ff83aa9bf860685caf2c7bcdbdbf1abaad484011
[dragonfly.git] / sys / netinet / sctp_output.c
1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
2
3 /*
4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31
32 #if !(defined(__OpenBSD__) || defined (__APPLE__))
33 #include "opt_ipsec.h"
34 #endif
35 #if defined(__FreeBSD__) || defined(__DragonFly__)
36 #include "opt_compat.h"
37 #include "opt_inet6.h"
38 #include "opt_inet.h"
39 #endif
40 #if defined(__NetBSD__)
41 #include "opt_inet.h"
42 #endif
43 #ifdef __APPLE__
44 #include <sctp.h>
45 #elif !defined(__OpenBSD__)
46 #include "opt_sctp.h"
47 #endif
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/malloc.h>
51 #include <sys/mbuf.h>
52 #ifndef __OpenBSD__
53 #include <sys/domain.h>
54 #endif
55 #include <sys/protosw.h>
56 #include <sys/socket.h>
57 #include <sys/socketvar.h>
58 #include <sys/proc.h>
59 #include <sys/kernel.h>
60 #include <sys/sysctl.h>
61 #include <sys/resourcevar.h>
62 #include <sys/uio.h>
63 #ifdef INET6
64 #include <sys/domain.h>
65 #endif
66 #include <sys/thread2.h>
67 #include <sys/socketvar2.h>
68
69 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
70 #include <sys/limits.h>
71 #else
72 #include <machine/limits.h>
73 #endif
74 #include <machine/cpu.h>
75
76 #include <net/if.h>
77 #include <net/if_types.h>
78
79 #if defined(__FreeBSD__) || defined(__DragonFly__)
80 #include <net/if_var.h>
81 #endif
82
83 #include <net/route.h>
84
85 #include <netinet/in.h>
86 #include <netinet/in_systm.h>
87 #include <netinet/ip.h>
88 #include <netinet/in_pcb.h>
89 #include <netinet/in_var.h>
90 #include <netinet/ip_var.h>
91
92 #ifdef INET6
93 #include <netinet/ip6.h>
94 #include <netinet6/ip6_var.h>
95 #include <netinet6/scope6_var.h>
96 #include <netinet6/nd6.h>
97
98 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
99 #include <netinet6/in6_pcb.h>
100 #elif defined(__OpenBSD__)
101 #include <netinet/in_pcb.h>
102 #endif
103
104 #include <netinet/icmp6.h>
105
106 #endif /* INET6 */
107
108 #include <net/net_osdep.h>
109
110 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
111 #ifndef in6pcb
112 #define in6pcb          inpcb
113 #endif
114 #endif
115
116 #include <netinet/sctp_pcb.h>
117
118 #ifdef IPSEC
119 #ifndef __OpenBSD__
120 #include <netinet6/ipsec.h>
121 #include <netproto/key/key.h>
122 #else
123 #undef IPSEC
124 #endif
125 #endif /* IPSEC */
126
127 #include <netinet/sctp_var.h>
128 #include <netinet/sctp_header.h>
129 #include <netinet/sctputil.h>
130 #include <netinet/sctp_pcb.h>
131 #include <netinet/sctp_output.h>
132 #include <netinet/sctp_uio.h>
133 #include <netinet/sctputil.h>
134 #include <netinet/sctp_hashdriver.h>
135 #include <netinet/sctp_timer.h>
136 #include <netinet/sctp_asconf.h>
137 #include <netinet/sctp_indata.h>
138
139 #ifdef SCTP_DEBUG
140 extern uint32_t sctp_debug_on;
141 #endif
142
143 extern int sctp_peer_chunk_oh;
144
145 static int
146 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
147 {
148         struct cmsghdr cmh;
149         int tlen, at;
150
151         tlen = control->m_len;
152         at = 0;
153         /*
154          * Independent of how many mbufs, find the c_type inside the control
155          * structure and copy out the data.
156          */
157         while (at < tlen) {
158                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
159                         /* not enough room for one more we are done. */
160                         return (0);
161                 }
162                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
163                 if ((cmh.cmsg_len + at) > tlen) {
164                         /*
165                          * this is real messed up since there is not enough
166                          * data here to cover the cmsg header. We are done.
