next = outchain;
6298                 outchain = tmp;
6299         }
6300         outchain->m_pkthdr.len = chk_length;
6301         if (chk_length % 4) {
6302                 /* need pad */
6303                 u_int32_t cpthis=0;
6304                 int padlen;
6305                 padlen = 4 - (outchain->m_pkthdr.len % 4);
6306                 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (caddr_t)&cpthis);
6307         }
6308         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6309         if (chk == NULL) {
6310                 /* no memory */
6311                 sctp_m_freem(outchain);
6312                 return ;
6313         }
6314         sctppcbinfo.ipi_count_chunk++;
6315         sctppcbinfo.ipi_gencnt_chunk++;
6316
6317         chk->send_size = chk_length;
6318         chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6319         chk->sent = SCTP_DATAGRAM_UNSENT;
6320         chk->snd_count = 0;
6321         chk->flags = 0;
6322         chk->asoc = &stcb->asoc;
6323         chk->data = outchain;
6324         chk->whoTo = net;
6325         chk->whoTo->ref_count++;
6326         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6327         chk->asoc->ctrl_queue_cnt++;
6328 }
6329
6330 int
6331 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6332         /* formulate and queue a cookie-ack back to sender */
6333         struct mbuf *cookie_ack;
6334         struct sctp_chunkhdr *hdr;
6335         struct sctp_tmit_chunk *chk;
6336
6337         cookie_ack = NULL;
6338         MGETHDR(cookie_ack, MB_DONTWAIT, MT_HEADER);
6339         if (cookie_ack == NULL) {
6340                 /* no mbuf's */
6341                 return (-1);
6342         }
6343         cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6344         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6345         if (chk == NULL) {
6346                 /* no memory */
6347                 sctp_m_freem(cookie_ack);
6348                 return (-1);
6349         }
6350         sctppcbinfo.ipi_count_chunk++;
6351         sctppcbinfo.ipi_gencnt_chunk++;
6352
6353         chk->send_size = sizeof(struct sctp_chunkhdr);
6354         chk->rec.chunk_id = SCTP_COOKIE_ACK;
6355         chk->sent = SCTP_DATAGRAM_UNSENT;
6356         chk->snd_count = 0;
6357         chk->flags = 0;
6358         chk->asoc = &stcb->asoc;
6359         chk->data = cookie_ack;
6360         if (chk->asoc->last_control_chunk_from != NULL) {
6361                 chk->whoTo = chk->asoc->last_control_chunk_from;
6362         } else {
6363                 chk->whoTo = chk->asoc->primary_destination;
6364         }
6365         chk->whoTo->ref_count++;
6366         hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6367         hdr->chunk_type = SCTP_COOKIE_ACK;
6368         hdr->chunk_flags = 0;
6369         hdr->chunk_length = htons(chk->send_size);
6370         cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6371         cookie_ack->m_pkthdr.rcvif = 0;
6372         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6373         chk->asoc->ctrl_queue_cnt++;
6374         return (0);
6375 }
6376
6377
6378 int
6379 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6380 {
6381         /* formulate and queue a SHUTDOWN-ACK back to the sender */
6382         struct mbuf *m_shutdown_ack;
6383         struct sctp_shutdown_ack_chunk *ack_cp;
6384         struct sctp_tmit_chunk *chk;
6385
6386         m_shutdown_ack = NULL;
6387         MGETHDR(m_shutdown_ack, MB_DONTWAIT, MT_HEADER);
6388         if (m_shutdown_ack == NULL) {
6389                 /* no mbuf's */
6390                 return (-1);
6391         }
6392         m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6393         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6394         if (chk == NULL) {
6395                 /* no memory */
6396                 sctp_m_freem(m_shutdown_ack);
6397                 return (-1);
6398         }
6399         sctppcbinfo.ipi_count_chunk++;
6400         sctppcbinfo.ipi_gencnt_chunk++;
6401
6402         chk->send_size = sizeof(struct sctp_chunkhdr);
6403         chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6404         chk->sent = SCTP_DATAGRAM_UNSENT;
6405         chk->snd_count = 0;
6406         chk->flags = 0;
6407         chk->asoc = &stcb->asoc;
6408         chk->data = m_shutdown_ack;
6409         chk->whoTo = net;
6410         net->ref_count++;
6411
6412         ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6413         ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6414         ack_cp->ch.chunk_flags = 0;
6415         ack_cp->ch.chunk_length = htons(chk->send_size);
6416         m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6417         m_shutdown_ack->m_pkthdr.rcvif = 0;
6418         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6419         chk->asoc->ctrl_queue_cnt++;
6420         return (0);
6421 }
6422
6423 int
6424 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6425 {
6426         /* formulate and queue a SHUTDOWN to the sender */
6427         struct mbuf *m_shutdown;
6428         struct sctp_shutdown_chunk *shutdown_cp;
6429         struct sctp_tmit_chunk *chk;
6430
6431         m_shutdown = NULL;
6432         MGETHDR(m_shutdown, MB_DONTWAIT, MT_HEADER);
6433         if (m_shutdown == NULL) {
6434                 /* no mbuf's */
6435                 return (-1);
6436         }
6437         m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6438         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6439         if (chk == NULL) {
6440                 /* no memory */
6441                 sctp_m_freem(m_shutdown);
6442                 return (-1);
6443         }
6444         sctppcbinfo.ipi_count_chunk++;
6445         sctppcbinfo.ipi_gencnt_chunk++;
6446
6447         chk->send_size = sizeof(struct sctp_shutdown_chunk);
6448         chk->rec.chunk_id = SCTP_SHUTDOWN;
6449         chk->sent = SCTP_DATAGRAM_UNSENT;
6450         chk->snd_count = 0;
6451         chk->flags = 0;
6452         chk->asoc = &stcb->asoc;
6453         chk->data = m_shutdown;
6454         chk->whoTo = net;
6455         net->ref_count++;
6456
6457         shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6458         shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6459         shutdown_cp->ch.chunk_flags = 0;
6460         shutdown_cp->ch.chunk_length = htons(chk->send_size);
6461         shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6462         m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6463         m_shutdown->m_pkthdr.rcvif = 0;
6464         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6465         chk->asoc->ctrl_queue_cnt++;
6466
6467         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6468             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6469                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
6470                 soisdisconnecting(stcb->sctp_ep->sctp_socket);
6471         }
6472         return (0);
6473 }
6474
6475 int
6476 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6477 {
6478         /*
6479          * formulate and queue an ASCONF to the peer
6480          * ASCONF parameters should be queued on the assoc queue
6481          */
6482         struct sctp_tmit_chunk *chk;
6483         struct mbuf *m_asconf;
6484         struct sctp_asconf_chunk *acp;
6485
6486
6487         /* compose an ASCONF chunk, maximum length is PMTU */
6488         m_asconf = sctp_compose_asconf(stcb);
6489         if (m_asconf == NULL) {
6490                 return (-1);
6491         }
6492         acp = mtod(m_asconf, struct sctp_asconf_chunk *);
6493         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6494         if (chk == NULL) {
6495                 /* no memory */
6496                 sctp_m_freem(m_asconf);
6497                 return (-1);
6498         }
6499         sctppcbinfo.ipi_count_chunk++;
6500         sctppcbinfo.ipi_gencnt_chunk++;
6501
6502         chk->data = m_asconf;
6503         chk->send_size = m_asconf->m_pkthdr.len;
6504         chk->rec.chunk_id = SCTP_ASCONF;
6505         chk->sent = SCTP_DATAGRAM_UNSENT;
6506         chk->snd_count = 0;
6507         chk->flags = 0;
6508         chk->asoc = &stcb->asoc;
6509         chk->whoTo = chk->asoc->primary_destination;
6510         chk->whoTo->ref_count++;
6511         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6512         chk->asoc->ctrl_queue_cnt++;
6513         return (0);
6514 }
6515
6516 int
6517 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6518 {
6519         /*
6520          * formulate and queue a asconf-ack back to sender
6521          * the asconf-ack must be stored in the tcb
6522          */
6523         struct sctp_tmit_chunk *chk;
6524         struct mbuf *m_ack;
6525
6526         /* is there a asconf-ack mbuf chain to send? */
6527         if (stcb->asoc.last_asconf_ack_sent == NULL) {
6528                 return (-1);
6529         }
6530
6531         /* copy the asconf_ack */
6532 #if defined(__FreeBSD__) || defined(__NetBSD__)
6533         /* Supposedly the m_copypacket is a optimzation,
6534          * use it if we can.
6535          */
6536         if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6537                 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, MB_DONTWAIT);
6538                 sctp_pegs[SCTP_CACHED_SRC]++;
6539         } else
6540                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6541 #else
6542                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6543 #endif
6544         if (m_ack == NULL) {
6545                 /* couldn't copy it */
6546
6547                 return (-1);
6548         }
6549         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6550         if (chk == NULL) {
6551                 /* no memory */
6552                 if (m_ack)
6553                         sctp_m_freem(m_ack);
6554                 return (-1);
6555         }
6556         sctppcbinfo.ipi_count_chunk++;
6557         sctppcbinfo.ipi_gencnt_chunk++;
6558
6559         /* figure out where it goes to */
6560         if (retrans) {
6561                 /* we're doing a retransmission */
6562                 if (stcb->asoc.used_alt_asconfack > 2) {
6563                         /* tried alternate nets already, go back */
6564                         chk->whoTo = NULL;
6565                 } else {
6566                         /* need to try and alternate net */
6567                         chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6568                         stcb->asoc.used_alt_asconfack++;
6569                 }
6570                 if (chk->whoTo == NULL) {
6571                         /* no alternate */
6572                         if (stcb->asoc.last_control_chunk_from == NULL)
6573                                 chk->whoTo = stcb->asoc.primary_destination;
6574                         else
6575                                 chk->whoTo = stcb->asoc.last_control_chunk_from;
6576                         stcb->asoc.used_alt_asconfack = 0;
6577                 }
6578         } else {
6579                 /* normal case */
6580                 if (stcb->asoc.last_control_chunk_from == NULL)
6581                         chk->whoTo = stcb->asoc.primary_destination;
6582                 else
6583                         chk->whoTo = stcb->asoc.last_control_chunk_from;
6584                 stcb->asoc.used_alt_asconfack = 0;
6585         }
6586         chk->data = m_ack;
6587         chk->send_size = m_ack->m_pkthdr.len;
6588         chk->rec.chunk_id = SCTP_ASCONF_ACK;
6589         chk->sent = SCTP_DATAGRAM_UNSENT;
6590         chk->snd_count = 0;
6591         chk->flags = 0;
6592         chk->asoc = &stcb->asoc;
6593         chk->whoTo->ref_count++;
6594         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6595         chk->asoc->ctrl_queue_cnt++;
6596         return (0);
6597 }
6598
6599
6600 static int
6601 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6602                           struct sctp_tcb *stcb,
6603                           struct sctp_association *asoc,
6604                           int *cnt_out, struct timeval *now, int *now_filled)
6605 {
6606         /*
6607          * send out one MTU of retransmission.
6608          * If fast_retransmit is happening we ignore the cwnd.
6609          * Otherwise we obey the cwnd and rwnd.
6610          * For a Cookie or Asconf in the control chunk queue we retransmit
6611          * them by themselves.
6612          *
6613          * For data chunks we will pick out the lowest TSN's in the
6614          * sent_queue marked for resend and bundle them all together
6615          * (up to a MTU of destination). The address to send to should
6616          * have been selected/changed where the retransmission was
6617          * marked (i.e. in FR or t3-timeout routines).
6618          */
6619         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6620         struct sctp_tmit_chunk *chk, *fwd;
6621         struct mbuf *m;
6622         struct sctphdr *shdr;
6623         int asconf;
6624         struct sctp_nets *net;
6625         int no_fragmentflg, bundle_at, cnt_thru;
6626         unsigned int mtu;
6627         int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6628
6629         tmr_started = ctl_cnt = bundle_at =  error = 0;
6630         no_fragmentflg = 1;
6631         asconf = 0;
6632         fwd_tsn = 0;
6633         *cnt_out = 0;
6634         fwd = NULL;
6635         m = NULL;
6636 #ifdef SCTP_AUDITING_ENABLED
6637         sctp_audit_log(0xC3, 1);
6638 #endif
6639         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6640 #ifdef SCTP_DEBUG
6641                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6642                         kprintf("SCTP hits empty queue with cnt set to %d?\n",
6643                                asoc->sent_queue_retran_cnt);
6644                 }
6645 #endif
6646                 asoc->sent_queue_cnt = 0;
6647                 asoc->sent_queue_cnt_removeable = 0;
6648         }
6649         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6650                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6651                         /* we only worry about things marked for resend */
6652                         continue;
6653                 }
6654                 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6655                     (chk->rec.chunk_id == SCTP_ASCONF) ||
6656                     (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6657                     (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6658                         if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6659                                 /* For stream reset we only retran the request
6660                                  * not the response.
6661                                  */
6662                                 struct sctp_stream_reset_req *strreq;
6663                                 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6664                                 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6665                                         continue;
6666                                 }
6667                         }
6668                         ctl_cnt++;
6669                         if (chk->rec.chunk_id == SCTP_ASCONF) {
6670                                 no_fragmentflg = 1;
6671                                 asconf = 1;
6672                         }
6673                         if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6674                                 fwd_tsn = 1;
6675                                 fwd = chk;
6676                         }
6677                         m = sctp_copy_mbufchain(chk->data, m);
6678                         break;
6679                 }
6680         }
6681         one_chunk = 0;
6682         cnt_thru = 0;
6683         /* do we have control chunks to retransmit? */
6684         if (m != NULL) {
6685                 /* Start a timer no matter if we suceed or fail */
6686                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6687                         sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6688                 } else if (chk->rec.chunk_id == SCTP_ASCONF)
6689                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6690
6691                 if (m->m_len == 0) {
6692                         /* Special case for when you get a 0 len
6693                          * mbuf at the head due to the lack
6694                          * of a MHDR at the beginning.
6695                          */
6696                         m->m_len = sizeof(struct sctphdr);
6697                 } else {
6698                         M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6699                         if (m == NULL) {
6700                                 return (ENOBUFS);
6701                         }
6702                 }
6703                 shdr = mtod(m, struct sctphdr *);
6704                 shdr->src_port = inp->sctp_lport;
6705                 shdr->dest_port = stcb->rport;
6706                 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6707                 shdr->checksum = 0;
6708                 chk->snd_count++;               /* update our count */
6709
6710                 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6711                     (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
6712                     no_fragmentflg, 0, NULL, asconf))) {
6713                         sctp_pegs[SCTP_DATA_OUT_ERR]++;
6714                         return (error);
6715                 }
6716                 /*
6717                  *We don't want to mark the net->sent time here since this
6718                  * we use this for HB and retrans cannot measure RTT
6719                  */
6720                 /*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6721                 *cnt_out += 1;
6722                 chk->sent = SCTP_DATAGRAM_SENT;
6723                 asoc->sent_queue_retran_cnt--;
6724                 if (asoc->sent_queue_retran_cnt < 0) {
6725                     asoc->sent_queue_retran_cnt = 0;
6726                 }
6727                 if (fwd_tsn == 0) {
6728                         return (0);
6729                 } else {
6730                         /* Clean up the fwd-tsn list */
6731                         sctp_clean_up_ctl (asoc);
6732                         return (0);
6733                 }
6734         }
6735         /* Ok, it is just data retransmission we need to do or
6736          * that and a fwd-tsn with it all.
6737          */
6738         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6739                 return (-1);
6740         }
6741 #ifdef SCTP_DEBUG
6742         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6743                 kprintf("Normal chunk retransmission cnt:%d\n",
6744                        asoc->sent_queue_retran_cnt);
6745         }
6746 #endif
6747         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6748             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6749                 /* not yet open, resend the cookie and that is it */
6750                 return (1);
6751         }
6752
6753
6754 #ifdef SCTP_AUDITING_ENABLED
6755         sctp_auditing(20, inp, stcb, NULL);
6756 #endif
6757         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6758                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6759                         /* No, not sent to this net or not ready for rtx */
6760                         continue;
6761
6762                 }
6763                 /* pick up the net */
6764                 net = chk->whoTo;
6765                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6766                         mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6767                 } else {
6768                         mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6769                 }
6770
6771                 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6772                         /* No room in peers rwnd */
6773                         uint32_t tsn;
6774                         tsn = asoc->last_acked_seq + 1;
6775                         if (tsn == chk->rec.data.TSN_seq) {
6776                                 /* we make a special exception for this case.
6777                                  * The peer has no rwnd but is missing the
6778                                  * lowest chunk.. which is probably what is
6779                                  * holding up the rwnd.
6780                                  */
6781                                 goto one_chunk_around;
6782                         }
6783 #ifdef SCTP_DEBUG
6784                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6785                                 kprintf("blocked-peers_rwnd:%d tf:%d\n",
6786                                        (int)asoc->peers_rwnd,
6787                                        (int)asoc->total_flight);
6788                         }
6789 #endif
6790                         sctp_pegs[SCTP_RWND_BLOCKED]++;
6791                         return (1);
6792                 }
6793         one_chunk_around:
6794                 if (asoc->peers_rwnd < mtu) {
6795                         one_chunk = 1;
6796                 }
6797 #ifdef SCTP_AUDITING_ENABLED
6798                 sctp_audit_log(0xC3, 2);
6799 #endif
6800                 bundle_at = 0;
6801                 m = NULL;
6802                 net->fast_retran_ip = 0;
6803                 if (chk->rec.data.doing_fast_retransmit == 0) {
6804                         /* if no FR in progress skip destination that
6805                          * have flight_size > cwnd.
6806                          */
6807                         if (net->flight_size >= net->cwnd) {
6808                                 sctp_pegs[SCTP_CWND_BLOCKED]++;
6809                                 continue;
6810                         }
6811                 } else {
6812                         /* Mark the destination net to have FR recovery
6813                          * limits put on it.