167                          */
168                         return (0);
169                 }
170                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
171                     (c_type == cmh.cmsg_type)) {
172                         /* found the one we want, copy it out */
173                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
174                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
175                                 /*
176                                  * space of cmsg_len after header not
177                                  * big enough
178                                  */
179                                 return (0);
180                         }
181                         m_copydata(control, at, cpsize, data);
182                         return (1);
183                  } else {
184                         at += CMSG_ALIGN(cmh.cmsg_len);
185                         if (cmh.cmsg_len == 0) {
186                                 break;
187                         }
188                 }
189         }
190         /* not found */
191         return (0);
192 }
193
194 static struct mbuf *
195 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
196 {
197         struct sctp_paramhdr *parmh;
198         struct mbuf *mret;
199         int len;
200         if (ifa->ifa_addr->sa_family == AF_INET) {
201                 len = sizeof(struct sctp_ipv4addr_param);
202         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
203                 len = sizeof(struct sctp_ipv6addr_param);
204         } else {
205                 /* unknown type */
206                 return (m);
207         }
208
209         if (M_TRAILINGSPACE(m) >= len) {
210                 /* easy side we just drop it on the end */
211                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
212                 mret = m;
213         } else {
214                 /* Need more space */
215                 mret = m;
216                 while (mret->m_next != NULL) {
217                         mret = mret->m_next;
218                 }
219                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
220                 if (mret->m_next == NULL) {
221                         /* We are hosed, can't add more addresses */
222                         return (m);
223                 }
224                 mret = mret->m_next;
225                 parmh = mtod(mret, struct sctp_paramhdr *);
226         }
227         /* now add the parameter */
228         if (ifa->ifa_addr->sa_family == AF_INET) {
229                 struct sctp_ipv4addr_param *ipv4p;
230                 struct sockaddr_in *sin;
231                 sin = (struct sockaddr_in *)ifa->ifa_addr;
232                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
233                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
234                 parmh->param_length = htons(len);
235                 ipv4p->addr = sin->sin_addr.s_addr;
236                 mret->m_len += len;
237         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
238                 struct sctp_ipv6addr_param *ipv6p;
239                 struct sockaddr_in6 *sin6;
240                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
241                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
242                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
243                 parmh->param_length = htons(len);
244                 memcpy(ipv6p->addr, &sin6->sin6_addr,
245                     sizeof(ipv6p->addr));
246                 /* clear embedded scope in the address */
247                 in6_clearscope((struct in6_addr *)ipv6p->addr);
248                 mret->m_len += len;
249         } else {
250                 return (m);
251         }
252         return (mret);
253 }
254
255
256
257 static struct mbuf *
258 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
259     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
260 {
261         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
262         struct sctp_state_cookie *stc;
263         struct sctp_paramhdr *ph;
264         uint8_t *signature;
265         int sig_offset;
266         uint16_t cookie_sz;
267
268         mret = NULL;
269
270         MGET(mret, MB_DONTWAIT, MT_DATA);
271         if (mret == NULL) {
272                 return (NULL);
273         }
274         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
275         if (copy_init == NULL) {
276                 sctp_m_freem(mret);
277                 return (NULL);
278         }
279         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
280             MB_DONTWAIT);
281         if (copy_initack == NULL) {
282                 sctp_m_freem(mret);
283                 sctp_m_freem(copy_init);
284                 return (NULL);
285         }
286         /* easy side we just drop it on the end */
287         ph = mtod(mret, struct sctp_paramhdr *);
288         mret->m_len = sizeof(struct sctp_state_cookie) +
289             sizeof(struct sctp_paramhdr);
290         stc = (struct sctp_state_cookie *)((caddr_t)ph +
291             sizeof(struct sctp_paramhdr));
292         ph->param_type = htons(SCTP_STATE_COOKIE);
293         ph->param_length = 0;   /* fill in at the end */
294         /* Fill in the stc cookie data */
295         *stc = *stc_in;
296
297         /* tack the INIT and then the INIT-ACK onto the chain */
298         cookie_sz = 0;
299         m_at = mret;
300         for (m_at = mret; m_at; m_at = m_at->m_next) {
301                 cookie_sz += m_at->m_len;
302                 if (m_at->m_next == NULL) {
303                         m_at->m_next = copy_init;
304                         break;
305                 }
306         }
307
308         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
309                 cookie_sz += m_at->m_len;
310                 if (m_at->m_next == NULL) {
311                         m_at->m_next = copy_initack;
312                         break;
313                 }
314         }
315
316         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
317                 cookie_sz += m_at->m_len;
318                 if (m_at->m_next == NULL) {
319                         break;
320                 }
321         }
322         MGET(sig, MB_DONTWAIT, MT_DATA);
323         if (sig == NULL) {
324                 /* no space */
325                 sctp_m_freem(mret);
326                 sctp_m_freem(copy_init);
327                 sctp_m_freem(copy_initack);
328                 return (NULL);
329         }
330         sig->m_len = 0;
331         m_at->m_next = sig;
332         sig_offset = 0;
333         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
334         /* Time to sign the cookie */
335         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
336             (int)(inp->sctp_ep.current_secret_number)],
337             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), signature);
338         sig->m_len += SCTP_SIGNATURE_SIZE;
339         cookie_sz += SCTP_SIGNATURE_SIZE;
340
341         ph->param_length = htons(cookie_sz);
342         return (mret);
343 }
344
345
346 static struct sockaddr_in *
347 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
348 {
349         struct sockaddr_in *sin;
350         /*
351          * Here we determine if its a prefered address. A
352          * prefered address means it is the same scope or
353          * higher scope then the destination.
354          *  L = loopback, P = private, G = global
355          * -----------------------------------------
356          *  src    |      dest     |    result
357          *-----------------------------------------
358          *   L     |       L       |    yes
359          *-----------------------------------------
360          *   P     |       L       |    yes
361          *-----------------------------------------
362          *   G     |       L       |    yes
363          *-----------------------------------------
364          *   L     |       P       |    no
365          *-----------------------------------------
366          *   P     |       P       |    yes
367          *-----------------------------------------
368          *   G     |       P       |    no
369          *-----------------------------------------
370          *   L     |       G       |    no
371          *-----------------------------------------
372          *   P     |       G       |    no
373          *-----------------------------------------
374          *   G     |       G       |    yes
375          *-----------------------------------------
376          */
377
378         if (ifa->ifa_addr->sa_family != AF_INET) {
379                 /* forget non-v4 */
380                 return (NULL);
381         }
382         /* Ok the address may be ok */
383         sin = (struct sockaddr_in *)ifa->ifa_addr;
384         if (sin->sin_addr.s_addr == 0) {
385                 return (NULL);
386         }
387         *sin_local = *sin_loop = 0;
388         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
389             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
390                 *sin_loop = 1;
391                 *sin_local = 1;
392         }
393         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
394                 *sin_local = 1;
395         }
396         if (!loopscope && *sin_loop) {
397                 /* Its a loopback address and we don't have loop scope */
398                 return (NULL);
399         }
400         if (!ipv4_scope && *sin_local) {
401                 /* Its a private address, and we don't have private address scope */
402                 return (NULL);
403         }
404         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
405                 /* its a global src and a private dest */
406                 return (NULL);
407         }
408         /* its a prefered address */
409         return (sin);
410 }
411
412 static struct sockaddr_in *
413 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
414 {
415         struct sockaddr_in *sin;
416         /*
417          * Here we determine if its a acceptable address. A
418          * acceptable address means it is the same scope or
419          * higher scope but we can allow for NAT which means
420          * its ok to have a global dest and a private src.
421          *
422          *  L = loopback, P = private, G = global
423          * -----------------------------------------
424          *  src    |      dest     |    result
425          *-----------------------------------------
426          *   L     |       L       |    yes
427          *-----------------------------------------
428          *   P     |       L       |    yes
429          *-----------------------------------------
430          *   G     |       L       |    yes
431          *-----------------------------------------
432          *   L     |       P       |    no
433          *-----------------------------------------
434          *   P     |       P       |    yes
435          *-----------------------------------------
436          *   G     |       P       |    yes - probably this won't work.
437          *-----------------------------------------
438          *   L     |       G       |    no
439          *-----------------------------------------
440          *   P     |       G       |    yes
441          *-----------------------------------------
442          *   G     |       G       |    yes
443          *-----------------------------------------
444          */
445
446         if (ifa->ifa_addr->sa_family != AF_INET) {
447                 /* forget non-v4 */
448                 return (NULL);
449         }
450         /* Ok the address may be ok */
451         sin = (struct sockaddr_in *)ifa->ifa_addr;
452         if (sin->sin_addr.s_addr == 0) {
453                 return (NULL);
454         }
455         *sin_local = *sin_loop = 0;
456         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
457             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
458                 *sin_loop = 1;
459                 *sin_local = 1;
460         }
461         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
462                 *sin_local = 1;
463         }
464         if (!loopscope && *sin_loop) {
465                 /* Its a loopback address and we don't have loop scope */
466                 return (NULL);
467         }
468         /* its an acceptable address */
469         return (sin);
470 }
471
472 /*
473  * This treats the address list on the ep as a restricted list
474  * (negative list). If a the passed address is listed, then
475  * the address is NOT allowed on the association.
476  */
477 int
478 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
479 {
480         struct sctp_laddr *laddr;
481 #ifdef SCTP_DEBUG
482         int cnt=0;
483 #endif
484         if (stcb == NULL) {
485                 /* There are no restrictions, no TCB :-) */
486                 return (0);
487         }
488 #ifdef SCTP_DEBUG
489         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
490                 cnt++;
491         }
492         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
493                 kprintf("There are %d addresses on the restricted list\n", cnt);
494         }
495         cnt = 0;
496 #endif
497         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
498                 if (laddr->ifa == NULL) {
499 #ifdef SCTP_DEBUG
500                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
501                                 kprintf("Help I have fallen and I can't get up!\n");
502                         }
503 #endif
504                         continue;
505                 }
506 #ifdef SCTP_DEBUG
507                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
508                         cnt++;
509                         kprintf("Restricted address[%d]:", cnt);
510                         sctp_print_address(laddr->ifa->ifa_addr);
511                 }
512 #endif
513                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
514                         /* Yes it is on the list */
515                         return (1);
516                 }
517         }
518         return (0);
519 }
520
521 static int
522 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
523 {
524         struct sctp_laddr *laddr;
525
526         if (ifa == NULL)
527                 return (0);
528         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
529                 if (laddr->ifa == NULL) {
530 #ifdef SCTP_DEBUG
531                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
532                                 kprintf("Help I have fallen and I can't get up!\n");
533                         }
534 #endif
535                         continue;
536                 }
537                 if (laddr->ifa->ifa_addr == NULL)
538                         continue;
539                 if (laddr->ifa == ifa)
540                         /* same pointer */
541                         return (1);
542                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
543                         /* skip non compatible address comparison */
544                         continue;
545                 }
546                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
547                         /* Yes it is restricted */
548                         return (1);
549                 }
550         }
551         return (0);
552 }
553
554
555
556 static struct in_addr
557 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
558                                  struct rtentry *rt,
559                                  uint8_t ipv4_scope,
560                                  uint8_t loopscope)
561 {
562         struct in_addr ans;
563         struct sctp_laddr *laddr;
564         struct sockaddr_in *sin;
565         struct ifnet *ifn;
566         uint8_t sin_loop, sin_local;
567
568         /* first question, is the ifn we will emit on
569          * in our list, if so, we want that one.
570          */
571         ifn = rt->rt_ifp;
572         if (ifn) {
573                 struct ifaddr_container *ifac;
574
575                 /* is a prefered one on the interface we route out? */
576                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
577                         struct ifaddr *ifa = ifac->ifa;
578
579                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
580                         if (sin == NULL)
581                                 continue;
582                         if (sctp_is_addr_in_ep(inp, ifa)) {
583                                 return (sin->sin_addr);
584                         }
585                 }
586                 /* is an acceptable one on the interface we route out? */
587                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
588                         struct ifaddr *ifa = ifac->ifa;
589
590                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
591                         if (sin == NULL)
592                                 continue;
593                         if (sctp_is_addr_in_ep(inp, ifa)) {
594                                 return (sin->sin_addr);
595                         }
596                 }
597         }
598         /* ok, what about a prefered address in the inp */
599         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
600              laddr && (laddr != inp->next_addr_touse);
601              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
602                 if (laddr->ifa == NULL) {
603                         /* address has been removed */
604                         continue;
605                 }
606                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
607                 if (sin == NULL)
608                         continue;
609                 return (sin->sin_addr);
610
611         }
612         /* ok, what about an acceptable address in the inp */
613         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
614              laddr && (laddr != inp->next_addr_touse);
615              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
616                 if (laddr->ifa == NULL) {
617                         /* address has been removed */
618                         continue;
619                 }
620                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
621                 if (sin == NULL)
622                         continue;
623                 return (sin->sin_addr);
624
625         }
626
627         /* no address bound can be a source for the destination we are in trouble */
628 #ifdef SCTP_DEBUG
629         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
630                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
631         }
632 #endif
633         memset(&ans, 0, sizeof(ans));
634         return (ans);
635 }
636
637
638
639 static struct in_addr
640 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
641                                   struct sctp_tcb *stcb,
642                                   struct sctp_nets *net,
643                                   struct rtentry *rt,
644                                   uint8_t ipv4_scope,
645                                   uint8_t loopscope,
646                                   int non_asoc_addr_ok)
647 {
648         /*
649          * Here we have two cases, bound all asconf
650          * allowed. bound all asconf not allowed.