6814                          */
6815                         net->fast_retran_ip = 1;
6816                 }
6817
6818                 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6819                         /* ok we will add this one */
6820                         m = sctp_copy_mbufchain(chk->data, m);
6821                         if (m == NULL) {
6822                                 return (ENOMEM);
6823                         }
6824                         /* upate our MTU size */
6825                         /* Do clear IP_DF ? */
6826                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6827                                 no_fragmentflg = 0;
6828                         }
6829                         mtu -= chk->send_size;
6830                         data_list[bundle_at++] = chk;
6831                         if (one_chunk && (asoc->total_flight <= 0)) {
6832                                 sctp_pegs[SCTP_WINDOW_PROBES]++;
6833                                 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6834                         }
6835                 }
6836                 if (one_chunk == 0) {
6837                         /* now are there anymore forward from chk to pick up?*/
6838                         fwd = TAILQ_NEXT(chk, sctp_next);
6839                         while (fwd) {
6840                                 if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6841                                         /* Nope, not for retran */
6842                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6843                                         continue;
6844                                 }
6845                                 if (fwd->whoTo != net) {
6846                                         /* Nope, not the net in question */
6847                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6848                                         continue;
6849                                 }
6850                                 if (fwd->send_size <= mtu) {
6851                                         m = sctp_copy_mbufchain(fwd->data, m);
6852                                         if (m == NULL) {
6853                                                 return (ENOMEM);
6854                                         }
6855                                         /* upate our MTU size */
6856                                         /* Do clear IP_DF ? */
6857                                         if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6858                                                 no_fragmentflg = 0;
6859                                         }
6860                                         mtu -= fwd->send_size;
6861                                         data_list[bundle_at++] = fwd;
6862                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6863                                                 break;
6864                                         }
6865                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6866                                 } else {
6867                                         /* can't fit so we are done */
6868                                         break;
6869                                 }
6870                         }
6871                 }
6872                 /* Is there something to send for this destination? */
6873                 if (m) {
6874                         /* No matter if we fail/or suceed we should
6875                          * start a timer. A failure is like a lost
6876                          * IP packet :-)
6877                          */
6878                         if (!callout_pending(&net->rxt_timer.timer)) {
6879                                 /* no timer running on this destination
6880                                  * restart it.
6881                                  */
6882                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6883                                 tmr_started = 1;
6884                         }
6885                         if (m->m_len == 0) {
6886                                 /* Special case for when you get a 0 len
6887                                  * mbuf at the head due to the lack
6888                                  * of a MHDR at the beginning.
6889                                  */
6890                                 m->m_len = sizeof(struct sctphdr);
6891                         } else {
6892                                 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6893                                 if (m == NULL) {
6894                                         return (ENOBUFS);
6895                                 }
6896                         }
6897                         shdr = mtod(m, struct sctphdr *);
6898                         shdr->src_port = inp->sctp_lport;
6899                         shdr->dest_port = stcb->rport;
6900                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6901                         shdr->checksum = 0;
6902
6903                         /* Now lets send it, if there is anything to send :> */
6904                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6905                                                                (struct sockaddr *)&net->ro._l_addr,
6906                                                                m,
6907                                                                no_fragmentflg, 0, NULL, asconf))) {
6908                                 /* error, we could not output */
6909                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6910                                 return (error);
6911                         }
6912                         /* For HB's */
6913                         /*
6914                          * We don't want to mark the net->sent time here since
6915                          * this we use this for HB and retrans cannot measure
6916                          * RTT
6917                          */
6918                         /*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6919
6920                         /* For auto-close */
6921                         cnt_thru++;
6922                         if (*now_filled == 0) {
6923                                 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6924                                 *now = asoc->time_last_sent;
6925                                 *now_filled = 1;
6926                         } else {
6927                                 asoc->time_last_sent = *now;
6928                         }
6929                         *cnt_out += bundle_at;
6930 #ifdef SCTP_AUDITING_ENABLED
6931                         sctp_audit_log(0xC4, bundle_at);
6932 #endif
6933                         for (i = 0; i < bundle_at; i++) {
6934                                 sctp_pegs[SCTP_RETRANTSN_SENT]++;
6935                                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
6936                                 data_list[i]->snd_count++;
6937                                 asoc->sent_queue_retran_cnt--;
6938                                 /* record the time */
6939                                 data_list[i]->sent_rcv_time = asoc->time_last_sent;
6940                                 if (asoc->sent_queue_retran_cnt < 0) {
6941                                     asoc->sent_queue_retran_cnt = 0;
6942                                 }
6943                                 net->flight_size += data_list[i]->book_size;
6944                                 asoc->total_flight += data_list[i]->book_size;
6945                                 asoc->total_flight_count++;
6946
6947 #ifdef SCTP_LOG_RWND
6948                                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6949                                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6950 #endif
6951                                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6952                                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6953                                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6954                                         /* SWS sender side engages */
6955                                         asoc->peers_rwnd = 0;
6956                                 }
6957
6958                                 if ((i == 0) &&
6959                                     (data_list[i]->rec.data.doing_fast_retransmit)) {
6960                                         sctp_pegs[SCTP_FAST_RETRAN]++;
6961                                         if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6962                                             (tmr_started == 0)) {
6963                                                 /*
6964                                                  * ok we just fast-retrans'd
6965                                                  * the lowest TSN, i.e the
6966                                                  * first on the list. In this
6967                                                  * case we want to give some
6968                                                  * more time to get a SACK
6969                                                  * back without a t3-expiring.
6970                                                  */
6971                                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6972                                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6973                                         }
6974                                 }
6975                         }
6976 #ifdef SCTP_AUDITING_ENABLED
6977                         sctp_auditing(21, inp, stcb, NULL);
6978 #endif
6979                 } else {
6980                         /* None will fit */
6981                         return (1);
6982                 }
6983                 if (asoc->sent_queue_retran_cnt <= 0) {
6984                         /* all done we have no more to retran */
6985                         asoc->sent_queue_retran_cnt = 0;
6986                         break;
6987                 }
6988                 if (one_chunk) {
6989                         /* No more room in rwnd */
6990                         return (1);
6991                 }
6992                 /* stop the for loop here. we sent out a packet */
6993                 break;
6994         }
6995         return (0);
6996 }
6997
6998
6999 static int
7000 sctp_timer_validation(struct sctp_inpcb *inp,
7001                       struct sctp_tcb *stcb,
7002                       struct sctp_association *asoc,
7003                       int ret)
7004 {
7005         struct sctp_nets *net;
7006         /* Validate that a timer is running somewhere */
7007         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7008                 if (callout_pending(&net->rxt_timer.timer)) {
7009                         /* Here is a timer */
7010                         return (ret);
7011                 }
7012         }
7013         /* Gak, we did not have a timer somewhere */
7014 #ifdef SCTP_DEBUG
7015         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7016                 kprintf("Deadlock avoided starting timer on a dest at retran\n");
7017         }
7018 #endif
7019         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
7020         return (ret);
7021 }
7022
7023 int
7024 sctp_chunk_output(struct sctp_inpcb *inp,
7025                   struct sctp_tcb *stcb,
7026                   int from_where)
7027 {
7028         /* Ok this is the generic chunk service queue.
7029          * we must do the following:
7030          *  - See if there are retransmits pending, if so we
7031          *      must do these first and return.
7032          *  - Service the stream queue that is next,
7033          *    moving any message (note I must get a complete
7034          *    message i.e. FIRST/MIDDLE and LAST to the out
7035          *    queue in one pass) and assigning TSN's
7036          *  - Check to see if the cwnd/rwnd allows any output, if
7037          *      so we go ahead and fomulate and send the low level
7038          *    chunks. Making sure to combine any control in the
7039          *    control chunk queue also.
7040          */
7041         struct sctp_association *asoc;
7042         struct sctp_nets *net;
7043         int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
7044         struct timeval now;
7045         int now_filled=0;
7046         int cwnd_full=0;
7047         asoc = &stcb->asoc;
7048         tot_out = 0;
7049         num_out = 0;
7050         reason_code = 0;
7051         sctp_pegs[SCTP_CALLS_TO_CO]++;
7052 #ifdef SCTP_DEBUG
7053         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7054                 kprintf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
7055         }
7056 #endif
7057         while (asoc->sent_queue_retran_cnt) {
7058                 /* Ok, it is retransmission time only, we send out only ONE
7059                  * packet with a single call off to the retran code.
7060                  */
7061                 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
7062                 if (ret > 0) {
7063                         /* Can't send anymore */
7064 #ifdef SCTP_DEBUG
7065                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7066                                 kprintf("retransmission ret:%d -- full\n", ret);
7067                         }
7068 #endif
7069                         /*
7070                          * now lets push out control by calling med-level
7071                          * output once. this assures that we WILL send HB's
7072                          * if queued too.
7073                          */
7074                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
7075                                               &cwnd_full, from_where,
7076                                               &now, &now_filled);
7077 #ifdef SCTP_DEBUG
7078                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7079                                 kprintf("Control send outputs:%d@full\n", num_out);
7080                         }
7081 #endif
7082 #ifdef SCTP_AUDITING_ENABLED
7083                         sctp_auditing(8, inp, stcb, NULL);
7084 #endif
7085                         return (sctp_timer_validation(inp, stcb, asoc, ret));
7086                 }
7087                 if (ret < 0) {
7088                         /*
7089                          * The count was off.. retran is not happening so do
7090                          * the normal retransmission.
7091                          */
7092 #ifdef SCTP_DEBUG
7093                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7094                                 kprintf("Done with retrans, none left fill up window\n");
7095                         }
7096 #endif
7097 #ifdef SCTP_AUDITING_ENABLED
7098                         sctp_auditing(9, inp, stcb, NULL);
7099 #endif
7100                         break;
7101                 }
7102                 if (from_where == 1) {
7103                         /* Only one transmission allowed out of a timeout */
7104 #ifdef SCTP_DEBUG
7105                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7106                                 kprintf("Only one packet allowed out\n");
7107                         }
7108 #endif
7109 #ifdef SCTP_AUDITING_ENABLED
7110                         sctp_auditing(10, inp, stcb, NULL);
7111 #endif
7112                         /* Push out any control */
7113                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
7114                                               &now, &now_filled);
7115                         return (ret);
7116                 }
7117                 if ((num_out == 0) && (ret == 0)) {
7118                         /* No more retrans to send */
7119                         break;
7120                 }
7121         }
7122 #ifdef SCTP_AUDITING_ENABLED
7123         sctp_auditing(12, inp, stcb, NULL);
7124 #endif
7125         /* Check for bad destinations, if they exist move chunks around. */
7126         burst_limit = asoc->max_burst;
7127         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7128                 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
7129                     SCTP_ADDR_NOT_REACHABLE) {
7130                         /*
7131                          * if possible move things off of this address
7132                          * we still may send below due to the dormant state
7133                          * but we try to find an alternate address to send
7134                          * to and if we have one we move all queued data on
7135                          * the out wheel to this alternate address.
7136                          */
7137                         sctp_move_to_an_alt(stcb, asoc, net);
7138                 } else {
7139                         /*
7140                         if ((asoc->sat_network) || (net->addr_is_local)) {
7141                                 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7142                         }
7143                         */
7144 #ifdef SCTP_DEBUG
7145                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7146                                 kprintf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7147                         }
7148 #endif
7149
7150 #ifdef SCTP_USE_ALLMAN_BURST
7151                         if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7152                                 if (net->ssthresh < net->cwnd)
7153                                         net->ssthresh = net->cwnd;
7154                                 net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7155 #ifdef SCTP_LOG_MAXBURST
7156                                 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7157 #endif
7158                                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7159                         }
7160                         net->fast_retran_ip = 0;
7161 #endif
7162                 }
7163
7164         }
7165         /* Fill up what we can to the destination */
7166         burst_cnt = 0;
7167         cwnd_full = 0;
7168         do {
7169 #ifdef SCTP_DEBUG
7170                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7171                         kprintf("Burst count:%d - call m-c-o\n", burst_cnt);
7172                 }
7173 #endif
7174                 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7175                                               &reason_code, 0,  &cwnd_full, from_where,
7176                                               &now, &now_filled);
7177                 if (error) {
7178 #ifdef SCTP_DEBUG
7179                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7180                                 kprintf("Error %d was returned from med-c-op\n", error);
7181                         }
7182 #endif
7183 #ifdef SCTP_LOG_MAXBURST
7184                         sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7185 #endif
7186                         break;
7187                 }
7188 #ifdef SCTP_DEBUG
7189                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7190                         kprintf("m-c-o put out %d\n", num_out);
7191                 }
7192 #endif
7193                 tot_out += num_out;
7194                 burst_cnt++;
7195         } while (num_out
7196 #ifndef SCTP_USE_ALLMAN_BURST
7197                  &&  (burst_cnt < burst_limit)
7198 #endif
7199                 );
7200 #ifndef SCTP_USE_ALLMAN_BURST
7201         if (burst_cnt >= burst_limit) {
7202                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7203                 asoc->burst_limit_applied = 1;
7204 #ifdef SCTP_LOG_MAXBURST
7205                 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7206 #endif
7207         } else {
7208                 asoc->burst_limit_applied = 0;
7209         }
7210 #endif
7211
7212 #ifdef SCTP_DEBUG
7213         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7214                 kprintf("Ok, we have put out %d chunks\n", tot_out);
7215         }
7216 #endif
7217         if (tot_out == 0) {
7218                 sctp_pegs[SCTP_CO_NODATASNT]++;
7219                 if (asoc->stream_queue_cnt > 0) {
7220                         sctp_pegs[SCTP_SOS_NOSNT]++;
7221                 } else {
7222                         sctp_pegs[SCTP_NOS_NOSNT]++;
7223                 }
7224                 if (asoc->send_queue_cnt > 0) {
7225                         sctp_pegs[SCTP_SOSE_NOSNT]++;
7226                 } else {
7227                         sctp_pegs[SCTP_NOSE_NOSNT]++;
7228                 }
7229         }
7230         /* Now we need to clean up the control chunk chain if
7231          * a ECNE is on it. It must be marked as UNSENT again
7232          * so next call will continue to send it until
7233          * such time that we get a CWR, to remove it.
7234          */
7235         sctp_fix_ecn_echo(asoc);
7236         return (error);
7237 }
7238
7239
7240 int
7241 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, struct sockaddr *addr,
7242             struct mbuf *control, struct thread *p, int flags)
7243 {
7244         struct inpcb *ip_inp;
7245         struct sctp_inpcb *t_inp;
7246         struct sctp_tcb *stcb;
7247         struct sctp_nets *net;
7248         struct sctp_association *asoc;
7249         int create_lock_applied = 0;
7250         int queue_only, error = 0;
7251         struct sctp_sndrcvinfo srcv;
7252         int un_sent = 0;
7253         int use_rcvinfo = 0;
7254         t_inp = inp;
7255         /*  struct route ro;*/
7256
7257         crit_enter();
7258         queue_only = 0;
7259         ip_inp = (struct inpcb *)inp;
7260         stcb = NULL;
7261         asoc = NULL;
7262         net = NULL;
7263
7264 #ifdef SCTP_DEBUG
7265         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7266                 kprintf("USR Send BEGINS\n");
7267         }
7268 #endif
7269
7270         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7271             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7272                 /* The listner can NOT send */
7273                 if (control) {
7274                         sctppcbinfo.mbuf_track--;
7275                         sctp_m_freem(control);
7276                         control = NULL;
7277                 }
7278                 sctp_m_freem(m);
7279                 crit_exit();
7280                 return (EFAULT);
7281         }
7282         /* Can't allow a V6 address on a non-v6 socket */
7283         if (addr) {
7284                 SCTP_ASOC_CREATE_LOCK(inp);
7285                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7286                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7287                         /* Should I really unlock ? */
7288                         SCTP_ASOC_CREATE_UNLOCK(inp);
7289                         if (control) {
7290                                 sctppcbinfo.mbuf_track--;
7291                                 sctp_m_freem(control);
7292                                 control = NULL;
7293                         }
7294                         sctp_m_freem(m);
7295                         crit_exit();
7296                         return (EFAULT);
7297                 }
7298                 create_lock_applied = 1;
7299                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7300                     (addr->sa_family == AF_INET6)) {
7301                         SCTP_ASOC_CREATE_UNLOCK(inp);
7302                         if (control) {
7303                                 sctppcbinfo.mbuf_track--;
7304                                 sctp_m_freem(control);
7305                                 control = NULL;
7306                         }
7307                         sctp_m_freem(m);
7308                         crit_exit();
7309                         return (EINVAL);
7310                 }
7311         }
7312         if (control) {
7313                 sctppcbinfo.mbuf_track++;
7314                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
7315                                    sizeof(srcv))) {
7316                         if (srcv.sinfo_flags & MSG_SENDALL) {
7317                                 /* its a sendall */
7318                                 sctppcbinfo.mbuf_track--;
7319                                 sctp_m_freem(control);
7320                                 crit_exit();
7321                                 if (create_lock_applied) {
7322                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7323                                         create_lock_applied = 0;
7324                                 }
7325                                 return (sctp_sendall(inp, NULL, m, &srcv));
7326                         }
7327                         if (srcv.sinfo_assoc_id) {
7328                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7329                                         SCTP_INP_RLOCK(inp);
7330                                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7331                                         if (stcb)
7332                                                 SCTP_TCB_LOCK(stcb);
7333                                         SCTP_INP_RUNLOCK(inp);
7334
7335                                         if (stcb == NULL) {
7336                                                 if (create_lock_applied) {
7337                                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7338                                                         create_lock_applied = 0;
7339                                                 }
7340                                                 sctppcbinfo.mbuf_track--;
7341                                                 sctp_m_freem(control);
7342                                                 sctp_m_freem(m);
7343                                                 crit_exit();
7344                                                 return (ENOTCONN);
7345                                         }
7346                                         net = stcb->asoc.primary_destination;
7347                                 } else {
7348                                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7349                                 }
7350                                 /*
7351                                  * Question: Should I error here if the
7352
7353                                  * assoc_id is no longer valid?