651          *
652          */
653         struct sctp_laddr *laddr, *starting_point;
654         struct in_addr ans;
655         struct ifnet *ifn;
656         uint8_t sin_loop, sin_local, start_at_beginning=0;
657         struct sockaddr_in *sin;
658
659         /* first question, is the ifn we will emit on
660          * in our list, if so, we want that one.
661          */
662         ifn = rt->rt_ifp;
663
664         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
665                 /*
666                  * Here we use the list of addresses on the endpoint. Then
667                  * the addresses listed on the "restricted" list is just that,
668                  * address that have not been added and can't be used (unless
669                  * the non_asoc_addr_ok is set).
670                  */
671 #ifdef SCTP_DEBUG
672                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
673                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
674                 }
675 #endif
676                 /* first question, is the ifn we will emit on
677                  * in our list, if so, we want that one.
678                  */
679                 if (ifn) {
680                         struct ifaddr_container *ifac;
681
682                         /* first try for an prefered address on the ep */
683                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
684                                 struct ifaddr *ifa = ifac->ifa;
685
686                                 if (sctp_is_addr_in_ep(inp, ifa)) {
687                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
688                                         if (sin == NULL)
689                                                 continue;
690                                         if ((non_asoc_addr_ok == 0) &&
691                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
692                                                 /* on the no-no list */
693                                                 continue;
694                                         }
695                                         return (sin->sin_addr);
696                                 }
697                         }
698                         /* next try for an acceptable address on the ep */
699                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
700                                 struct ifaddr *ifa = ifac->ifa;
701
702                                 if (sctp_is_addr_in_ep(inp, ifa)) {
703                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
704                                         if (sin == NULL)
705                                                 continue;
706                                         if ((non_asoc_addr_ok == 0) &&
707                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
708                                                 /* on the no-no list */
709                                                 continue;
710                                         }
711                                         return (sin->sin_addr);
712                                 }
713                         }
714
715                 }
716                 /* if we can't find one like that then we must
717                  * look at all addresses bound to pick one at
718                  * first prefereable then secondly acceptable.
719                  */
720                 starting_point = stcb->asoc.last_used_address;
721         sctpv4_from_the_top:
722                 if (stcb->asoc.last_used_address == NULL) {
723                         start_at_beginning=1;
724                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
725                 }
726                 /* search beginning with the last used address */
727                 for (laddr = stcb->asoc.last_used_address; laddr;
728                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
729                         if (laddr->ifa == NULL) {
730                                 /* address has been removed */
731                                 continue;
732                         }
733                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
734                         if (sin == NULL)
735                                 continue;
736                         if ((non_asoc_addr_ok == 0) &&
737                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
738                                 /* on the no-no list */
739                                 continue;
740                         }
741                         return (sin->sin_addr);
742
743                 }
744                 if (start_at_beginning == 0) {
745                         stcb->asoc.last_used_address = NULL;
746                         goto sctpv4_from_the_top;
747                 }
748                 /* now try for any higher scope than the destination */
749                 stcb->asoc.last_used_address = starting_point;
750                 start_at_beginning = 0;
751         sctpv4_from_the_top2:
752                 if (stcb->asoc.last_used_address == NULL) {
753                         start_at_beginning=1;
754                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
755                 }
756                 /* search beginning with the last used address */
757                 for (laddr = stcb->asoc.last_used_address; laddr;
758                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
759                         if (laddr->ifa == NULL) {
760                                 /* address has been removed */
761                                 continue;
762                         }
763                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
764                         if (sin == NULL)
765                                 continue;
766                         if ((non_asoc_addr_ok == 0) &&
767                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
768                                 /* on the no-no list */
769                                 continue;
770                         }
771                         return (sin->sin_addr);
772                 }
773                 if (start_at_beginning == 0) {
774                         stcb->asoc.last_used_address = NULL;
775                         goto sctpv4_from_the_top2;
776                 }
777         } else {
778                 /*
779                  * Here we have an address list on the association, thats the
780                  * only valid source addresses that we can use.
781                  */
782 #ifdef SCTP_DEBUG
783                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
784                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
785                 }
786 #endif
787                 /* First look at all addresses for one that is on
788                  * the interface we route out
789                  */
790                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
791                              sctp_nxt_addr) {
792                         if (laddr->ifa == NULL) {
793                                 /* address has been removed */
794                                 continue;
795                         }
796                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
797                         if (sin == NULL)
798                                 continue;
799                         /* first question, is laddr->ifa an address associated with the emit interface */
800                         if (ifn) {
801                                 struct ifaddr_container *ifac;
802
803                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
804                                         struct ifaddr *ifa = ifac->ifa;
805
806                                         if (laddr->ifa == ifa) {
807                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
808                                                 return (sin->sin_addr);
809                                         }
810                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
811                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
812                                                 return (sin->sin_addr);
813                                         }
814                                 }
815                         }
816                 }
817                 /* what about an acceptable one on the interface? */
818                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
819                              sctp_nxt_addr) {
820                         if (laddr->ifa == NULL) {
821                                 /* address has been removed */
822                                 continue;
823                         }
824                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
825                         if (sin == NULL)
826                                 continue;
827                         /* first question, is laddr->ifa an address associated with the emit interface */
828                         if (ifn) {
829                                 struct ifaddr_container *ifac;
830
831                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
832                                         struct ifaddr *ifa = ifac->ifa;
833
834                                         if (laddr->ifa == ifa) {
835                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
836                                                 return (sin->sin_addr);
837                                         }
838                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
839                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
840                                                 return (sin->sin_addr);
841                                         }
842                                 }
843                         }
844                 }
845                 /* ok, next one that is preferable in general */
846                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
847                              sctp_nxt_addr) {
848                         if (laddr->ifa == NULL) {
849                                 /* address has been removed */
850                                 continue;
851                         }
852                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
853                         if (sin == NULL)
854                                 continue;
855                         return (sin->sin_addr);
856                 }
857
858                 /* last, what about one that is acceptable */
859                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
860                              sctp_nxt_addr) {
861                         if (laddr->ifa == NULL) {
862                                 /* address has been removed */
863                                 continue;
864                         }
865                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
866                         if (sin == NULL)
867                                 continue;
868                         return (sin->sin_addr);
869                 }
870         }
871         memset(&ans, 0, sizeof(ans));
872         return (ans);
873 }
874
875 static struct sockaddr_in *
876 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
877                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
878 {
879         struct ifaddr_container *ifac;
880         struct sockaddr_in *sin;
881         uint8_t sin_loop, sin_local;
882         int num_eligible_addr = 0;
883
884         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
885                 struct ifaddr *ifa = ifac->ifa;
886
887                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
888                 if (sin == NULL)
889                         continue;
890                 if (stcb) {
891                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
892                                 /* It is restricted for some reason.. probably
893                                  * not yet added.
894                                  */
895                                 continue;
896                         }
897                 }
898                 if (cur_addr_num == num_eligible_addr) {
899                         return (sin);
900                 }
901         }
902         return (NULL);
903 }
904
905
906 static int
907 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
908                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
909 {
910         struct ifaddr_container *ifac;
911         struct sockaddr_in *sin;
912         int num_eligible_addr = 0;
913
914         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
915                 struct ifaddr *ifa = ifac->ifa;
916
917                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
918                 if (sin == NULL)
919                         continue;
920                 if (stcb) {
921                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
922                                 /* It is restricted for some reason.. probably
923                                  * not yet added.
924                                  */
925                                 continue;
926                         }
927                 }
928                 num_eligible_addr++;
929         }
930         return (num_eligible_addr);
931
932 }
933
934 static struct in_addr
935 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
936                         struct sctp_tcb *stcb,
937                         struct sctp_nets *net,
938                         struct rtentry *rt,
939                         uint8_t ipv4_scope,
940                         uint8_t loopscope,
941                         int non_asoc_addr_ok)
942 {
943         int cur_addr_num=0, num_prefered=0;
944         uint8_t sin_loop, sin_local;
945         struct ifnet *ifn;
946         struct sockaddr_in *sin;
947         struct in_addr ans;
948         struct ifaddr_container *ifac;
949         /*
950          * For v4 we can use (in boundall) any address in the association. If
951          * non_asoc_addr_ok is set we can use any address (at least in theory).
952          * So we look for prefered addresses first. If we find one, we use it.
953          * Otherwise we next try to get an address on the interface, which we
954          * should be able to do (unless non_asoc_addr_ok is false and we are
955          * routed out that way). In these cases where we can't use the address
956          * of the interface we go through all the ifn's looking for an address
957          * we can use and fill that in. Punting means we send back address
958          * 0, which will probably cause problems actually since then IP will
959          * fill in the address of the route ifn, which means we probably already
960          * rejected it.. i.e. here comes an abort :-<.
961          */
962         ifn = rt->rt_ifp;
963         if (net) {
964                 cur_addr_num = net->indx_of_eligible_next_to_use;
965         }
966         if (ifn == NULL) {
967                 goto bound_all_v4_plan_c;
968         }
969         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
970 #ifdef SCTP_DEBUG
971         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
972                 kprintf("Found %d preferred source addresses\n", num_prefered);
973         }
974 #endif
975         if (num_prefered == 0) {
976                 /* no eligible addresses, we must use some other
977                  * interface address if we can find one.
978                  */
979                 goto bound_all_v4_plan_b;
980         }
981         /* Ok we have num_eligible_addr set with how many we can use,
982          * this may vary from call to call due to addresses being deprecated etc..
983          */
984         if (cur_addr_num >= num_prefered) {
985                 cur_addr_num = 0;
986         }
987         /* select the nth address from the list (where cur_addr_num is the nth) and
988          * 0 is the first one, 1 is the second one etc...
989          */
990 #ifdef SCTP_DEBUG
991         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
992                 kprintf("cur_addr_num:%d\n", cur_addr_num);
993         }
994 #endif
995         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
996                                                                    ipv4_scope, cur_addr_num);
997
998         /* if sin is NULL something changed??, plan_a now */
999         if (sin) {
1000                 return (sin->sin_addr);
1001         }
1002
1003         /*
1004          * plan_b: Look at the interface that we emit on
1005          *         and see if we can find an acceptable address.
1006          */
1007  bound_all_v4_plan_b:
1008         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1009                 struct ifaddr *ifa = ifac->ifa;
1010
1011                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1012                 if (sin == NULL)
1013                         continue;
1014                 if (stcb) {
1015                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1016                                 /* It is restricted for some reason.. probably
1017                                  * not yet added.