7354                                  * i.e. I can't find it?
7355                                  */
7356                                 if ((stcb) &&
7357                                     (addr != NULL)) {
7358                                         /* Must locate the net structure */
7359                                         if (addr)
7360                                                 net = sctp_findnet(stcb, addr);
7361                                 }
7362                                 if (net == NULL)
7363                                         net = stcb->asoc.primary_destination;
7364                         }
7365                         use_rcvinfo = 1;
7366                 }
7367         }
7368         if (stcb == NULL) {
7369                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7370                         SCTP_INP_RLOCK(inp);
7371                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7372                         if (stcb)
7373                                 SCTP_TCB_LOCK(stcb);
7374                         SCTP_INP_RUNLOCK(inp);
7375                         if (stcb == NULL) {
7376                                 crit_exit();
7377                                 if (create_lock_applied) {
7378                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7379                                         create_lock_applied = 0;
7380                                 }
7381                                 if (control) {
7382                                         sctppcbinfo.mbuf_track--;
7383                                         sctp_m_freem(control);
7384                                         control = NULL;
7385                                 }
7386                                 sctp_m_freem(m);
7387                                 return (ENOTCONN);
7388                         }
7389                         if (addr == NULL) {
7390                                 net = stcb->asoc.primary_destination;
7391                         } else {
7392                                 net = sctp_findnet(stcb, addr);
7393                                 if (net == NULL) {
7394                                         net = stcb->asoc.primary_destination;
7395                                 }
7396                         }
7397                 } else {
7398                         if (addr != NULL) {
7399                                 SCTP_INP_WLOCK(inp);
7400                                 SCTP_INP_INCR_REF(inp);
7401                                 SCTP_INP_WUNLOCK(inp);
7402                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7403                                 if (stcb == NULL) {
7404                                         SCTP_INP_WLOCK(inp);
7405                                         SCTP_INP_DECR_REF(inp);
7406                                         SCTP_INP_WUNLOCK(inp);
7407                                 }
7408                         }
7409                 }
7410         }
7411         if ((stcb == NULL) &&
7412             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7413                 if (control) {
7414                         sctppcbinfo.mbuf_track--;
7415                         sctp_m_freem(control);
7416                         control = NULL;
7417                 }
7418                 if (create_lock_applied) {
7419                         SCTP_ASOC_CREATE_UNLOCK(inp);
7420                         create_lock_applied = 0;
7421                 }
7422                 sctp_m_freem(m);
7423                 crit_exit();
7424                 return (ENOTCONN);
7425         } else if ((stcb == NULL) &&
7426                    (addr == NULL)) {
7427                 if (control) {
7428                         sctppcbinfo.mbuf_track--;
7429                         sctp_m_freem(control);
7430                         control = NULL;
7431                 }
7432                 if (create_lock_applied) {
7433                         SCTP_ASOC_CREATE_UNLOCK(inp);
7434                         create_lock_applied = 0;
7435                 }
7436                 sctp_m_freem(m);
7437                 crit_exit();
7438                 return (ENOENT);
7439         } else if (stcb == NULL) {
7440                 /* UDP mode, we must go ahead and start the INIT process */
7441                 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7442                         /* Strange user to do this */
7443                         if (control) {
7444                                 sctppcbinfo.mbuf_track--;
7445                                 sctp_m_freem(control);
7446                                 control = NULL;
7447                         }
7448                         if (create_lock_applied) {
7449                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7450                                 create_lock_applied = 0;
7451                         }
7452                         sctp_m_freem(m);
7453                         crit_exit();
7454                         return (ENOENT);
7455                 }
7456                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7457                 if (stcb == NULL) {
7458                         if (control) {
7459                                 sctppcbinfo.mbuf_track--;
7460                                 sctp_m_freem(control);
7461                                 control = NULL;
7462                         }
7463                         if (create_lock_applied) {
7464                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7465                                 create_lock_applied = 0;
7466                         }
7467                         sctp_m_freem(m);
7468                         crit_exit();
7469                         return (error);
7470                 }
7471                 if (create_lock_applied) {
7472                         SCTP_ASOC_CREATE_UNLOCK(inp);
7473                         create_lock_applied = 0;
7474                 } else {
7475                         kprintf("Huh-1, create lock should have been applied!\n");
7476                 }
7477                 queue_only = 1;
7478                 asoc = &stcb->asoc;
7479                 asoc->state = SCTP_STATE_COOKIE_WAIT;
7480                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7481                 if (control) {
7482                         /* see if a init structure exists in cmsg headers */
7483                         struct sctp_initmsg initm;
7484                         int i;
7485                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
7486                                            sizeof(initm))) {
7487                                 /* we have an INIT override of the default */
7488                                 if (initm.sinit_max_attempts)
7489                                         asoc->max_init_times = initm.sinit_max_attempts;
7490                                 if (initm.sinit_num_ostreams)
7491                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
7492                                 if (initm.sinit_max_instreams)
7493                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
7494                                 if (initm.sinit_max_init_timeo)
7495                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7496                         }
7497                         if (asoc->streamoutcnt < asoc->pre_open_streams) {
7498                                 /* Default is NOT correct */
7499 #ifdef SCTP_DEBUG
7500                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7501                                         kprintf("Ok, defout:%d pre_open:%d\n",
7502                                                asoc->streamoutcnt, asoc->pre_open_streams);
7503                                 }
7504 #endif
7505                                 FREE(asoc->strmout, M_PCB);
7506                                 asoc->strmout = NULL;
7507                                 asoc->streamoutcnt = asoc->pre_open_streams;
7508                                 MALLOC(asoc->strmout, struct sctp_stream_out *,
7509                                        asoc->streamoutcnt *
7510                                        sizeof(struct sctp_stream_out), M_PCB,
7511                                        MB_WAIT);
7512                                 for (i = 0; i < asoc->streamoutcnt; i++) {
7513                                         /*
7514                                          * inbound side must be set to 0xffff,
7515                                          * also NOTE when we get the INIT-ACK
7516                                          * back (for INIT sender) we MUST
7517                                          * reduce the count (streamoutcnt) but
7518                                          * first check if we sent to any of the
7519                                          * upper streams that were dropped (if
7520                                          * some were). Those that were dropped
7521                                          * must be notified to the upper layer
7522                                          * as failed to send.
7523                                          */
7524                                         asoc->strmout[i].next_sequence_sent = 0x0;
7525                                         TAILQ_INIT(&asoc->strmout[i].outqueue);
7526                                         asoc->strmout[i].stream_no = i;
7527                                         asoc->strmout[i].next_spoke.tqe_next = 0;
7528                                         asoc->strmout[i].next_spoke.tqe_prev = 0;
7529                                 }
7530                         }
7531                 }
7532                 sctp_send_initiate(inp, stcb);
7533                 /*
7534                  * we may want to dig in after this call and adjust the MTU
7535                  * value. It defaulted to 1500 (constant) but the ro structure
7536                  * may now have an update and thus we may need to change it
7537                  * BEFORE we append the message.
7538                  */
7539                 net = stcb->asoc.primary_destination;
7540         } else {
7541                 if (create_lock_applied) {
7542                         SCTP_ASOC_CREATE_UNLOCK(inp);
7543                         create_lock_applied = 0;
7544                 }
7545                 asoc = &stcb->asoc;
7546                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7547                     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7548                         queue_only = 1;
7549                 }
7550                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7551                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7552                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7553                     (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7554                         if (control) {
7555                                 sctppcbinfo.mbuf_track--;
7556                                 sctp_m_freem(control);
7557                                 control = NULL;
7558                         }
7559                         if ((use_rcvinfo) &&
7560                             (srcv.sinfo_flags & MSG_ABORT)) {
7561                                 sctp_msg_append(stcb, net, m, &srcv, flags);
7562                                 error = 0;
7563                         } else {
7564                                 if (m)
7565                                         sctp_m_freem(m);
7566                                 error = ECONNRESET;
7567                         }
7568                         crit_exit();
7569                         SCTP_TCB_UNLOCK(stcb);
7570                         return (error);
7571                 }
7572         }
7573         if (create_lock_applied) {
7574                 /* we should never hit here with the create lock applied
7575                  *
7576                  */
7577                 SCTP_ASOC_CREATE_UNLOCK(inp);
7578                 create_lock_applied = 0;
7579         }
7580
7581
7582         if (use_rcvinfo == 0) {
7583                 srcv = stcb->asoc.def_send;
7584         }
7585 #ifdef SCTP_DEBUG
7586         else {
7587                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7588                         kprintf("stream:%d\n", srcv.sinfo_stream);
7589                         kprintf("flags:%x\n", (u_int)srcv.sinfo_flags);
7590                         kprintf("ppid:%d\n", srcv.sinfo_ppid);
7591                         kprintf("context:%d\n", srcv.sinfo_context);
7592                 }
7593         }
7594 #endif
7595         if (control) {
7596                 sctppcbinfo.mbuf_track--;
7597                 sctp_m_freem(control);
7598                 control = NULL;
7599         }
7600         if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7601                 /* we take the override or the unconfirmed */
7602                 ;
7603         } else {
7604                 net = stcb->asoc.primary_destination;
7605         }
7606         if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7607                 SCTP_TCB_UNLOCK(stcb);
7608                 crit_exit();
7609                 return (error);
7610         }
7611         if (net->flight_size > net->cwnd) {
7612                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7613                 queue_only = 1;
7614         } else if (asoc->ifp_had_enobuf) {
7615                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7616                 queue_only = 1;
7617         } else {
7618                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7619                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7620                            SCTP_MED_OVERHEAD);
7621
7622                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7623                     (stcb->asoc.total_flight > 0) &&
7624                     (un_sent < (int)stcb->asoc.smallest_mtu)
7625                         ) {
7626
7627                         /* Ok, Nagle is set on and we have
7628                          * data outstanding. Don't send anything
7629                          * and let the SACK drive out the data.
7630                          */
7631                         sctp_pegs[SCTP_NAGLE_NOQ]++;
7632                         queue_only = 1;
7633                 } else {
7634                         sctp_pegs[SCTP_NAGLE_OFF]++;
7635                 }
7636         }
7637         if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7638                 /* we can attempt to send too.*/
7639 #ifdef SCTP_DEBUG
7640                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7641                         kprintf("USR Send calls sctp_chunk_output\n");
7642                 }
7643 #endif
7644 #ifdef SCTP_AUDITING_ENABLED
7645                 sctp_audit_log(0xC0, 1);
7646                 sctp_auditing(6, inp, stcb, net);
7647 #endif
7648                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7649                 sctp_chunk_output(inp, stcb, 0);
7650 #ifdef SCTP_AUDITING_ENABLED
7651                 sctp_audit_log(0xC0, 2);
7652                 sctp_auditing(7, inp, stcb, net);
7653 #endif
7654
7655         }
7656 #ifdef SCTP_DEBUG
7657         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7658                 kprintf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7659         }
7660 #endif
7661         SCTP_TCB_UNLOCK(stcb);
7662         crit_exit();
7663         return (0);
7664 }
7665
7666 void
7667 send_forward_tsn(struct sctp_tcb *stcb,
7668                  struct sctp_association *asoc)
7669 {
7670         struct sctp_tmit_chunk *chk;
7671         struct sctp_forward_tsn_chunk *fwdtsn;
7672
7673         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7674                 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7675                         /* mark it to unsent */
7676                         chk->sent = SCTP_DATAGRAM_UNSENT;
7677                         chk->snd_count = 0;
7678                         /* Do we correct its output location? */
7679                         if (chk->whoTo != asoc->primary_destination) {
7680                                 sctp_free_remote_addr(chk->whoTo);
7681                                 chk->whoTo = asoc->primary_destination;
7682                                 chk->whoTo->ref_count++;
7683                         }
7684                         goto sctp_fill_in_rest;
7685                 }
7686         }
7687         /* Ok if we reach here we must build one */
7688         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7689         if (chk == NULL) {
7690                 return;
7691         }
7692         sctppcbinfo.ipi_count_chunk++;
7693         sctppcbinfo.ipi_gencnt_chunk++;
7694         chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7695         chk->asoc = asoc;
7696         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
7697         if (chk->data == NULL) {
7698                 chk->whoTo->ref_count--;
7699                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7700                 sctppcbinfo.ipi_count_chunk--;
7701                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7702                         panic("Chunk count is negative");
7703                 }
7704                 sctppcbinfo.ipi_gencnt_chunk++;
7705                 return;
7706         }
7707         chk->data->m_data += SCTP_MIN_OVERHEAD;
7708         chk->sent = SCTP_DATAGRAM_UNSENT;
7709         chk->snd_count = 0;
7710         chk->whoTo = asoc->primary_destination;
7711         chk->whoTo->ref_count++;
7712         TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7713         asoc->ctrl_queue_cnt++;
7714  sctp_fill_in_rest:
7715         /* Here we go through and fill out the part that
7716          * deals with stream/seq of the ones we skip.
7717          */
7718         chk->data->m_pkthdr.len = chk->data->m_len = 0;
7719         {
7720                 struct sctp_tmit_chunk *at, *tp1, *last;
7721                 struct sctp_strseq *strseq;
7722                 unsigned int cnt_of_space, i, ovh;
7723                 unsigned int space_needed;
7724                 unsigned int cnt_of_skipped = 0;
7725                 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7726                         if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7727                                 /* no more to look at */
7728                                 break;
7729                         }
7730                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7731                                 /* We don't report these */
7732                                 continue;
7733                         }
7734                         cnt_of_skipped++;
7735                 }
7736                 space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7737                                 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7738                 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7739                     ((chk->data->m_flags & M_EXT) == 0)) {
7740                         /* Need a M_EXT, get one and move
7741                          * fwdtsn to data area.
7742                          */
7743                         MCLGET(chk->data, MB_DONTWAIT);
7744                 }
7745                 cnt_of_space = M_TRAILINGSPACE(chk->data);
7746
7747                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7748                         ovh = SCTP_MIN_OVERHEAD;
7749                 } else {
7750                         ovh = SCTP_MIN_V4_OVERHEAD;
7751                 }
7752                 if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7753                         /* trim to a mtu size */
7754                         cnt_of_space = asoc->smallest_mtu - ovh;
7755                 }
7756                 if (cnt_of_space < space_needed) {
7757                         /* ok we must trim down the chunk by lowering
7758                          * the advance peer ack point.
7759                          */
7760                         cnt_of_skipped = (cnt_of_space-
7761                                           ((sizeof(struct sctp_forward_tsn_chunk))/
7762                                             sizeof(struct sctp_strseq)));
7763                         /* Go through and find the TSN that
7764                          * will be the one we report.
7765                          */
7766                         at = TAILQ_FIRST(&asoc->sent_queue);
7767                         for (i = 0; i < cnt_of_skipped; i++) {
7768                                 tp1 = TAILQ_NEXT(at, sctp_next);
7769                                 at = tp1;
7770                         }
7771                         last = at;
7772                         /* last now points to last one I can report, update peer ack point */
7773                         asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7774                         space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7775                 }
7776                 chk->send_size = space_needed;
7777                 /* Setup the chunk */
7778                 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7779                 fwdtsn->ch.chunk_length = htons(chk->send_size);
7780                 fwdtsn->ch.chunk_flags = 0;
7781                 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7782                 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7783                 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7784                                   (cnt_of_skipped * sizeof(struct sctp_strseq)));
7785                 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7786                 fwdtsn++;
7787                 /* Move pointer to after the fwdtsn and transfer to
7788                  * the strseq pointer.
7789                  */
7790                 strseq = (struct sctp_strseq *)fwdtsn;
7791                 /*
7792                  * Now populate the strseq list. This is done blindly
7793                  * without pulling out duplicate stream info. This is
7794                  * inefficent but won't harm the process since the peer
7795                  * will look at these in sequence and will thus release
7796                  * anything. It could mean we exceed the PMTU and chop
7797                  * off some that we could have included.. but this is
7798                  * unlikely (aka 1432/4 would mean 300+ stream seq's would
7799                  * have to be reported in one FWD-TSN. With a bit of work
7800                  * we can later FIX this to optimize and pull out duplcates..
7801                  * but it does add more overhead. So for now... not!
7802                  */
7803                 at = TAILQ_FIRST(&asoc->sent_queue);
7804                 for (i = 0; i < cnt_of_skipped; i++) {
7805                         tp1 = TAILQ_NEXT(at, sctp_next);
7806                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7807                                 /* We don't report these */
7808                                 i--;
7809                                 at = tp1;
7810                                 continue;
7811                         }
7812                         strseq->stream = ntohs(at->rec.data.stream_number);
7813                         strseq->sequence = ntohs(at->rec.data.stream_seq);
7814                         strseq++;
7815                         at = tp1;
7816                 }
7817         }
7818         return;
7819
7820 }
7821
7822 void
7823 sctp_send_sack(struct sctp_tcb *stcb)
7824 {
7825         /*
7826          * Queue up a SACK in the control queue. We must first check to
7827          * see if a SACK is somehow on the control queue. If so, we will
7828          * take and and remove the old one.