1018                                  */
1019                                 continue;
1020                         }
1021                 }
1022                 return (sin->sin_addr);
1023         }
1024         /*
1025          * plan_c: Look at all interfaces and find a prefered
1026          *         address. If we reache here we are in trouble I think.
1027          */
1028  bound_all_v4_plan_c:
1029         for (ifn = TAILQ_FIRST(&ifnet);
1030              ifn && (ifn != inp->next_ifn_touse);
1031              ifn=TAILQ_NEXT(ifn, if_list)) {
1032                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1033                         /* wrong base scope */
1034                         continue;
1035                 }
1036                 if (ifn == rt->rt_ifp)
1037                         /* already looked at this guy */
1038                         continue;
1039                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1040                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1041 #ifdef SCTP_DEBUG
1042                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1043                         kprintf("Found ifn:%p %d preferred source addresses\n", ifn, num_prefered);
1044                 }
1045 #endif
1046                 if (num_prefered == 0) {
1047                         /*
1048                          * None on this interface.
1049                          */
1050                         continue;
1051                 }
1052                 /* Ok we have num_eligible_addr set with how many we can use,
1053                  * this may vary from call to call due to addresses being deprecated etc..
1054                  */
1055                 if (cur_addr_num >= num_prefered) {
1056                         cur_addr_num = 0;
1057                 }
1058                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1059                                                                           ipv4_scope, cur_addr_num);
1060                 if (sin == NULL)
1061                         continue;
1062                 return (sin->sin_addr);
1063
1064         }
1065
1066         /*
1067          * plan_d: We are in deep trouble. No prefered address on
1068          *         any interface. And the emit interface does not
1069          *         even have an acceptable address. Take anything
1070          *         we can get! If this does not work we are
1071          *         probably going to emit a packet that will
1072          *         illicit an ABORT, falling through.
1073          */
1074
1075         for (ifn = TAILQ_FIRST(&ifnet);
1076              ifn && (ifn != inp->next_ifn_touse);
1077              ifn=TAILQ_NEXT(ifn, if_list)) {
1078                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1079                         /* wrong base scope */
1080                         continue;
1081                 }
1082                 if (ifn == rt->rt_ifp)
1083                         /* already looked at this guy */
1084                         continue;
1085
1086                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1087                         struct ifaddr *ifa = ifac->ifa;
1088
1089                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1090                         if (sin == NULL)
1091                                 continue;
1092                         if (stcb) {
1093                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1094                                         /* It is restricted for some reason.. probably
1095                                          * not yet added.
1096                                          */
1097                                         continue;
1098                                 }
1099                         }
1100                         return (sin->sin_addr);
1101                 }
1102         }
1103         /*
1104          * Ok we can find NO address to source from that is
1105          * not on our negative list. It is either the special
1106          * ASCONF case where we are sourceing from a intf that
1107          * has been ifconfig'd to a different address (i.e.
1108          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1109          * address. OR we are hosed, and this baby is going
1110          * to abort the association.
1111          */
1112         if (non_asoc_addr_ok) {
1113                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1114         } else {
1115                 memset(&ans, 0, sizeof(ans));
1116                 return (ans);
1117         }
1118 }
1119
1120
1121
1122 /* tcb may be NULL */
1123 struct in_addr
1124 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1125     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1126     int non_asoc_addr_ok)
1127 {
1128         struct in_addr ans;
1129         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1130         uint8_t ipv4_scope, loopscope;
1131         /*
1132          * Rules:
1133          * - Find the route if needed, cache if I can.
1134          * - Look at interface address in route, Is it
1135          *   in the bound list. If so we have the best source.
1136          * - If not we must rotate amongst the addresses.
1137          *
1138          * Cavets and issues
1139          *
1140          * Do we need to pay attention to scope. We can have
1141          * a private address or a global address we are sourcing
1142          * or sending to. So if we draw it out
1143          *      source     *      dest   *  result
1144          *  ------------------------------------------
1145          *  a   Private    *     Global  *  NAT?
1146          *  ------------------------------------------
1147          *  b   Private    *     Private *  No problem
1148          *  ------------------------------------------
1149          *  c   Global     *     Private *  Huh, How will this work?
1150          *  ------------------------------------------
1151          *  d   Global     *     Global  *  No Problem
1152          *  ------------------------------------------
1153          *
1154          * And then we add to that what happens if there are multiple
1155          * addresses assigned to an interface. Remember the ifa on a
1156          * ifn is a linked list of addresses. So one interface can
1157          * have more than one IPv4 address. What happens if we
1158          * have both a private and a global address? Do we then
1159          * use context of destination to sort out which one is
1160          * best? And what about NAT's sending P->G may get you
1161          * a NAT translation, or should you select the G thats
1162          * on the interface in preference.
1163          *
1164          * Decisions:
1165          *
1166          *  - count the number of addresses on the interface.
1167          *  - if its one, no problem except case <c>. For <a>
1168          *    we will assume a NAT out there.
1169          *  - if there are more than one, then we need to worry
1170          *    about scope P or G. We should prefer G -> G and
1171          *    P -> P if possible. Then as a secondary fall back
1172          *    to mixed types G->P being a last ditch one.
1173          *  - The above all works for bound all, but bound
1174          *    specific we need to use the same concept but instead
1175          *    only consider the bound addresses. If the bound set
1176          *    is NOT assigned to the interface then we must use
1177          *    rotation amongst them.
1178          *
1179          * Notes: For v4, we can always punt and let ip_output
1180          * decide by sending back a source of 0.0.0.0
1181          */
1182
1183         if (ro->ro_rt == NULL) {
1184                 /*
1185                  * Need a route to cache.