7829          */
7830         struct sctp_association *asoc;
7831         struct sctp_tmit_chunk *chk, *a_chk;
7832         struct sctp_sack_chunk *sack;
7833         struct sctp_gap_ack_block *gap_descriptor;
7834         uint32_t *dup;
7835         int start;
7836         unsigned int i, maxi, seeing_ones, m_size;
7837         unsigned int num_gap_blocks, space;
7838
7839         start = maxi = 0;
7840         seeing_ones = 1;
7841         a_chk = NULL;
7842         asoc = &stcb->asoc;
7843         if (asoc->last_data_chunk_from == NULL) {
7844                 /* Hmm we never received anything */
7845                 return;
7846         }
7847         sctp_set_rwnd(stcb, asoc);
7848         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7849                 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7850                         /* Hmm, found a sack already on queue, remove it */
7851                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7852                         asoc->ctrl_queue_cnt++;
7853                         a_chk = chk;
7854                         if (a_chk->data)
7855                                 sctp_m_freem(a_chk->data);
7856                         a_chk->data = NULL;
7857                         sctp_free_remote_addr(a_chk->whoTo);
7858                         a_chk->whoTo = NULL;
7859                         break;
7860                 }
7861         }
7862         if (a_chk == NULL) {
7863                 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7864                 if (a_chk == NULL) {
7865                         /* No memory so we drop the idea, and set a timer */
7866                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7867                                         stcb->sctp_ep, stcb, NULL);
7868                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7869                                          stcb->sctp_ep, stcb, NULL);
7870                         return;
7871                 }
7872                 sctppcbinfo.ipi_count_chunk++;
7873                 sctppcbinfo.ipi_gencnt_chunk++;
7874                 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7875         }
7876         a_chk->asoc = asoc;
7877         a_chk->snd_count = 0;
7878         a_chk->send_size = 0;   /* fill in later */
7879         a_chk->sent = SCTP_DATAGRAM_UNSENT;
7880         m_size = (asoc->mapping_array_size << 3);
7881
7882         if ((asoc->numduptsns) ||
7883             (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7884                 ) {
7885                 /* Ok, we have some duplicates or the destination for the
7886                  * sack is unreachable, lets see if we can select an alternate
7887                  * than asoc->last_data_chunk_from
7888                  */
7889                 if ((!(asoc->last_data_chunk_from->dest_state &
7890                       SCTP_ADDR_NOT_REACHABLE)) &&
7891                     (asoc->used_alt_onsack > 2)) {
7892                         /* We used an alt last time, don't this time */
7893                         a_chk->whoTo = NULL;
7894                 } else {
7895                         asoc->used_alt_onsack++;
7896                         a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7897                 }
7898                 if (a_chk->whoTo == NULL) {
7899                         /* Nope, no alternate */
7900                         a_chk->whoTo = asoc->last_data_chunk_from;
7901                         asoc->used_alt_onsack = 0;
7902                 }
7903         } else {
7904                 /* No duplicates so we use the last
7905                  * place we received data from.
7906                  */
7907 #ifdef SCTP_DEBUG
7908                 if (asoc->last_data_chunk_from == NULL) {
7909                         kprintf("Huh, last_data_chunk_from is null when we want to sack??\n");
7910                 }
7911 #endif
7912                 asoc->used_alt_onsack = 0;
7913                 a_chk->whoTo = asoc->last_data_chunk_from;
7914         }
7915         if (a_chk->whoTo)
7916                 a_chk->whoTo->ref_count++;
7917
7918         /* Ok now lets formulate a MBUF with our sack */
7919         MGETHDR(a_chk->data, MB_DONTWAIT, MT_DATA);
7920         if ((a_chk->data == NULL) ||
7921             (a_chk->whoTo == NULL)) {
7922                 /* rats, no mbuf memory */
7923                 if (a_chk->data) {
7924                         /* was a problem with the destination */
7925                         sctp_m_freem(a_chk->data);
7926                         a_chk->data = NULL;
7927                 }
7928                 a_chk->whoTo->ref_count--;
7929                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7930                 sctppcbinfo.ipi_count_chunk--;
7931                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7932                         panic("Chunk count is negative");
7933                 }
7934                 sctppcbinfo.ipi_gencnt_chunk++;
7935                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7936                                 stcb->sctp_ep, stcb, NULL);
7937                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7938                                  stcb->sctp_ep, stcb, NULL);
7939                 return;
7940         }
7941         /* First count the number of gap ack blocks we need */
7942         if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7943                 /* We know if there are none above the cum-ack we
7944                  * have everything with NO gaps
7945                  */
7946                 num_gap_blocks = 0;
7947         } else {
7948                 /* Ok we must count how many gaps we
7949                  * have.
7950                  */
7951                 num_gap_blocks = 0;
7952                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7953                         maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7954                 } else {
7955                         maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7956                 }
7957                 if (maxi > m_size) {
7958                         /* impossible but who knows, someone is playing with us  :> */
7959 #ifdef SCTP_DEBUG
7960                         kprintf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7961                                maxi,
7962                                m_size,
7963                                asoc->highest_tsn_inside_map,
7964                                asoc->mapping_array_base_tsn,
7965                                asoc->cumulative_tsn
7966                                );
7967 #endif
7968                         num_gap_blocks = 0;
7969                         goto no_gaps_now;
7970                 }
7971                 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7972                         start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7973                 } else {
7974                         /* Set it so we start at 0 */
7975                         start = -1;
7976                 }
7977                 /* Ok move start up one to look at the NEXT past the cum-ack */
7978                 start++;
7979                 for (i = start; i <= maxi; i++) {
7980                         if (seeing_ones) {
7981                                 /* while seeing ones I must
7982                                  * transition back to 0 before
7983                                  * finding the next gap and
7984                                  * counting the segment.
7985                                  */
7986                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7987                                         seeing_ones = 0;
7988                                 }
7989                         } else {
7990                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7991                                         seeing_ones = 1;
7992                                         num_gap_blocks++;
7993                                 }
7994                         }
7995                 }
7996         no_gaps_now:
7997                 if (num_gap_blocks == 0) {
7998                         /*
7999                          * Traveled all of the bits and NO one,
8000                          * must have reneged
8001                          */
8002                         if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
8003                            asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
8004 #ifdef SCTP_MAP_LOGGING
8005                            sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
8006 #endif
8007                         }
8008                 }
8009         }
8010
8011         /* Now calculate the space needed */
8012         space = (sizeof(struct sctp_sack_chunk) +
8013                  (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8014                  (asoc->numduptsns * sizeof(int32_t))
8015                 );
8016         if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
8017                 /* Reduce the size of the sack to fit */
8018                 int calc, fit;
8019                 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
8020                 calc -= sizeof(struct sctp_gap_ack_block);
8021                 fit = calc/sizeof(struct sctp_gap_ack_block);
8022                 if (fit > (int)num_gap_blocks) {
8023                         /* discard some dups */
8024                         asoc->numduptsns = (fit - num_gap_blocks);
8025                 } else {
8026                         /* discard all dups and some gaps */
8027                         num_gap_blocks = fit;
8028                         asoc->numduptsns = 0;
8029                 }
8030                 /* recalc space */
8031                 space = (sizeof(struct sctp_sack_chunk) +
8032                          (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8033                          (asoc->numduptsns * sizeof(int32_t))
8034                         );
8035
8036         }
8037
8038         if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
8039                 /* We need a cluster */
8040                 MCLGET(a_chk->data, MB_DONTWAIT);
8041                 if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
8042                         /* can't get a cluster
8043                          * give up and try later.
8044                          */
8045                         if (a_chk->data)
8046                                 sctp_m_freem(a_chk->data);
8047                         a_chk->data = NULL;
8048                         a_chk->whoTo->ref_count--;
8049                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
8050                         sctppcbinfo.ipi_count_chunk--;
8051                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8052                                 panic("Chunk count is negative");
8053                         }
8054                         sctppcbinfo.ipi_gencnt_chunk++;
8055                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
8056                                         stcb->sctp_ep, stcb, NULL);
8057                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
8058                                          stcb->sctp_ep, stcb, NULL);
8059                         return;
8060                 }
8061         }
8062
8063         /* ok, lets go through and fill it in */
8064         a_chk->data->m_data += SCTP_MIN_OVERHEAD;
8065         sack = mtod(a_chk->data, struct sctp_sack_chunk *);
8066         sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
8067         sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
8068         sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
8069         sack->sack.a_rwnd = htonl(asoc->my_rwnd);
8070         asoc->my_last_reported_rwnd = asoc->my_rwnd;
8071         sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
8072         sack->sack.num_dup_tsns = htons(asoc->numduptsns);
8073
8074         a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
8075                             (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8076                             (asoc->numduptsns * sizeof(int32_t)));
8077         a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
8078         sack->ch.chunk_length = htons(a_chk->send_size);
8079
8080         gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
8081         seeing_ones = 0;
8082         for (i = start; i <= maxi; i++) {
8083                 if (num_gap_blocks == 0) {
8084                         break;
8085                 }
8086                 if (seeing_ones) {
8087                         /* while seeing Ones I must
8088                          * transition back to 0 before
8089                          * finding the next gap
8090                          */
8091                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
8092                                 gap_descriptor->end = htons(((uint16_t)(i-start)));
8093                                 gap_descriptor++;
8094                                 seeing_ones = 0;
8095                                 num_gap_blocks--;
8096                         }
8097                 } else {
8098                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
8099                                 gap_descriptor->start = htons(((uint16_t)(i+1-start)));
8100                                 /* advance struct to next pointer */
8101                                 seeing_ones = 1;
8102                         }
8103                 }
8104         }
8105         if (num_gap_blocks) {
8106                 /* special case where the array is all 1's
8107                  * to the end of the array.
8108                  */
8109                 gap_descriptor->end = htons(((uint16_t)((i-start))));
8110                 gap_descriptor++;
8111         }
8112         /* now we must add any dups we are going to report. */
8113         if (asoc->numduptsns) {
8114                 dup = (uint32_t *)gap_descriptor;
8115                 for (i = 0; i < asoc->numduptsns; i++) {
8116                         *dup = htonl(asoc->dup_tsns[i]);
8117                         dup++;
8118                 }
8119                 asoc->numduptsns = 0;
8120         }
8121         /* now that the chunk is prepared queue it to the control
8122          * chunk queue.
8123          */
8124         TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
8125         asoc->ctrl_queue_cnt++;
8126         sctp_pegs[SCTP_PEG_SACKS_SENT]++;
8127         return;
8128 }
8129
8130 void
8131 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
8132 {
8133         struct mbuf *m_abort;
8134         struct sctp_abort_msg *abort_m;
8135         int sz;
8136         abort_m = NULL;
8137         MGETHDR(m_abort, MB_DONTWAIT, MT_HEADER);
8138         if (m_abort == NULL) {
8139                 /* no mbuf's */
8140                 return;
8141         }
8142         m_abort->m_data += SCTP_MIN_OVERHEAD;
8143         abort_m = mtod(m_abort, struct sctp_abort_msg *);
8144         m_abort->m_len = sizeof(struct sctp_abort_msg);
8145         m_abort->m_next = operr;
8146         sz = 0;
8147         if (operr) {
8148                 struct mbuf *n;
8149                 n = operr;
8150                 while (n) {
8151                         sz += n->m_len;
8152                         n = n->m_next;
8153                 }
8154         }
8155         abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8156         abort_m->msg.ch.chunk_flags = 0;
8157         abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8158                                              sz);
8159         abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8160         abort_m->sh.dest_port = stcb->rport;
8161         abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8162         abort_m->sh.checksum = 0;
8163         m_abort->m_pkthdr.len = m_abort->m_len + sz;
8164         m_abort->m_pkthdr.rcvif = 0;
8165         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8166             stcb->asoc.primary_destination,
8167             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
8168             m_abort, 1, 0, NULL, 0);
8169 }
8170
8171 int
8172 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8173                             struct sctp_nets *net)
8174
8175 {
8176         /* formulate and SEND a SHUTDOWN-COMPLETE */
8177         struct mbuf *m_shutdown_comp;
8178         struct sctp_shutdown_complete_msg *comp_cp;
8179
8180         m_shutdown_comp = NULL;
8181         MGETHDR(m_shutdown_comp, MB_DONTWAIT, MT_HEADER);
8182         if (m_shutdown_comp == NULL) {
8183                 /* no mbuf's */
8184                 return (-1);
8185         }
8186         m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8187         comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8188         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8189         comp_cp->shut_cmp.ch.chunk_flags = 0;
8190         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8191         comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8192         comp_cp->sh.dest_port = stcb->rport;
8193         comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8194         comp_cp->sh.checksum = 0;
8195
8196         m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8197         m_shutdown_comp->m_pkthdr.rcvif = 0;
8198         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8199             (struct sockaddr *)&net->ro._l_addr, m_shutdown_comp,
8200             1, 0, NULL, 0);
8201         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8202             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8203                 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8204                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
8205                 soisdisconnected(stcb->sctp_ep->sctp_socket);
8206         }
8207         return (0);
8208 }
8209
8210 int
8211 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8212 {
8213         /* formulate and SEND a SHUTDOWN-COMPLETE */
8214         struct mbuf *mout;
8215         struct ip *iph, *iph_out;
8216         struct ip6_hdr *ip6, *ip6_out;
8217         int offset_out;
8218         struct sctp_shutdown_complete_msg *comp_cp;
8219
8220         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
8221         if (mout == NULL) {
8222                 /* no mbuf's */
8223                 return (-1);
8224         }
8225         iph = mtod(m, struct ip *);
8226         iph_out = NULL;
8227         ip6_out = NULL;
8228         offset_out = 0;
8229         if (iph->ip_v == IPVERSION) {
8230                 mout->m_len = sizeof(struct ip) +
8231                     sizeof(struct sctp_shutdown_complete_msg);
8232                 mout->m_next = NULL;
8233                 iph_out = mtod(mout, struct ip *);
8234
8235                 /* Fill in the IP header for the ABORT */
8236                 iph_out->ip_v = IPVERSION;
8237                 iph_out->ip_hl = (sizeof(struct ip)/4);
8238                 iph_out->ip_tos = (u_char)0;
8239                 iph_out->ip_id = 0;
8240                 iph_out->ip_off = 0;
8241                 iph_out->ip_ttl = MAXTTL;
8242                 iph_out->ip_p = IPPROTO_SCTP;
8243                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8244                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8245
8246                 /* let IP layer calculate this */
8247                 iph_out->ip_sum = 0;
8248                 offset_out += sizeof(*iph_out);
8249                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8250                     (caddr_t)iph_out + offset_out);
8251         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8252                 ip6 = (struct ip6_hdr *)iph;
8253                 mout->m_len = sizeof(struct ip6_hdr) +
8254                     sizeof(struct sctp_shutdown_complete_msg);
8255                 mout->m_next = NULL;
8256                 ip6_out = mtod(mout, struct ip6_hdr *);
8257
8258                 /* Fill in the IPv6 header for the ABORT */
8259                 ip6_out->ip6_flow = ip6->ip6_flow;
8260                 ip6_out->ip6_hlim = ip6_defhlim;
8261                 ip6_out->ip6_nxt = IPPROTO_SCTP;
8262                 ip6_out->ip6_src = ip6->ip6_dst;
8263                 ip6_out->ip6_dst = ip6->ip6_src;
8264                 ip6_out->ip6_plen = mout->m_len;
8265                 offset_out += sizeof(*ip6_out);
8266                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8267                     (caddr_t)ip6_out + offset_out);
8268         } else {
8269                 /* Currently not supported. */
8270                 return (-1);
8271         }
8272
8273         /* Now copy in and fill in the ABORT tags etc. */
8274         comp_cp->sh.src_port = sh->dest_port;
8275         comp_cp->sh.dest_port = sh->src_port;
8276         comp_cp->sh.checksum = 0;
8277         comp_cp->sh.v_tag = sh->v_tag;
8278         comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8279         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8280         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8281
8282         mout->m_pkthdr.len = mout->m_len;
8283         /* add checksum */
8284         if ((sctp_no_csum_on_loopback) &&
8285            (m->m_pkthdr.rcvif) &&
8286            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
8287                 comp_cp->sh.checksum =  0;
8288         } else {
8289                 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8290         }
8291
8292         /* zap the rcvif, it should be null */
8293         mout->m_pkthdr.rcvif = 0;
8294         /* zap the stack pointer to the route */
8295         if (iph_out != NULL) {
8296                 struct route ro;
8297
8298                 bzero(&ro, sizeof ro);
8299 #ifdef SCTP_DEBUG
8300                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8301                         kprintf("sctp_shutdown_complete2 calling ip_output:\n");
8302                         sctp_print_address_pkt(iph_out, &comp_cp->sh);
8303                 }
8304 #endif
8305                 /* set IPv4 length */
8306 #if defined(__FreeBSD__)
8307                 iph_out->ip_len = mout->m_pkthdr.len;
8308 #else
8309                 iph_out->ip_len = htons(mout->m_pkthdr.len);
8310 #endif
8311                 /* out it goes */
8312                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
8313 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
8314     || defined(__NetBSD__) || defined(__DragonFly__)
8315                     , NULL
8316 #endif
8317                     );
8318                 /* Free the route if we got one back */
8319                 if (ro.ro_rt)
8320                         RTFREE(ro.ro_rt);
8321         } else if (ip6_out != NULL) {
8322 #ifdef NEW_STRUCT_ROUTE
8323                 struct route ro;
8324 #else
8325                 struct route_in6 ro;
8326 #endif
8327
8328                 bzero(&ro, sizeof(ro));
8329 #ifdef SCTP_DEBUG
8330                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8331                         kprintf("sctp_shutdown_complete2 calling ip6_output:\n");
8332                         sctp_print_address_pkt((struct ip *)ip6_out,
8333                             &comp_cp->sh);
8334                 }
8335 #endif
8336                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
8337 #if defined(__NetBSD__)
8338                            , NULL
8339 #endif
8340 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
8341                            , NULL
8342 #endif
8343                     );
8344                 /* Free the route if we got one back */
8345                 if (ro.ro_rt)
8346                         RTFREE(ro.ro_rt);
8347         }
8348         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8349         return (0);
8350 }
8351
8352 static struct sctp_nets *
8353 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8354 {
8355         struct sctp_nets *net, *hnet;
8356         int ms_goneby, highest_ms, state_overide=0;
8357
8358         SCTP_GETTIME_TIMEVAL(now);
8359         highest_ms = 0;
8360         hnet = NULL;
8361         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8362                 if (
8363                         ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8364                         (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8365                         ) {
8366                         /* Skip this guy from consideration if HB is off AND its confirmed*/
8367 #ifdef SCTP_DEBUG
8368                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8369                                 kprintf("Skipping net:%p state:%d nohb/out-of-scope\n",
8370                                        net, net->dest_state);
8371                         }
8372 #endif
8373                         continue;
8374                 }
8375                 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
8376                         /* skip this dest net from consideration */
8377 #ifdef SCTP_DEBUG
8378                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8379                                 kprintf("Skipping net:%p reachable NOT\n",
8380                                        net);
8381                         }
8382 #endif
8383                         continue;
8384                 }
8385                 if (net->last_sent_time.tv_sec) {
8386                         /* Sent to so we subtract */
8387                         ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8388                 } else
8389                         /* Never been sent to */
8390                         ms_goneby = 0x7fffffff;
8391 #ifdef SCTP_DEBUG
8392                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8393                         kprintf("net:%p ms_goneby:%d\n",
8394                                net, ms_goneby);
8395                 }
8396 #endif
8397                 /* When the address state is unconfirmed but still considered reachable, we
8398                  * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8399                  * state, thenw we cut it back to HB at a more normal pace.