1186                  *
1187                  */
1188 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1189                 rtalloc_ign(ro, 0UL);
1190 #else
1191                 rtalloc(ro);
1192 #endif
1193         }
1194         if (ro->ro_rt == NULL) {
1195                 /* No route to host .. punt */
1196                 memset(&ans, 0, sizeof(ans));
1197                 return (ans);
1198         }
1199         /* Setup our scopes */
1200         if (stcb) {
1201                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1202                 loopscope = stcb->asoc.loopback_scope;
1203         } else {
1204                 /* Scope based on outbound address */
1205                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1206                         ipv4_scope = 1;
1207                         loopscope = 0;
1208                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1209                         ipv4_scope = 1;
1210                         loopscope = 1;
1211                 } else {
1212                         ipv4_scope = 0;
1213                         loopscope = 0;
1214                 }
1215         }
1216 #ifdef SCTP_DEBUG
1217         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1218                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1219                        loopscope, ipv4_scope);
1220         }
1221 #endif
1222         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1223                 /*
1224                  * When bound to all if the address list is set
1225                  * it is a negative list. Addresses being added
1226                  * by asconf.
1227                  */
1228                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1229                     ipv4_scope, loopscope, non_asoc_addr_ok));
1230         }
1231         /*
1232          * Three possiblities here:
1233          *
1234          * a) stcb is NULL, which means we operate only from
1235          *    the list of addresses (ifa's) bound to the assoc and
1236          *    we care not about the list.
1237          * b) stcb is NOT-NULL, which means we have an assoc structure and
1238          *    auto-asconf is on. This means that the list of addresses is
1239          *    a NOT list. We use the list from the inp, but any listed address
1240          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1241          *    set we CAN use an address NOT available (i.e. being added). Its
1242          *    a negative list.
1243          * c) stcb is NOT-NULL, which means we have an assoc structure and
1244          *    auto-asconf is off. This means that the list of addresses is
1245          *    the ONLY addresses I can use.. its positive.
1246          *
1247          *    Note we collapse b & c into the same function just like in
1248          *    the v6 address selection.
1249          */
1250         if (stcb) {
1251                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1252                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1253         } else {
1254                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1255                     ipv4_scope, loopscope));
1256         }
1257         /* this should not be reached */
1258         memset(&ans, 0, sizeof(ans));
1259         return (ans);
1260 }
1261
1262
1263
1264 static struct sockaddr_in6 *
1265 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1266 {
1267         struct in6_ifaddr *ifa6;
1268         struct sockaddr_in6 *sin6;
1269
1270         if (ifa->ifa_addr->sa_family != AF_INET6) {
1271                 /* forget non-v6 */
1272                 return (NULL);
1273         }
1274         ifa6 = (struct in6_ifaddr *)ifa;
1275         /* ok to use deprecated addresses? */
1276         if (!ip6_use_deprecated) {
1277                 if (IFA6_IS_DEPRECATED(ifa6)) {
1278                         /* can't use this type */
1279                         return (NULL);
1280                 }
1281         }
1282         /* are we ok, with the current state of this address? */
1283         if (ifa6->ia6_flags &
1284             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1285                 /* Can't use these types */
1286                 return (NULL);
1287         }
1288         /* Ok the address may be ok */
1289         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1290         *sin_local = *sin_loop = 0;
1291         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1292             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1293                 *sin_loop = 1;
1294         }
1295         if (!loopscope && *sin_loop) {
1296                 /* Its a loopback address and we don't have loop scope */
1297                 return (NULL);
1298         }
1299         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1300                 /* we skip unspecifed addresses */
1301                 return (NULL);
1302         }
1303
1304         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1305                 *sin_local = 1;
1306         }
1307         if (!loc_scope && *sin_local) {
1308                 /* Its a link local address, and we don't have link local scope */
1309                 return (NULL);
1310         }
1311         return (sin6);
1312 }
1313
1314
1315 static struct sockaddr_in6 *
1316 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1317                                   struct sctp_tcb *stcb,
1318                                   struct sctp_nets *net,
1319                                   struct rtentry *rt,
1320                                   uint8_t loc_scope,
1321                                   uint8_t loopscope,
1322                                   int non_asoc_addr_ok)
1323 {
1324         /*
1325          *   Each endpoint has a list of local addresses associated
1326          *   with it. The address list is either a "negative list" i.e.
1327          *   those addresses that are NOT allowed to be used as a source OR
1328          *   a "postive list" i.e. those addresses that CAN be used.
1329          *
1330          *   Its a negative list if asconf is allowed. What we do
1331          *   in this case is use the ep address list BUT we have
1332          *   to cross check it against the negative list.
1333          *
1334          *   In the case where NO asconf is allowed, we have just
1335          *   a straight association level list that we must use to
1336          *   find a source address.
1337          */
1338         struct sctp_laddr *laddr, *starting_point;
1339         struct sockaddr_in6 *sin6;
1340         int sin_loop, sin_local;
1341         int start_at_beginning=0;
1342         struct ifnet *ifn;
1343
1344         ifn = rt->rt_ifp;
1345         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1346 #ifdef SCTP_DEBUG
1347                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1348                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1349                 }
1350 #endif
1351                 /* first question, is the ifn we will emit on
1352                  * in our list, if so, we want that one.