8400                  */
8401                 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8402                         state_overide = 1;
8403                 } else {
8404                         state_overide = 0;
8405                 }
8406
8407                 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8408                     (ms_goneby > highest_ms)) {
8409                         highest_ms = ms_goneby;
8410                         hnet = net;
8411 #ifdef SCTP_DEBUG
8412                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8413                                 kprintf("net:%p is the new high\n",
8414                                        net);
8415                         }
8416 #endif
8417                 }
8418         }
8419         if (hnet &&
8420            ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8421                 state_overide = 1;
8422         } else {
8423                 state_overide = 0;
8424         }
8425
8426         if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8427                 /* Found the one with longest delay bounds
8428                  * OR it is unconfirmed and still not marked
8429                  * unreachable.
8430                  */
8431 #ifdef SCTP_DEBUG
8432                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8433                         kprintf("net:%p is the hb winner -",
8434                                 hnet);
8435                         if (hnet)
8436                                 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr);
8437                         else
8438                                 kprintf(" none\n");
8439                 }
8440 #endif
8441                 /* update the timer now */
8442                 hnet->last_sent_time = *now;
8443                 return (hnet);
8444         }
8445         /* Nothing to HB */
8446         return (NULL);
8447 }
8448
8449 int
8450 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8451 {
8452         struct sctp_tmit_chunk *chk;
8453         struct sctp_nets *net;
8454         struct sctp_heartbeat_chunk *hb;
8455         struct timeval now;
8456         struct sockaddr_in *sin;
8457         struct sockaddr_in6 *sin6;
8458
8459         if (user_req == 0) {
8460                 net = sctp_select_hb_destination(stcb, &now);
8461                 if (net == NULL) {
8462                         /* All our busy none to send to, just
8463                          * start the timer again.
8464                          */
8465                         if (stcb->asoc.state == 0) {
8466                                 return (0);
8467                         }
8468                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8469                                          stcb->sctp_ep,
8470                                          stcb,
8471                                          net);
8472                         return (0);
8473                 }
8474 #ifndef SCTP_USE_ALLMAN_BURST
8475                 else {
8476                         /* found one idle.. decay cwnd on this one
8477                          * by 1/2 if none outstanding.
8478                          */
8479
8480                         if (net->flight_size == 0) {
8481                                 net->cwnd /= 2;
8482                                 if (net->addr_is_local) {
8483                                         if (net->cwnd < (net->mtu *4)) {
8484                                                 net->cwnd = net->mtu * 4;
8485                                         }
8486                                 } else {
8487                                         if (net->cwnd < (net->mtu * 2)) {
8488                                                 net->cwnd = net->mtu * 2;
8489                                         }
8490                                 }
8491
8492                         }
8493
8494                 }
8495 #endif
8496         } else {
8497                 net = u_net;
8498                 if (net == NULL) {
8499                         return (0);
8500                 }
8501                 SCTP_GETTIME_TIMEVAL(&now);
8502         }
8503         sin = (struct sockaddr_in *)&net->ro._l_addr;
8504         if (sin->sin_family != AF_INET) {
8505                 if (sin->sin_family != AF_INET6) {
8506                         /* huh */
8507                         return (0);
8508                 }
8509         }
8510         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8511         if (chk == NULL) {
8512 #ifdef SCTP_DEBUG
8513                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8514                         kprintf("Gak, can't get a chunk for hb\n");
8515                 }
8516 #endif
8517                 return (0);
8518         }
8519         sctppcbinfo.ipi_gencnt_chunk++;
8520         sctppcbinfo.ipi_count_chunk++;
8521         chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8522         chk->asoc = &stcb->asoc;
8523         chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8524         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8525         if (chk->data == NULL) {
8526                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8527                 sctppcbinfo.ipi_count_chunk--;
8528                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8529                         panic("Chunk count is negative");
8530                 }
8531                 sctppcbinfo.ipi_gencnt_chunk++;
8532                 return (0);
8533         }
8534         chk->data->m_data += SCTP_MIN_OVERHEAD;
8535         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8536         chk->sent = SCTP_DATAGRAM_UNSENT;
8537         chk->snd_count = 0;
8538         chk->whoTo = net;
8539         chk->whoTo->ref_count++;
8540         /* Now we have a mbuf that we can fill in with the details */
8541         hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8542
8543         /* fill out chunk header */
8544         hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8545         hb->ch.chunk_flags = 0;
8546         hb->ch.chunk_length = htons(chk->send_size);
8547         /* Fill out hb parameter */
8548         hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8549         hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8550         hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8551         hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8552         /* Did our user request this one, put it in */
8553         hb->heartbeat.hb_info.user_req = user_req;
8554         hb->heartbeat.hb_info.addr_family = sin->sin_family;
8555         hb->heartbeat.hb_info.addr_len = sin->sin_len;
8556         if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8557                 /* we only take from the entropy pool if the address is
8558                  * not confirmed.
8559                  */
8560                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8561                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8562         } else {
8563                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8564                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8565         }
8566         if (sin->sin_family == AF_INET) {
8567                 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8568         } else if (sin->sin_family == AF_INET6) {
8569                 /* We leave the scope the way it is in our lookup table. */
8570                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
8571                 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8572         } else {
8573                 /* huh compiler bug */
8574 #ifdef SCTP_DEBUG
8575                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8576                         kprintf("Compiler bug bleeds a mbuf and a chunk\n");
8577                 }
8578 #endif
8579                 return (0);
8580         }
8581         /* ok we have a destination that needs a beat */
8582         /* lets do the theshold management Qiaobing style */
8583         if (user_req == 0) {
8584                 if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8585                                               stcb->asoc.max_send_times)) {
8586                         /* we have lost the association, in a way this
8587                          * is quite bad since we really are one less time
8588                          * since we really did not send yet. This is the
8589                          * down side to the Q's style as defined in the RFC
8590                          * and not my alternate style defined in the RFC.
8591                          */
8592                         if (chk->data != NULL) {
8593                                 sctp_m_freem(chk->data);
8594                                 chk->data = NULL;
8595                         }
8596                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8597                         sctppcbinfo.ipi_count_chunk--;
8598                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8599                                 panic("Chunk count is negative");
8600                         }
8601                         sctppcbinfo.ipi_gencnt_chunk++;
8602                         return (-1);
8603                 }
8604         }
8605         net->hb_responded = 0;
8606 #ifdef SCTP_DEBUG
8607         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8608                 kprintf("Inserting chunk for HB\n");
8609         }
8610 #endif
8611         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8612         stcb->asoc.ctrl_queue_cnt++;
8613         sctp_pegs[SCTP_HB_SENT]++;
8614         /*
8615          * Call directly med level routine to put out the chunk. It will
8616          * always tumble out control chunks aka HB but it may even tumble
8617          * out data too.
8618          */
8619         if (user_req == 0) {
8620                 /* Ok now lets start the HB timer if it is NOT a user req */
8621                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8622                                  stcb, net);
8623         }
8624         return (1);
8625 }
8626
8627 void
8628 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8629                    uint32_t high_tsn)
8630 {
8631         struct sctp_association *asoc;
8632         struct sctp_ecne_chunk *ecne;
8633         struct sctp_tmit_chunk *chk;
8634         asoc = &stcb->asoc;
8635         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8636                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8637                         /* found a previous ECN_ECHO update it if needed */
8638                         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8639                         ecne->tsn = htonl(high_tsn);
8640                         return;
8641                 }
8642         }
8643         /* nope could not find one to update so we must build one */
8644         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8645         if (chk == NULL) {
8646                 return;
8647         }
8648         sctp_pegs[SCTP_ECNE_SENT]++;
8649         sctppcbinfo.ipi_count_chunk++;
8650         sctppcbinfo.ipi_gencnt_chunk++;
8651         chk->rec.chunk_id = SCTP_ECN_ECHO;
8652         chk->asoc = &stcb->asoc;
8653         chk->send_size = sizeof(struct sctp_ecne_chunk);
8654         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8655         if (chk->data == NULL) {
8656                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8657                 sctppcbinfo.ipi_count_chunk--;
8658                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8659                         panic("Chunk count is negative");
8660                 }
8661                 sctppcbinfo.ipi_gencnt_chunk++;
8662                 return;
8663         }
8664         chk->data->m_data += SCTP_MIN_OVERHEAD;
8665         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8666         chk->sent = SCTP_DATAGRAM_UNSENT;
8667         chk->snd_count = 0;
8668         chk->whoTo = net;
8669         chk->whoTo->ref_count++;
8670         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8671         ecne->ch.chunk_type = SCTP_ECN_ECHO;
8672         ecne->ch.chunk_flags = 0;
8673         ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8674         ecne->tsn = htonl(high_tsn);
8675         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8676         asoc->ctrl_queue_cnt++;
8677 }
8678
8679 void
8680 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8681                          struct mbuf *m, int iphlen, int bad_crc)
8682 {
8683         struct sctp_association *asoc;
8684         struct sctp_pktdrop_chunk *drp;
8685         struct sctp_tmit_chunk *chk;
8686         uint8_t *datap;
8687         int len;
8688         unsigned int small_one;
8689         struct ip *iph;
8690
8691         long spc;
8692         asoc = &stcb->asoc;
8693         if (asoc->peer_supports_pktdrop == 0) {
8694                 /* peer must declare support before I
8695                  * send one.
8696                  */
8697                 return;
8698         }
8699         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8700         if (chk == NULL) {
8701                 return;
8702         }
8703         sctppcbinfo.ipi_count_chunk++;
8704         sctppcbinfo.ipi_gencnt_chunk++;
8705
8706         iph = mtod(m, struct ip *);
8707         if (iph == NULL) {
8708                 return;
8709         }
8710         if (iph->ip_v == IPVERSION) {
8711                 /* IPv4 */
8712 #if defined(__FreeBSD__)
8713                 len = chk->send_size = iph->ip_len;
8714 #else
8715                 len = chk->send_size = (iph->ip_len - iphlen);
8716 #endif
8717         } else {
8718                 struct ip6_hdr *ip6h;
8719                 /* IPv6 */
8720                 ip6h = mtod(m, struct ip6_hdr *);
8721                 len = chk->send_size = htons(ip6h->ip6_plen);
8722         }
8723         if ((len+iphlen) > m->m_pkthdr.len) {
8724                 /* huh */
8725                 chk->send_size = len = m->m_pkthdr.len - iphlen;
8726         }
8727         chk->asoc = &stcb->asoc;
8728         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8729         if (chk->data == NULL) {
8730         jump_out:
8731                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8732                 sctppcbinfo.ipi_count_chunk--;
8733                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8734                         panic("Chunk count is negative");
8735                 }
8736                 sctppcbinfo.ipi_gencnt_chunk++;
8737                 return;
8738         }
8739         if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8740                 MCLGET(chk->data, MB_DONTWAIT);
8741                 if ((chk->data->m_flags & M_EXT) == 0) {
8742                         /* Give up */
8743                         sctp_m_freem(chk->data);
8744                         chk->data = NULL;
8745                         goto jump_out;
8746                 }
8747         }
8748         chk->data->m_data += SCTP_MIN_OVERHEAD;
8749         drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8750         if (drp == NULL) {
8751                 sctp_m_freem(chk->data);
8752                 chk->data = NULL;
8753                 goto jump_out;
8754         }
8755         small_one = asoc->smallest_mtu;
8756         if (small_one > MCLBYTES) {
8757                 /* Only one cluster worth of data MAX */
8758                 small_one = MCLBYTES;
8759         }
8760         chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8761                           sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8762         if (chk->book_size > small_one) {
8763                 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8764                 drp->trunc_len = htons(chk->send_size);
8765                 chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8766                                              sizeof(struct sctp_pktdrop_chunk) +
8767                                              sizeof(struct sctphdr));
8768                 len = chk->send_size;
8769         } else {
8770                 /* no truncation needed */
8771                 drp->ch.chunk_flags = 0;
8772                 drp->trunc_len = htons(0);
8773         }
8774         if (bad_crc) {
8775                 drp->ch.chunk_flags |= SCTP_BADCRC;
8776         }
8777         chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8778         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8779         chk->sent = SCTP_DATAGRAM_UNSENT;
8780         chk->snd_count = 0;
8781         if (net) {
8782                 /* we should hit here */
8783                 chk->whoTo = net;
8784         } else {
8785                 chk->whoTo = asoc->primary_destination;
8786         }
8787         chk->whoTo->ref_count++;
8788         chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8789         drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8790         drp->ch.chunk_length = htons(chk->send_size);
8791         spc = stcb->sctp_socket->so_rcv.ssb_hiwat;
8792         if (spc < 0) {
8793                 spc = 0;
8794         }
8795         drp->bottle_bw = htonl(spc);
8796         drp->current_onq = htonl(asoc->size_on_delivery_queue +
8797                                  asoc->size_on_reasm_queue +
8798                                  asoc->size_on_all_streams +
8799                                  asoc->my_rwnd_control_len +
8800                                  stcb->sctp_socket->so_rcv.ssb_cc);
8801         drp->reserved = 0;
8802         datap = drp->data;
8803         m_copydata(m, iphlen, len, datap);
8804         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8805         asoc->ctrl_queue_cnt++;
8806 }
8807
8808 void
8809 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8810 {
8811         struct sctp_association *asoc;
8812         struct sctp_cwr_chunk *cwr;
8813         struct sctp_tmit_chunk *chk;
8814
8815         asoc = &stcb->asoc;
8816         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8817                 if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8818                         /* found a previous ECN_CWR update it if needed */
8819                         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8820                         if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8821                                               MAX_TSN)) {
8822                                 cwr->tsn = htonl(high_tsn);
8823                         }
8824                         return;
8825                 }
8826         }
8827         /* nope could not find one to update so we must build one */
8828         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8829         if (chk == NULL) {
8830                 return;
8831         }
8832         sctppcbinfo.ipi_count_chunk++;
8833         sctppcbinfo.ipi_gencnt_chunk++;
8834         chk->rec.chunk_id = SCTP_ECN_CWR;
8835         chk->asoc = &stcb->asoc;
8836         chk->send_size = sizeof(struct sctp_cwr_chunk);
8837         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8838         if (chk->data == NULL) {
8839                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8840                 sctppcbinfo.ipi_count_chunk--;
8841                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8842                         panic("Chunk count is negative");
8843                 }
8844                 sctppcbinfo.ipi_gencnt_chunk++;
8845                 return;
8846         }
8847         chk->data->m_data += SCTP_MIN_OVERHEAD;
8848         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8849         chk->sent = SCTP_DATAGRAM_UNSENT;
8850         chk->snd_count = 0;
8851         chk->whoTo = net;
8852         chk->whoTo->ref_count++;
8853         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8854         cwr->ch.chunk_type = SCTP_ECN_CWR;
8855         cwr->ch.chunk_flags = 0;
8856         cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8857         cwr->tsn = htonl(high_tsn);
8858         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8859         asoc->ctrl_queue_cnt++;
8860 }
8861 static void
8862 sctp_reset_the_streams(struct sctp_tcb *stcb,
8863      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8864 {
8865         int i;
8866
8867         if (req->reset_flags & SCTP_RESET_ALL) {
8868                 for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8869                         stcb->asoc.strmout[i].next_sequence_sent = 0;
8870                 }
8871         } else if (number_entries) {
8872                 for (i=0; i<number_entries; i++) {
8873                         if (list[i] >= stcb->asoc.streamoutcnt) {
8874                                 /* no such stream */
8875                                 continue;
8876                         }
8877                         stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8878                 }
8879         }
8880         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8881 }
8882
8883 void
8884 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8885      struct sctp_stream_reset_request *req)
8886 {
8887         struct sctp_association *asoc;
8888         struct sctp_stream_reset_resp *strack;
8889         struct sctp_tmit_chunk *chk;
8890         uint32_t seq;
8891         int number_entries, i;
8892         uint8_t two_way=0, not_peer=0;
8893         uint16_t *list=NULL;
8894
8895         asoc = &stcb->asoc;
8896         if (req->reset_flags & SCTP_RESET_ALL)
8897                 number_entries = 0;
8898         else
8899                 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8900
8901         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8902         if (chk == NULL) {
8903                 return;
8904         }
8905         sctppcbinfo.ipi_count_chunk++;
8906         sctppcbinfo.ipi_gencnt_chunk++;
8907         chk->rec.chunk_id = SCTP_STREAM_RESET;
8908         chk->asoc = &stcb->asoc;
8909         chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8910         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8911         if (chk->data == NULL) {
8912         strresp_jump_out:
8913                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8914                 sctppcbinfo.ipi_count_chunk--;
8915                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8916                         panic("Chunk count is negative");
8917                 }
8918                 sctppcbinfo.ipi_gencnt_chunk++;
8919                 return;
8920         }
8921         chk->data->m_data += SCTP_MIN_OVERHEAD;
8922         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8923         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8924                 MCLGET(chk->data, MB_DONTWAIT);
8925                 if ((chk->data->m_flags & M_EXT) == 0) {
8926                         /* Give up */
8927                         sctp_m_freem(chk->data);
8928                         chk->data = NULL;
8929                         goto strresp_jump_out;
8930                 }
8931                 chk->data->m_data += SCTP_MIN_OVERHEAD;
8932         }
8933         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8934                 /* can't do it, no room */
8935                 /* Give up */
8936                 sctp_m_freem(chk->data);
8937                 chk->data = NULL;
8938                 goto strresp_jump_out;
8939
8940         }
8941         chk->sent = SCTP_DATAGRAM_UNSENT;
8942         chk->snd_count = 0;
8943         chk->whoTo = asoc->primary_destination;
8944         chk->whoTo->ref_count++;
8945         strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8946
8947         strack->ch.chunk_type = SCTP_STREAM_RESET;
8948         strack->ch.chunk_flags = 0;
8949         strack->ch.chunk_length = htons(chk->send_size);
8950
8951         memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8952
8953         strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8954         strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8955
8956
8957
8958         if (chk->send_size % 4) {
8959                 /* need a padding for the end */
8960                 int pad;
8961                 uint8_t *end;
8962                 end = (uint8_t *)((caddr_t)strack + chk->send_size);
8963                 pad = chk->send_size % 4;
8964                 for (i = 0; i < pad; i++) {
8965                         end[i] = 0;
8966                 }
8967                 chk->send_size += pad;
8968         }
8969
8970         /* actual response */
8971         if (req->reset_flags & SCTP_RESET_YOUR) {
8972                 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8973         } else {
8974                 strack->sr_resp.reset_flags = 0;
8975         }
8976
8977         /* copied from reset request */
8978         strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8979         seq = ntohl(req->reset_req_seq);
8980
8981         list = req->list_of_streams;
8982         /* copy the un-converted network byte order streams */
8983         for (i=0; i<number_entries; i++) {
8984                 strack->sr_resp.list_of_streams[i] = list[i];
8985         }
8986         if (asoc->str_reset_seq_in == seq) {
8987                 /* is it the next expected? */
8988                 asoc->str_reset_seq_in++;
8989                 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8990                 asoc->str_reset_sending_seq = asoc->sending_seq;
8991                 if (number_entries) {
8992                         int i;
8993                         uint16_t temp;
8994                         /* convert them to host byte order */
8995                         for (i=0 ; i<number_entries; i++) {
8996                                 temp = ntohs(list[i]);
8997                                 list[i] = temp;
8998                         }
8999                 }
9000                 if (req->reset_flags & SCTP_RESET_YOUR) {
9001                         /* reset my outbound streams */
9002                         sctp_reset_the_streams(stcb, req , number_entries, list);
9003                 }
9004                 if (req->reset_flags & SCTP_RECIPRICAL) {
9005                         /* reset peer too */
9006                         sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
9007                 }
9008
9009         } else {
9010                 /* no its a retran so I must just ack and do nothing */
9011                 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
9012         }
9013         strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
9014         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9015                           chk,
9016                           sctp_next);
9017         asoc->ctrl_queue_cnt++;
9018 }
9019
9020
9021 void
9022 sctp_send_str_reset_req(struct sctp_tcb *stcb,
9023      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
9024 {
9025         /* Send a stream reset request. The number_entrys may be 0 and list NULL
9026          * if the request is to reset all streams. If two_way is true then we
9027          * not only request a RESET of the received streams but we also
9028          * request the peer to send a reset req to us too.
9029          * Flag combinations in table:
9030          *
9031          *       two_way | not_peer  | = | Flags
9032          *       ------------------------------
9033          *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
9034          *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
9035          *         0     |    1      | = | Not a Valid Request (not anyone)
9036          *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
9037          */
9038         struct sctp_association *asoc;
9039         struct sctp_stream_reset_req *strreq;
9040         struct sctp_tmit_chunk *chk;
9041
9042
9043         asoc = &stcb->asoc;
9044         if (asoc->stream_reset_outstanding) {
9045                 /* Already one pending, must get ACK back
9046                  * to clear the flag.
9047                  */
9048                 return;
9049         }
9050
9051         if ((two_way == 0) && (not_peer == 1)) {
9052                 /* not a valid request */
9053                 return;
9054         }
9055
9056         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9057         if (chk == NULL) {
9058                 return;
9059         }
9060         sctppcbinfo.ipi_count_chunk++;
9061         sctppcbinfo.ipi_gencnt_chunk++;
9062         chk->rec.chunk_id = SCTP_STREAM_RESET;
9063         chk->asoc = &stcb->asoc;
9064         chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
9065         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
9066         if (chk->data == NULL) {
9067         strreq_jump_out:
9068                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9069                 sctppcbinfo.ipi_count_chunk--;
9070                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9071                         panic("Chunk count is negative");
9072                 }
9073                 sctppcbinfo.ipi_gencnt_chunk++;
9074                 return;
9075         }
9076         chk->data->m_data += SCTP_MIN_OVERHEAD;
9077         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
9078         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9079                 MCLGET(chk->data, MB_DONTWAIT);
9080                 if ((chk->data->m_flags & M_EXT) == 0) {
9081                         /* Give up */
9082                         sctp_m_freem(chk->data);
9083                         chk->data = NULL;
9084                         goto strreq_jump_out;
9085                 }
9086                 chk->data->m_data += SCTP_MIN_OVERHEAD;
9087         }
9088         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9089                 /* can't do it, no room */
9090                 /* Give up */
9091                 sctp_m_freem(chk->data);
9092                 chk->data = NULL;
9093                 goto strreq_jump_out;
9094         }
9095         chk->sent = SCTP_DATAGRAM_UNSENT;
9096         chk->snd_count = 0;
9097         chk->whoTo = asoc->primary_destination;
9098         chk->whoTo->ref_count++;
9099
9100         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
9101         strreq->ch.chunk_type = SCTP_STREAM_RESET;
9102         strreq->ch.chunk_flags = 0;
9103         strreq->ch.chunk_length = htons(chk->send_size);
9104
9105         strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
9106         strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
9107
9108         if (chk->send_size % 4) {
9109                 /* need a padding for the end */
9110                 int pad, i;
9111                 uint8_t *end;
9112                 end = (uint8_t *)((caddr_t)strreq + chk->send_size);
9113                 pad = chk->send_size % 4;
9114                 for (i=0; i<pad; i++) {
9115                         end[i] = 0;
9116                 }
9117                 chk->send_size += pad;
9118         }
9119
9120         strreq->sr_req.reset_flags = 0;
9121         if (number_entrys == 0) {
9122                 strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
9123         }
9124         if (two_way == 0) {
9125                 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
9126         } else {
9127                 if (not_peer == 0) {
9128                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
9129                 } else {
9130                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
9131                 }
9132         }
9133         memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
9134         strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
9135         if (number_entrys) {
9136                 /* populate the specific entry's */
9137                 int i;
9138                 for (i=0; i < number_entrys; i++) {
9139                         strreq->sr_req.list_of_streams[i] = htons(list[i]);
9140                 }
9141         }
9142         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9143                           chk,
9144                           sctp_next);
9145         asoc->ctrl_queue_cnt++;
9146         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
9147         asoc->stream_reset_outstanding = 1;
9148 }
9149
9150 void
9151 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
9152     struct mbuf *err_cause)
9153 {
9154         /*
9155          * Formulate the abort message, and send it back down.
9156          */
9157         struct mbuf *mout;
9158         struct sctp_abort_msg *abm;
9159         struct ip *iph, *iph_out;
9160         struct ip6_hdr *ip6, *ip6_out;
9161         int iphlen_out;
9162
9163         /* don't respond to ABORT with ABORT */
9164         if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
9165                 if (err_cause)
9166                         sctp_m_freem(err_cause);
9167                 return;
9168         }
9169         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
9170         if (mout == NULL) {
9171                 if (err_cause)
9172                         sctp_m_freem(err_cause);
9173                 return;
9174         }
9175         iph = mtod(m, struct ip *);
9176         iph_out = NULL;
9177         ip6_out = NULL;
9178         if (iph->ip_v == IPVERSION) {
9179                 iph_out = mtod(mout, struct ip *);
9180                 mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9181                 mout->m_next = err_cause;
9182
9183                 /* Fill in the IP header for the ABORT */
9184                 iph_out->ip_v = IPVERSION;
9185                 iph_out->ip_hl = (sizeof(struct ip) / 4);
9186                 iph_out->ip_tos = (u_char)0;
9187                 iph_out->ip_id = 0;
9188                 iph_out->ip_off = 0;
9189                 iph_out->ip_ttl = MAXTTL;
9190                 iph_out->ip_p = IPPROTO_SCTP;
9191                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9192                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9193                 /* let IP layer calculate this */
9194                 iph_out->ip_sum = 0;
9195
9196                 iphlen_out = sizeof(*iph_out);
9197                 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
9198         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9199                 ip6 = (struct ip6_hdr *)iph;
9200                 ip6_out = mtod(mout, struct ip6_hdr *);
9201                 mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9202                 mout->m_next = err_cause;
9203
9204                 /* Fill in the IP6 header for the ABORT */
9205                 ip6_out->ip6_flow = ip6->ip6_flow;
9206                 ip6_out->ip6_hlim = ip6_defhlim;
9207                 ip6_out->ip6_nxt = IPPROTO_SCTP;
9208                 ip6_out->ip6_src = ip6->ip6_dst;
9209                 ip6_out->ip6_dst = ip6->ip6_src;
9210
9211                 iphlen_out = sizeof(*ip6_out);
9212                 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
9213         } else {
9214                 /* Currently not supported */
9215                 return;
9216         }
9217
9218         abm->sh.src_port = sh->dest_port;
9219         abm->sh.dest_port = sh->src_port;
9220         abm->sh.checksum = 0;
9221         if (vtag == 0) {
9222                 abm->sh.v_tag = sh->v_tag;
9223                 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9224         } else {
9225                 abm->sh.v_tag = htonl(vtag);
9226                 abm->msg.ch.chunk_flags = 0;
9227         }
9228         abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9229
9230         if (err_cause) {
9231                 struct mbuf *m_tmp = err_cause;
9232                 int err_len = 0;
9233                 /* get length of the err_cause chain */
9234                 while (m_tmp != NULL) {
9235                         err_len += m_tmp->m_len;
9236                         m_tmp = m_tmp->m_next;
9237                 }
9238                 mout->m_pkthdr.len = mout->m_len + err_len;
9239                 if (err_len % 4) {
9240                         /* need pad at end of chunk */
9241                         u_int32_t cpthis=0;
9242                         int padlen;
9243                         padlen = 4 - (mout->m_pkthdr.len % 4);
9244                         m_copyback(mout, mout->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9245                 }
9246                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9247         } else {
9248                 mout->m_pkthdr.len = mout->m_len;
9249                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9250         }
9251
9252         /* add checksum */
9253         if ((sctp_no_csum_on_loopback) &&
9254            (m->m_pkthdr.rcvif) &&
9255            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9256                 abm->sh.checksum =  0;
9257         } else {
9258                 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9259         }
9260
9261         /* zap the rcvif, it should be null */
9262         mout->m_pkthdr.rcvif = 0;
9263         if (iph_out != NULL) {
9264                 struct route ro;
9265
9266                 /* zap the stack pointer to the route */
9267                 bzero(&ro, sizeof ro);
9268 #ifdef SCTP_DEBUG
9269                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9270                         kprintf("sctp_send_abort calling ip_output:\n");
9271                         sctp_print_address_pkt(iph_out, &abm->sh);
9272                 }
9273 #endif
9274                 /* set IPv4 length */
9275 #if defined(__FreeBSD__)
9276                 iph_out->ip_len = mout->m_pkthdr.len;
9277 #else
9278                 iph_out->ip_len = htons(mout->m_pkthdr.len);
9279 #endif
9280                 /* out it goes */
9281                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
9282 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9283     || defined(__NetBSD__) || defined(__DragonFly__)
9284                     , NULL
9285 #endif
9286                     );
9287                 /* Free the route if we got one back */
9288                 if (ro.ro_rt)
9289                         RTFREE(ro.ro_rt);
9290         } else if (ip6_out != NULL) {
9291 #ifdef NEW_STRUCT_ROUTE
9292                 struct route ro;
9293 #else
9294                 struct route_in6 ro;
9295 #endif
9296
9297                 /* zap the stack pointer to the route */
9298                 bzero(&ro, sizeof(ro));
9299 #ifdef SCTP_DEBUG
9300                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9301                         kprintf("sctp_send_abort calling ip6_output:\n");
9302                         sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9303                 }
9304 #endif
9305                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
9306 #if defined(__NetBSD__)
9307                         , NULL
9308 #endif
9309 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9310                     , NULL
9311 #endif
9312                     );
9313                 /* Free the route if we got one back */
9314                 if (ro.ro_rt)
9315                         RTFREE(ro.ro_rt);
9316         }
9317         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9318 }
9319
9320 void
9321 sctp_send_operr_to(struct mbuf *m, int iphlen,
9322                    struct mbuf *scm,
9323                    uint32_t vtag)
9324 {
9325         struct sctphdr *ihdr;
9326         int retcode;
9327         struct sctphdr *ohdr;
9328         struct sctp_chunkhdr *ophdr;
9329
9330         struct ip *iph;
9331 #ifdef SCTP_DEBUG
9332         struct sockaddr_in6 lsa6, fsa6;
9333 #endif
9334         uint32_t val;
9335         iph = mtod(m, struct ip *);
9336         ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
9337         if (!(scm->m_flags & M_PKTHDR)) {
9338                 /* must be a pkthdr */
9339                 kprintf("Huh, not a packet header in send_operr\n");
9340                 m_freem(scm);
9341                 return;
9342         }
9343         M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), MB_DONTWAIT);
9344         if (scm == NULL) {
9345                 /* can't send because we can't add a mbuf */
9346                 return;
9347         }
9348         ohdr = mtod(scm, struct sctphdr *);
9349         ohdr->src_port = ihdr->dest_port;
9350         ohdr->dest_port = ihdr->src_port;
9351         ohdr->v_tag = vtag;
9352         ohdr->checksum = 0;
9353         ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9354         ophdr->chunk_type = SCTP_OPERATION_ERROR;
9355         ophdr->chunk_flags = 0;
9356         ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9357         if (scm->m_pkthdr.len % 4) {
9358                 /* need padding */
9359                 u_int32_t cpthis=0;
9360                 int padlen;
9361                 padlen = 4 - (scm->m_pkthdr.len % 4);
9362                 m_copyback(scm, scm->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9363         }
9364         if ((sctp_no_csum_on_loopback) &&
9365             (m->m_pkthdr.rcvif) &&
9366             (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9367                 val = 0;
9368         } else {
9369                 val = sctp_calculate_sum(scm, NULL, 0);
9370         }
9371         ohdr->checksum = val;
9372         if (iph->ip_v == IPVERSION) {
9373                 /* V4 */
9374                 struct ip *out;
9375                 struct route ro;
9376                 M_PREPEND(scm, sizeof(struct ip), MB_DONTWAIT);
9377                 if (scm == NULL)
9378                         return;
9379                 bzero(&ro, sizeof ro);
9380                 out = mtod(scm, struct ip *);
9381                 out->ip_v = iph->ip_v;
9382                 out->ip_hl = (sizeof(struct ip)/4);
9383                 out->ip_tos = iph->ip_tos;
9384                 out->ip_id = iph->ip_id;
9385                 out->ip_off = 0;
9386                 out->ip_ttl = MAXTTL;
9387                 out->ip_p = IPPROTO_SCTP;
9388                 out->ip_sum = 0;
9389                 out->ip_src = iph->ip_dst;
9390                 out->ip_dst = iph->ip_src;
9391 #if defined(__FreeBSD__)
9392                 out->ip_len = scm->m_pkthdr.len;
9393 #else
9394                 out->ip_len = htons(scm->m_pkthdr.len);
9395 #endif
9396                 retcode = ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL
9397 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9398     || defined(__NetBSD__) || defined(__DragonFly__)
9399                     , NULL
9400 #endif
9401                         );
9402                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9403                 /* Free the route if we got one back */
9404                 if (ro.ro_rt)
9405                         RTFREE(ro.ro_rt);
9406         } else {
9407                 /* V6 */
9408 #ifdef NEW_STRUCT_ROUTE
9409                 struct route ro;
9410 #else
9411                 struct route_in6 ro;
9412 #endif
9413                 struct ip6_hdr *out6, *in6;
9414
9415                 M_PREPEND(scm, sizeof(struct ip6_hdr), MB_DONTWAIT);
9416                 if (scm == NULL)
9417                         return;
9418                 bzero(&ro, sizeof ro);
9419                 in6 = mtod(m, struct ip6_hdr *);
9420                 out6 = mtod(scm, struct ip6_hdr *);
9421                 out6->ip6_flow = in6->ip6_flow;
9422                 out6->ip6_hlim = ip6_defhlim;
9423                 out6->ip6_nxt = IPPROTO_SCTP;
9424                 out6->ip6_src = in6->ip6_dst;
9425                 out6->ip6_dst = in6->ip6_src;
9426
9427 #ifdef SCTP_DEBUG
9428                 bzero(&lsa6, sizeof(lsa6));
9429                 lsa6.sin6_len = sizeof(lsa6);
9430                 lsa6.sin6_family = AF_INET6;
9431                 lsa6.sin6_addr = out6->ip6_src;
9432                 bzero(&fsa6, sizeof(fsa6));
9433                 fsa6.sin6_len = sizeof(fsa6);
9434                 fsa6.sin6_family = AF_INET6;
9435                 fsa6.sin6_addr = out6->ip6_dst;
9436                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9437                         kprintf("sctp_operr_to calling ipv6 output:\n");
9438                         kprintf("src: ");
9439                         sctp_print_address((struct sockaddr *)&lsa6);
9440                         kprintf("dst ");
9441                         sctp_print_address((struct sockaddr *)&fsa6);
9442                 }
9443 #endif /* SCTP_DEBUG */
9444                 ip6_output(scm, NULL, &ro, 0, NULL, NULL
9445 #if defined(__NetBSD__)
9446             , NULL
9447 #endif
9448 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9449             , NULL
9450 #endif
9451                 );
9452                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9453                 /* Free the route if we got one back */
9454                 if (ro.ro_rt)
9455                         RTFREE(ro.ro_rt);
9456         }
9457 }
9458
9459 static int
9460 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9461 {
9462         int left, cancpy, willcpy, error;
9463         left = cpsz;
9464
9465         if (m == NULL) {
9466                 /* TSNH */
9467                 *mbcnt = 0;
9468                 return (ENOMEM);
9469         }
9470         m->m_len = 0;
9471         if ((left+resv_upfront) > (int)MHLEN) {
9472                 MCLGET(m, MB_WAIT);
9473                 if (m == NULL) {
9474                         *mbcnt = 0;
9475                         return (ENOMEM);
9476                 }
9477                 if ((m->m_flags & M_EXT) == 0) {
9478                         *mbcnt = 0;
9479                         return (ENOMEM);
9480                 }
9481                 *mbcnt += m->m_ext.ext_size;
9482         }
9483         *mbcnt += MSIZE;
9484         cancpy = M_TRAILINGSPACE(m);
9485         willcpy = min(cancpy, left);
9486         if ((willcpy + resv_upfront) > cancpy) {
9487                 willcpy -= resv_upfront;
9488         }
9489         while (left > 0) {
9490                 /* Align data to the end */
9491                 if ((m->m_flags & M_EXT) == 0) {
9492                         if (m->m_flags & M_PKTHDR) {
9493                                 MH_ALIGN(m, willcpy);
9494                         } else {
9495                                 M_ALIGN(m, willcpy);
9496                         }
9497                 } else {
9498                         MC_ALIGN(m, willcpy);
9499                 }
9500                 error = uiomove(mtod(m, caddr_t), willcpy, uio);
9501                 if (error) {
9502                         return (error);
9503                 }
9504                 m->m_len = willcpy;
9505                 m->m_nextpkt = 0;
9506                 left -= willcpy;
9507                 if (left > 0) {
9508                         MGET(m->m_next, MB_WAIT, MT_DATA);
9509                         if (m->m_next == NULL) {
9510                                 *mbcnt = 0;
9511                                 return (ENOMEM);
9512                         }
9513                         m = m->m_next;
9514                         m->m_len = 0;
9515                         *mbcnt += MSIZE;
9516                         if (left > (int)MHLEN) {
9517                                 MCLGET(m, MB_WAIT);
9518                                 if (m == NULL) {
9519                                         *mbcnt = 0;
9520                                         return (ENOMEM);
9521                                 }
9522                                 if ((m->m_flags & M_EXT) == 0) {
9523                                         *mbcnt = 0;
9524                                         return (ENOMEM);
9525                                 }
9526                                 *mbcnt += m->m_ext.ext_size;
9527                         }
9528                         cancpy = M_TRAILINGSPACE(m);
9529                         willcpy = min(cancpy, left);
9530                 }
9531         }
9532         return (0);
9533 }
9534
9535 static int
9536 sctp_copy_it_in(struct sctp_inpcb *inp,
9537                 struct sctp_tcb *stcb,
9538                 struct sctp_association *asoc,
9539                 struct sctp_nets *net,
9540                 struct sctp_sndrcvinfo *srcv,
9541                 struct uio *uio,
9542                 int flags)
9543 {
9544         /* This routine must be very careful in
9545          * its work. Protocol processing is
9546          * up and running so care must be taken to
9547          * spl...() when you need to do something
9548          * that may effect the stcb/asoc. The sb is
9549          * locked however. When data is copied the
9550          * protocol processing should be enabled since
9551          * this is a slower operation...
9552          */
9553         struct socket *so;
9554         int error = 0;
9555         int frag_size, mbcnt = 0, mbcnt_e = 0;
9556         unsigned int sndlen;
9557         unsigned int tot_demand;
9558         int tot_out, dataout;
9559         struct sctp_tmit_chunk *chk;
9560         struct mbuf *mm;
9561         struct sctp_stream_out *strq;
9562         uint32_t my_vtag;
9563         int resv_in_first;
9564
9565         crit_enter();
9566         so = stcb->sctp_socket;
9567         chk = NULL;
9568         mm = NULL;
9569
9570         sndlen = uio->uio_resid;
9571         /* lock the socket buf */
9572         SOCKBUF_LOCK(&so->so_snd);
9573         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
9574         if (error)
9575                 goto out_locked;
9576
9577         /* will it ever fit ? */
9578         if (sndlen > so->so_snd.ssb_hiwat) {
9579                 /* It will NEVER fit */
9580                 error = EMSGSIZE;
9581                 crit_exit();
9582                 goto release;
9583         }
9584         /* Do I need to block? */
9585         if ((so->so_snd.ssb_hiwat <
9586             (sndlen + asoc->total_output_queue_size)) ||
9587             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9588             (asoc->total_output_mbuf_queue_size >
9589             so->so_snd.ssb_mbmax)
9590         ) {
9591                 /* prune any prsctp bufs out */
9592                 if (asoc->peer_supports_prsctp) {
9593                         sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9594                 }
9595                 /*
9596                  * We store off a pointer to the endpoint.
9597                  * Since on return from this we must check to
9598                  * see if an so_error is set. If so we may have
9599                  * been reset and our stcb destroyed. Returning
9600                  * an error will flow back to the user...
9601                  */
9602                 while ((so->so_snd.ssb_hiwat <
9603                     (sndlen + asoc->total_output_queue_size)) ||
9604                     (asoc->chunks_on_out_queue >
9605                     sctp_max_chunks_on_queue) ||
9606                     (asoc->total_output_mbuf_queue_size >
9607                     so->so_snd.ssb_mbmax)
9608                 ) {
9609                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
9610                                 /* Non-blocking io in place */
9611                                 error = EWOULDBLOCK;
9612                                 goto release;
9613                         }
9614                         inp->sctp_tcb_at_block = (void *)stcb;
9615                         inp->error_on_block = 0;
9616 #ifdef SCTP_BLK_LOGGING
9617                         sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9618                             so, asoc);
9619 #endif
9620                         ssb_unlock(&so->so_snd);
9621                         SCTP_TCB_UNLOCK(stcb);
9622                         error = ssb_wait(&so->so_snd);
9623                         SCTP_INP_RLOCK(inp);
9624                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9625                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9626                                 /* Should I really unlock ? */
9627                                 SCTP_INP_RUNLOCK(inp);
9628                                 error = EFAULT;
9629                                 goto out_locked;
9630                         }
9631                         SCTP_TCB_LOCK(stcb);
9632                         SCTP_INP_RUNLOCK(inp);
9633
9634                         inp->sctp_tcb_at_block = 0;
9635 #ifdef SCTP_BLK_LOGGING
9636                         sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9637                             so, asoc);
9638 #endif
9639                         if (inp->error_on_block) {
9640                                 /*
9641                                  * if our asoc was killed, the free code
9642                                  * (in sctp_pcb.c) will save a error in
9643                                  * here for us
9644                                  */
9645                                 error = inp->error_on_block;
9646                                 crit_exit();
9647                                 goto out_locked;
9648                         }
9649                         if (error) {
9650                                 crit_exit();
9651                                 goto out_locked;
9652                         }
9653                         /* did we encounter a socket error? */
9654                         if (so->so_error) {
9655                                 error = so->so_error;
9656                                 crit_exit();
9657                                 goto out_locked;
9658                         }
9659                         error = ssb_lock(&so->so_snd, M_WAITOK);
9660                         if (error) {
9661                                 /* Can't acquire the lock */
9662                                 crit_exit();
9663                                 goto out_locked;
9664                         }
9665 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9666                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9667 #else
9668                         if (so->so_state & SS_CANTSENDMORE) {
9669 #endif
9670                                 /* The socket is now set not to sendmore.. its gone */
9671                                 error = EPIPE;
9672                                 crit_exit();
9673                                 goto release;
9674                         }
9675                         if (so->so_error) {
9676                                 error = so->so_error;
9677                                 crit_exit();
9678                                 goto release;
9679                         }
9680                         if (asoc->peer_supports_prsctp) {
9681                                 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9682                         }
9683                 }
9684         }
9685         dataout = tot_out = uio->uio_resid;
9686         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9687                 resv_in_first = SCTP_MED_OVERHEAD;
9688         } else {
9689                 resv_in_first = SCTP_MED_V4_OVERHEAD;
9690         }
9691
9692         /* Are we aborting? */
9693         if (srcv->sinfo_flags & MSG_ABORT) {
9694                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9695                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9696                         /* It has to be up before we abort */
9697                         /* how big is the user initiated abort? */
9698
9699                         /* I wonder about doing a MGET without a splnet set.
9700                          * it is done that way in the sosend code so I guess
9701                          * it is ok :-0
9702                          */
9703                         MGETHDR(mm, MB_WAIT, MT_DATA);
9704                         if (mm) {
9705                                 struct sctp_paramhdr *ph;
9706
9707                                 tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9708                                 if (tot_demand > MHLEN) {
9709                                         if (tot_demand > MCLBYTES) {
9710                                                 /* truncate user data */
9711                                                 tot_demand = MCLBYTES;
9712                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9713                                         }
9714                                         MCLGET(mm, MB_WAIT);
9715                                         if ((mm->m_flags & M_EXT) == 0) {
9716                                                 /* truncate further */
9717                                                 tot_demand = MHLEN;
9718                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9719                                         }
9720                                 }
9721                                 /* now move forward the data pointer */
9722                                 ph = mtod(mm, struct sctp_paramhdr *);
9723                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9724                                 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9725                                 ph++;
9726                                 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9727                                 mm->m_len = mm->m_pkthdr.len;
9728                                 error = uiomove((caddr_t)ph, (int)tot_out, uio);
9729                                 if (error) {
9730                                         /*
9731                                          * Here if we can't get his data we
9732                                          * still abort we just don't get to
9733                                          * send the users note :-0
9734                                          */
9735                                         sctp_m_freem(mm);
9736                                         mm = NULL;
9737                                 }
9738                         }
9739                         ssb_unlock(&so->so_snd);
9740                         SOCKBUF_UNLOCK(&so->so_snd);
9741                         sctp_abort_an_association(stcb->sctp_ep, stcb,
9742                                                   SCTP_RESPONSE_TO_USER_REQ,
9743                                                   mm);
9744                         mm = NULL;
9745                         crit_exit();
9746                         goto out_notlocked;
9747                 }
9748                 crit_exit();
9749                 goto release;
9750         }
9751
9752         /* Now can we send this? */
9753         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9754             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9755             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9756             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9757                 /* got data while shutting down */
9758                 error = ECONNRESET;
9759                 crit_exit();
9760                 goto release;
9761         }
9762         /* Is the stream no. valid? */
9763         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9764                 /* Invalid stream number */
9765                 error = EINVAL;
9766                 crit_exit();
9767                 goto release;
9768         }
9769         if (asoc->strmout == NULL) {
9770                 /* huh? software error */
9771 #ifdef SCTP_DEBUG
9772                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9773                         kprintf("software error in sctp_copy_it_in\n");
9774                 }
9775 #endif
9776                 error = EFAULT;
9777                 crit_exit();
9778                 goto release;
9779         }
9780         if ((srcv->sinfo_flags & MSG_EOF) &&
9781             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9782             (tot_out == 0)) {
9783                 crit_exit();
9784                 goto zap_by_it_now;
9785         }
9786         if (tot_out == 0) {
9787                 /* not allowed */
9788                 error = EMSGSIZE;
9789                 crit_exit();
9790                 goto release;
9791         }
9792         /* save off the tag */
9793         my_vtag = asoc->my_vtag;
9794         strq = &asoc->strmout[srcv->sinfo_stream];
9795         /* First lets figure out the "chunking" point */
9796         frag_size = sctp_get_frag_point(stcb, asoc);
9797
9798         /* two choices here, it all fits in one chunk or
9799          * we need multiple chunks.
9800          */
9801         crit_exit();
9802         SOCKBUF_UNLOCK(&so->so_snd);
9803         if (tot_out <= frag_size) {
9804                 /* no need to setup a template */
9805                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9806                 if (chk == NULL) {
9807                         error = ENOMEM;
9808                         SOCKBUF_LOCK(&so->so_snd);
9809                         goto release;
9810                 }
9811                 sctppcbinfo.ipi_count_chunk++;
9812                 sctppcbinfo.ipi_gencnt_chunk++;
9813                 asoc->chunks_on_out_queue++;
9814                 MGETHDR(mm, MB_WAIT, MT_DATA);
9815                 if (mm == NULL) {
9816                         error = ENOMEM;
9817                         goto clean_up;
9818                 }
9819                 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9820                 if (error)
9821                         goto clean_up;
9822                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9823                 chk->mbcnt = mbcnt_e;
9824                 mbcnt += mbcnt_e;
9825                 mbcnt_e = 0;
9826                 mm->m_pkthdr.len = tot_out;
9827                 chk->data = mm;
9828                 mm = NULL;
9829
9830                 /* the actual chunk flags */
9831                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9832                 chk->whoTo->ref_count++;
9833
9834                 /* fix up the send_size if it is not present */
9835                 chk->send_size = tot_out;
9836                 chk->book_size = chk->send_size;
9837                 /* ok, we are commited */
9838                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9839                         /* bump the ssn if we are unordered. */
9840                         strq->next_sequence_sent++;
9841                 }
9842                 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9843                         asoc->sent_queue_cnt_removeable++;
9844                 }
9845                 crit_enter();
9846                 if ((asoc->state == 0) ||
9847                     (my_vtag != asoc->my_vtag) ||
9848                     (so != inp->sctp_socket) ||
9849                     (inp->sctp_socket == 0)) {
9850                         /* connection was aborted */
9851                         crit_exit();
9852                         error = ECONNRESET;
9853                         goto clean_up;
9854                 }
9855                 asoc->stream_queue_cnt++;
9856                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9857                 /* now check if this stream is on the wheel */
9858                 if ((strq->next_spoke.tqe_next == NULL) &&
9859                     (strq->next_spoke.tqe_prev == NULL)) {
9860                         /* Insert it on the wheel since it is not
9861                          * on it currently
9862                          */
9863                         sctp_insert_on_wheel(asoc, strq);
9864                 }
9865                 crit_exit();
9866 clean_up:
9867                 if (error) {
9868                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9869                         sctppcbinfo.ipi_count_chunk--;
9870                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9871                                 panic("Chunk count is negative");
9872                         }
9873                         SOCKBUF_LOCK(&so->so_snd);
9874                         goto release;
9875                 }
9876         } else {
9877                 /* we need to setup a template */
9878                 struct sctp_tmit_chunk template;
9879                 struct sctpchunk_listhead tmp;
9880
9881                 /* setup the template */
9882                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9883
9884                 /* Prepare the temp list */
9885                 TAILQ_INIT(&tmp);
9886
9887                 /* Template is complete, now time for the work */
9888                 while (tot_out > 0) {
9889                         /* Get a chunk */
9890                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9891                         if (chk == NULL) {
9892                                 /*
9893                                  * ok we must spin through and dump anything
9894                                  * we have allocated and then jump to the
9895                                  * no_membad
9896                                  */
9897                                 error = ENOMEM;
9898                         }
9899                         sctppcbinfo.ipi_count_chunk++;
9900                         asoc->chunks_on_out_queue++;
9901
9902                         sctppcbinfo.ipi_gencnt_chunk++;
9903                         *chk = template;
9904                         chk->whoTo->ref_count++;
9905                         MGETHDR(chk->data, MB_WAIT, MT_DATA);
9906                         if (chk->data == NULL) {
9907                                 error = ENOMEM;
9908                                 goto temp_clean_up;
9909                         }
9910                         tot_demand = min(tot_out, frag_size);
9911                         error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9912                         if (error)
9913                                 goto temp_clean_up;
9914                         /* now fix the chk->send_size */
9915                         chk->mbcnt = mbcnt_e;
9916                         mbcnt += mbcnt_e;
9917                         mbcnt_e = 0;
9918                         chk->send_size = tot_demand;
9919                         chk->data->m_pkthdr.len = tot_demand;
9920                         chk->book_size = chk->send_size;
9921                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9922                                 asoc->sent_queue_cnt_removeable++;
9923                         }
9924                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9925                         tot_out -= tot_demand;
9926                 }
9927                 /* Now the tmp list holds all chunks and data */
9928                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9929                         /* bump the ssn if we are unordered. */
9930                         strq->next_sequence_sent++;
9931                 }
9932                 /* Mark the first/last flags. This will
9933                  * result int a 3 for a single item on the list
9934                  */
9935                 chk = TAILQ_FIRST(&tmp);
9936                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9937                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9938                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9939
9940                 /* now move it to the streams actual queue */
9941                 /* first stop protocol processing */
9942                 crit_enter();
9943                 if ((asoc->state == 0) ||
9944                     (my_vtag != asoc->my_vtag) ||
9945                     (so != inp->sctp_socket) ||
9946                     (inp->sctp_socket == 0)) {
9947                         /* connection was aborted */
9948                         crit_exit();
9949                         error = ECONNRESET;
9950                         goto temp_clean_up;
9951                 }
9952                 chk = TAILQ_FIRST(&tmp);
9953                 while (chk) {
9954                         chk->data->m_nextpkt = 0;
9955                         TAILQ_REMOVE(&tmp, chk, sctp_next);
9956                         asoc->stream_queue_cnt++;
9957                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9958                         chk = TAILQ_FIRST(&tmp);
9959                 }
9960                 /* now check if this stream is on the wheel */
9961                 if ((strq->next_spoke.tqe_next == NULL) &&
9962                     (strq->next_spoke.tqe_prev == NULL)) {
9963                         /* Insert it on the wheel since it is not
9964                          * on it currently
9965                          */
9966                         sctp_insert_on_wheel(asoc, strq);
9967                 }
9968                 /* Ok now we can allow pping */
9969                 crit_exit();
9970 temp_clean_up:
9971                 if (error) {
9972                         SOCKBUF_LOCK(&so->so_snd);
9973                         chk = TAILQ_FIRST(&tmp);
9974                         while (chk) {
9975                                 if (chk->data) {
9976                                         sctp_m_freem(chk->data);
9977                                         chk->data = NULL;
9978                                 }
9979                                 TAILQ_REMOVE(&tmp, chk, sctp_next);
9980                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9981                                 sctppcbinfo.ipi_count_chunk--;
9982                                 asoc->chunks_on_out_queue--;
9983                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9984                                         panic("Chunk count is negative");
9985                                 }
9986                                 sctppcbinfo.ipi_gencnt_chunk++;
9987                                 chk = TAILQ_FIRST(&tmp);
9988                         }
9989                         goto release;
9990                 }
9991         }
9992 zap_by_it_now:
9993 #ifdef SCTP_MBCNT_LOGGING
9994         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9995                        asoc->total_output_queue_size,
9996                        dataout,
9997                        asoc->total_output_mbuf_queue_size,
9998                        mbcnt);
9999 #endif
10000         crit_enter();
10001         SOCKBUF_LOCK(&so->so_snd);
10002         asoc->total_output_queue_size += dataout;
10003         asoc->total_output_mbuf_queue_size += mbcnt;
10004         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
10005             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
10006                 so->so_snd.ssb_cc += dataout;
10007                 so->so_snd.ssb_mbcnt += mbcnt;
10008         }
10009         if ((srcv->sinfo_flags & MSG_EOF) &&
10010             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
10011                 ) {
10012                 int some_on_streamwheel = 0;
10013                 error = 0;
10014                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
10015                         /* Check to see if some data queued */
10016                         struct sctp_stream_out *outs;
10017                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
10018                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
10019                                         some_on_streamwheel = 1;
10020                                         break;
10021                                 }
10022                         }
10023                 }
10024                 if (TAILQ_EMPTY(&asoc->send_queue) &&
10025                     TAILQ_EMPTY(&asoc->sent_queue) &&
10026                     (some_on_streamwheel == 0)) {
10027                         /* there is nothing queued to send, so I'm done... */
10028                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
10029                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
10030                                 /* only send SHUTDOWN the first time through */
10031 #ifdef SCTP_DEBUG
10032                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
10033                                         kprintf("%s:%d sends a shutdown\n",
10034                                                __FILE__,
10035                                                __LINE__
10036                                                 );
10037                                 }
10038 #endif
10039                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
10040                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
10041                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
10042                                                  asoc->primary_destination);
10043                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
10044                                                  asoc->primary_destination);
10045                         }
10046                 } else {
10047                         /*
10048                          * we still got (or just got) data to send, so set
10049                          * SHUTDOWN_PENDING
10050                          */
10051                         /*
10052                          * XXX sockets draft says that MSG_EOF should be sent
10053                          * with no data.  currently, we will allow user data
10054                          * to be sent first and move to SHUTDOWN-PENDING
10055                          */
10056                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
10057                 }
10058         }
10059         crit_exit();
10060 #ifdef SCTP_DEBUG
10061         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
10062                 kprintf("++total out:%d total_mbuf_out:%d\n",
10063                        (int)asoc->total_output_queue_size,
10064                        (int)asoc->total_output_mbuf_queue_size);
10065         }
10066 #endif
10067
10068 release:
10069         ssb_unlock(&so->so_snd);
10070 out_locked:
10071         SOCKBUF_UNLOCK(&so->so_snd);
10072 out_notlocked:
10073         if (mm)
10074                 sctp_m_freem(mm);
10075         return (error);
10076 }
10077
10078
10079 int
10080 sctp_sosend(struct socket *so,
10081 #ifdef __NetBSD__
10082             struct mbuf *addr_mbuf,
10083 #else
10084             struct sockaddr *addr,
10085 #endif
10086             struct uio *uio,
10087             struct mbuf *top,
10088             struct mbuf *control,
10089 #if defined(__NetBSD__) || defined(__APPLE__)
10090             int flags
10091 #else
10092             int flags,
10093 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10094             struct thread *p
10095 #else
10096             struct proc *p
10097 #endif
10098 #endif
10099 )
10100 {
10101         unsigned int sndlen;
10102         int error, use_rcvinfo;
10103         int queue_only = 0, queue_only_for_init=0;
10104         int un_sent = 0;
10105         int now_filled=0;
10106         struct sctp_inpcb *inp;
10107         struct sctp_tcb *stcb=NULL;
10108         struct sctp_sndrcvinfo srcv;
10109         struct timeval now;
10110         struct sctp_nets *net;
10111         struct sctp_association *asoc;
10112         struct sctp_inpcb *t_inp;
10113         int create_lock_applied = 0;
10114 #if defined(__APPLE__)
10115         struct proc *p = current_proc();
10116 #elif defined(__NetBSD__)
10117         struct proc *p = curproc; /* XXX */
10118         struct sockaddr *addr = NULL;
10119         if (addr_mbuf)
10120                 addr = mtod(addr_mbuf, struct sockaddr *);
10121 #endif
10122
10123         error = use_rcvinfo = 0;
10124         net = NULL;
10125         stcb = NULL;
10126         asoc = NULL;
10127         t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
10128         if (uio)
10129                 sndlen = uio->uio_resid;
10130         else
10131                 sndlen = top->m_pkthdr.len;
10132
10133
10134         crit_enter();
10135
10136         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
10137             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
10138                 /* The listner can NOT send */
10139                 error = EFAULT;
10140                 crit_exit();
10141                 goto out;
10142         }
10143         if (addr) {
10144                 SCTP_ASOC_CREATE_LOCK(inp);
10145                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
10146                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
10147                         /* Should I really unlock ? */
10148                         error = EFAULT;
10149                         crit_exit();
10150                         goto out;
10151
10152                 }
10153                 create_lock_applied = 1;
10154                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
10155                     (addr->sa_family == AF_INET6)) {
10156                         error = EINVAL;
10157                         crit_exit();
10158                         goto out;
10159                 }
10160         }
10161         /* now we must find the assoc */
10162         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
10163                 SCTP_INP_RLOCK(inp);
10164                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
10165                 if (stcb == NULL) {
10166                         SCTP_INP_RUNLOCK(inp);
10167                         error = ENOTCONN;
10168                         crit_exit();
10169                         goto out;
10170                 }
10171                 SCTP_TCB_LOCK(stcb);
10172                 SCTP_INP_RUNLOCK(inp);
10173                 net = stcb->asoc.primary_destination;
10174         }
10175         /* get control */
10176         if (control) {
10177                 /* process cmsg snd/rcv info (maybe a assoc-id) */
10178                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10179                                    sizeof(srcv))) {
10180                         /* got one */
10181                         if (srcv.sinfo_flags & MSG_SENDALL) {
10182                                 /* its a sendall */
10183                                 sctppcbinfo.mbuf_track--;
10184                                 sctp_m_freem(control);
10185
10186                                 if (create_lock_applied) {
10187                                         SCTP_ASOC_CREATE_UNLOCK(inp);
10188                                         create_lock_applied = 0;
10189                                 }
10190                                 return (sctp_sendall(inp, uio, top, &srcv));
10191                         }
10192                         use_rcvinfo = 1;
10193                 }
10194         }
10195         if (stcb == NULL) {
10196                 /* Need to do a lookup */
10197                 if (use_rcvinfo && srcv.sinfo_assoc_id) {
10198                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
10199                         /*
10200                          * Question: Should I error here if the assoc_id is
10201                          * no longer valid? i.e. I can't find it?
10202                          */
10203                         if ((stcb) &&
10204                             (addr != NULL)) {
10205                                 /* Must locate the net structure */
10206                                 net = sctp_findnet(stcb, addr);
10207                         }
10208                 }
10209                 if (stcb == NULL) {
10210                         if (addr != NULL) {
10211                                 /* Since we did not use findep we must
10212                                  * increment it, and if we don't find a
10213                                  * tcb decrement it.
10214                                  */
10215                                 SCTP_INP_WLOCK(inp);
10216                                 SCTP_INP_INCR_REF(inp);
10217                                 SCTP_INP_WUNLOCK(inp);
10218                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
10219                                 if (stcb == NULL) {
10220                                         SCTP_INP_WLOCK(inp);
10221                                         SCTP_INP_DECR_REF(inp);
10222                                         SCTP_INP_WUNLOCK(inp);
10223                                 }
10224                         }
10225                 }
10226         }
10227         if ((stcb == NULL) &&
10228             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
10229                 error = ENOTCONN;
10230                 crit_exit();
10231                 goto out;
10232         } else if ((stcb == NULL) && (addr == NULL)) {
10233                 error = ENOENT;
10234                 crit_exit();
10235                 goto out;
10236         } else if (stcb == NULL) {
10237                 /* UDP style, we must go ahead and start the INIT process */
10238                 if ((use_rcvinfo) &&
10239                     (srcv.sinfo_flags & MSG_ABORT)) {
10240                         /* User asks to abort a non-existant asoc */
10241                         error = ENOENT;
10242                         crit_exit();
10243                         goto out;
10244                 }
10245                 /* get an asoc/stcb struct */
10246                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
10247                 if (stcb == NULL) {
10248                         /* Error is setup for us in the call */
10249                         crit_exit();
10250                         goto out;
10251                 }
10252                 if (create_lock_applied) {
10253                         SCTP_ASOC_CREATE_UNLOCK(inp);
10254                         create_lock_applied = 0;
10255                 } else {
10256                         kprintf("Huh-3? create lock should have been on??\n");
10257                 }
10258                 /* Turn on queue only flag to prevent data from being sent */
10259                 queue_only = 1;
10260                 asoc = &stcb->asoc;
10261                 asoc->state = SCTP_STATE_COOKIE_WAIT;
10262                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
10263                 if (control) {
10264                         /* see if a init structure exists in cmsg headers */
10265                         struct sctp_initmsg initm;
10266                         int i;
10267                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
10268                                 /* we have an INIT override of the default */
10269                                 if (initm.sinit_max_attempts)
10270                                         asoc->max_init_times = initm.sinit_max_attempts;
10271                                 if (initm.sinit_num_ostreams)
10272                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
10273                                 if (initm.sinit_max_instreams)
10274                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
10275                                 if (initm.sinit_max_init_timeo)
10276                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10277                                 if (asoc->streamoutcnt < asoc->pre_open_streams) {
10278                                         /* Default is NOT correct */
10279 #ifdef SCTP_DEBUG
10280                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10281                                                 kprintf("Ok, defout:%d pre_open:%d\n",
10282                                                        asoc->streamoutcnt, asoc->pre_open_streams);
10283                                         }
10284 #endif
10285                                         FREE(asoc->strmout, M_PCB);
10286                                         asoc->strmout = NULL;
10287                                         asoc->streamoutcnt = asoc->pre_open_streams;
10288
10289                                         /* What happesn if this fails? .. we panic ...*/
10290                                         MALLOC(asoc->strmout,
10291                                                struct sctp_stream_out *,
10292                                                asoc->streamoutcnt *
10293                                                sizeof(struct sctp_stream_out),
10294                                                M_PCB, MB_WAIT);
10295                                         for (i = 0; i < asoc->streamoutcnt; i++) {
10296                                                 /*
10297                                                  * inbound side must be set to 0xffff,
10298                                                  * also NOTE when we get the INIT-ACK
10299                                                  * back (for INIT sender) we MUST
10300                                                  * reduce the count (streamoutcnt) but
10301                                                  * first check if we sent to any of the
10302                                                  * upper streams that were dropped (if
10303                                                  * some were). Those that were dropped
10304                                                  * must be notified to the upper layer
10305                                                  * as failed to send.
10306                                                  */
10307                                                 asoc->strmout[i].next_sequence_sent = 0x0;
10308                                                 TAILQ_INIT(&asoc->strmout[i].outqueue);
10309                                                 asoc->strmout[i].stream_no = i;
10310                                                 asoc->strmout[i].next_spoke.tqe_next = 0;
10311                                                 asoc->strmout[i].next_spoke.tqe_prev = 0;
10312                                         }
10313                                 }
10314                         }
10315
10316                 }
10317                 /* out with the INIT */
10318                 queue_only_for_init = 1;
10319                 sctp_send_initiate(inp, stcb);
10320                 /*
10321                  * we may want to dig in after this call and adjust the MTU
10322                  * value. It defaulted to 1500 (constant) but the ro structure
10323                  * may now have an update and thus we may need to change it
10324                  * BEFORE we append the message.
10325                  */
10326                 net = stcb->asoc.primary_destination;
10327                 asoc = &stcb->asoc;
10328         } else {
10329                 asoc = &stcb->asoc;
10330         }
10331         if (create_lock_applied) {
10332                 SCTP_ASOC_CREATE_UNLOCK(inp);
10333                 create_lock_applied = 0;
10334         }
10335         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10336             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10337                 queue_only = 1;
10338         }
10339         if (use_rcvinfo == 0) {
10340                 /* Grab the default stuff from the asoc */
10341                 srcv = stcb->asoc.def_send;
10342         }
10343         /* we are now done with all control */
10344         if (control) {
10345                 sctp_m_freem(control);
10346                 control = NULL;
10347         }
10348
10349         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10350             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10351             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10352             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10353                 if ((use_rcvinfo) &&
10354                     (srcv.sinfo_flags & MSG_ABORT)) {
10355                         ;
10356                 } else {
10357                         error = ECONNRESET;
10358                         crit_exit();
10359                         goto out;
10360                 }
10361         }
10362         /* Ok, we will attempt a msgsnd :> */
10363         if (p)
10364 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10365                 p->td_lwp->lwp_ru.ru_msgsnd++;
10366 #else
10367         p->p_stats->p_ru.ru_msgsnd++;
10368 #endif
10369
10370         if (stcb) {
10371                 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10372                         /* we take the override or the unconfirmed */
10373                         ;
10374                 } else {
10375                         net = stcb->asoc.primary_destination;
10376                 }
10377         }
10378
10379         if (top == NULL) {
10380                 /* Must copy it all in from user land. The
10381                  * socket buf is locked but we don't suspend
10382                  * protocol processing until we are ready to
10383                  * send/queue it.
10384                  */
10385                 crit_exit();
10386                 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10387                 if (error)
10388                         goto out;
10389         } else {
10390                 /* Here we must either pull in the user data to chunk
10391                  * buffers, or use top to do a msg_append.
10392                  */
10393                 error = sctp_msg_append(stcb, net, top, &srcv, flags);
10394                 crit_exit();
10395                 if (error)
10396                         goto out;
10397                 /* zap the top since it is now being used */
10398                 top = 0;
10399         }
10400
10401         if (net->flight_size > net->cwnd) {
10402                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10403                 queue_only = 1;
10404
10405         } else if (asoc->ifp_had_enobuf) {
10406                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10407                 queue_only = 1;
10408         } else {
10409                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10410                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10411                            SCTP_MED_OVERHEAD);
10412
10413                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10414                     (stcb->asoc.total_flight > 0) &&
10415                     (un_sent < (int)stcb->asoc.smallest_mtu)) {
10416
10417                         /* Ok, Nagle is set on and we have data outstanding. Don't
10418                          * send anything and let SACKs drive out the data unless we
10419                          * have a "full" segment to send.
10420                          */
10421                         sctp_pegs[SCTP_NAGLE_NOQ]++;
10422                         queue_only = 1;
10423                 } else {
10424                         sctp_pegs[SCTP_NAGLE_OFF]++;
10425                 }
10426         }
10427         if (queue_only_for_init) {
10428                 /* It is possible to have a turn around of the
10429                  * INIT/INIT-ACK/COOKIE before I have a chance to
10430                  * copy in the data. In such a case I DO want to
10431                  * send it out by reversing the queue only flag.
10432                  */
10433                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10434                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10435                         /* yep, reverse it */
10436                         queue_only = 0;
10437                 }
10438         }
10439
10440         if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10441                 /* we can attempt to send too.*/
10442 #ifdef SCTP_DEBUG
10443                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10444                         kprintf("USR Send calls sctp_chunk_output\n");
10445                 }
10446 #endif
10447                 crit_enter();
10448                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10449                 sctp_chunk_output(inp, stcb, 0);
10450                 crit_exit();
10451         } else if ((queue_only == 0) &&
10452                    (stcb->asoc.peers_rwnd == 0) &&
10453                    (stcb->asoc.total_flight == 0)) {
10454                 /* We get to have a probe outstanding */
10455                 crit_enter();
10456                 sctp_from_user_send = 1;
10457                 sctp_chunk_output(inp, stcb, 0);
10458                 sctp_from_user_send = 0;
10459                 crit_exit();
10460
10461         } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10462                 int num_out, reason, cwnd_full;
10463                 /* Here we do control only */
10464                 crit_enter();
10465                 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10466                                       &reason, 1, &cwnd_full, 1, &now, &now_filled);
10467                 crit_exit();
10468         }
10469 #ifdef SCTP_DEBUG
10470         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10471                 kprintf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10472                        queue_only, stcb->asoc.peers_rwnd, un_sent,
10473                        stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10474                        stcb->asoc.total_output_queue_size);
10475         }
10476 #endif
10477  out:
10478         if (create_lock_applied) {
10479                 SCTP_ASOC_CREATE_UNLOCK(inp);
10480                 create_lock_applied = 0;
10481         }
10482         if (stcb)
10483                 SCTP_TCB_UNLOCK(stcb);
10484         if (top)
10485                 sctp_m_freem(top);
10486         if (control)
10487                 sctp_m_freem(control);
10488         return (error);
10489 }