1353                  */
1354                 if (ifn) {
1355                         struct ifaddr_container *ifac;
1356
1357                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1358                                 struct ifaddr *ifa = ifac->ifa;
1359
1360                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1361                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1362                                         if (sin6 == NULL)
1363                                                 continue;
1364                                         if ((non_asoc_addr_ok == 0) &&
1365                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1366                                                 /* on the no-no list */
1367                                                 continue;
1368                                         }
1369                                         return (sin6);
1370                                 }
1371                         }
1372                 }
1373                 starting_point = stcb->asoc.last_used_address;
1374                 /* First try for matching scope */
1375         sctp_from_the_top:
1376                 if (stcb->asoc.last_used_address == NULL) {
1377                         start_at_beginning=1;
1378                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1379                 }
1380                 /* search beginning with the last used address */
1381                 for (laddr = stcb->asoc.last_used_address; laddr;
1382                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1383                         if (laddr->ifa == NULL) {
1384                                 /* address has been removed */
1385                                 continue;
1386                         }
1387                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1388                         if (sin6 == NULL)
1389                                 continue;
1390                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1391                                 /* on the no-no list */
1392                                 continue;
1393                         }
1394                         /* is it of matching scope ? */
1395                         if ((loopscope == 0) &&
1396                             (loc_scope == 0) &&
1397                             (sin_loop == 0) &&
1398                             (sin_local == 0)) {
1399                                 /* all of global scope we are ok with it */
1400                                 return (sin6);
1401                         }
1402                         if (loopscope && sin_loop)
1403                                 /* both on the loopback, thats ok */
1404                                 return (sin6);
1405                         if (loc_scope && sin_local)
1406                                 /* both local scope */
1407                                 return (sin6);
1408
1409                 }
1410                 if (start_at_beginning == 0) {
1411                         stcb->asoc.last_used_address = NULL;
1412                         goto sctp_from_the_top;
1413                 }
1414                 /* now try for any higher scope than the destination */
1415                 stcb->asoc.last_used_address = starting_point;
1416                 start_at_beginning = 0;
1417         sctp_from_the_top2:
1418                 if (stcb->asoc.last_used_address == NULL) {
1419                         start_at_beginning=1;
1420                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1421                 }
1422                 /* search beginning with the last used address */
1423                 for (laddr = stcb->asoc.last_used_address; laddr;
1424                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1425                         if (laddr->ifa == NULL) {
1426                                 /* address has been removed */
1427                                 continue;
1428                         }
1429                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1430                         if (sin6 == NULL)
1431                                 continue;
1432                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1433                                 /* on the no-no list */
1434                                 continue;
1435                         }
1436                         return (sin6);
1437                 }
1438                 if (start_at_beginning == 0) {
1439                         stcb->asoc.last_used_address = NULL;
1440                         goto sctp_from_the_top2;
1441                 }
1442         } else {
1443 #ifdef SCTP_DEBUG
1444                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1445                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
1446                 }
1447 #endif
1448                 /* First try for interface output match */
1449                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1450                              sctp_nxt_addr) {
1451                         if (laddr->ifa == NULL) {
1452                                 /* address has been removed */
1453                                 continue;
1454                         }
1455                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1456                         if (sin6 == NULL)
1457                                 continue;
1458                         /* first question, is laddr->ifa an address associated with the emit interface */
1459                         if (ifn) {
1460                                 struct ifaddr_container *ifac;
1461
1462                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1463                                         struct ifaddr *ifa = ifac->ifa;
1464
1465                                         if (laddr->ifa == ifa) {
1466                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1467                                                 return (sin6);
1468                                         }
1469                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1470                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1471                                                 return (sin6);
1472                                         }
1473                                 }
1474                         }
1475                 }
1476                 /* Next try for matching scope */
1477                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1478                              sctp_nxt_addr) {
1479                         if (laddr->ifa == NULL) {
1480                                 /* address has been removed */
1481                                 continue;
1482                         }
1483                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1484                         if (sin6 == NULL)
1485                                 continue;
1486
1487                         if ((loopscope == 0) &&
1488                             (loc_scope == 0) &&
1489                             (sin_loop == 0) &&
1490                             (sin_local == 0)) {
1491                                 /* all of global scope we are ok with it */
1492                                 return (sin6);
1493                         }
1494                         if (loopscope && sin_loop)
1495                                 /* both on the loopback, thats ok */
1496                                 return (sin6);
1497                         if (loc_scope && sin_local)
1498                                 /* both local scope */
1499                                 return (sin6);
1500                 }
1501                 /* ok, now try for a higher scope in the source address */
1502                 /* First try for matching scope */
1503                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1504                              sctp_nxt_addr) {
1505                         if (laddr->ifa == NULL) {
1506                                 /* address has been removed */
1507                                 continue;
1508                         }
1509                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1510                         if (sin6 == NULL)
1511                                 continue;
1512                         return (sin6);
1513                 }
1514         }
1515         return (NULL);
1516 }
1517
1518 static struct sockaddr_in6 *
1519 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1520                                  struct rtentry *rt,
1521                                  uint8_t loc_scope,
1522                                  uint8_t loopscope)
1523 {
1524         /*
1525          * Here we are bound specific and have only
1526          * an inp. We must find an address that is bound
1527          * that we can give out as a src address. We
1528          * prefer two addresses of same scope if we can
1529          * find them that way.
1530          */
1531         struct sctp_laddr *laddr;
1532         struct sockaddr_in6 *sin6;
1533         struct ifnet *ifn;
1534         int sin_loop, sin_local;
1535
1536         /* first question, is the ifn we will emit on
1537          * in our list, if so, we want that one.
1538          */
1539
1540         ifn = rt->rt_ifp;
1541         if (ifn) {
1542                 struct ifaddr_container *ifac;
1543
1544                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1545                         struct ifaddr *ifa = ifac->ifa;
1546
1547                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1548                         if (sin6 == NULL)
1549                                 continue;
1550                         if (sctp_is_addr_in_ep(inp, ifa)) {
1551                                 return (sin6);
1552                         }
1553                 }
1554         }
1555         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1556              laddr && (laddr != inp->next_addr_touse);
1557              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1558                 if (laddr->ifa == NULL) {
1559                         /* address has been removed */
1560                         continue;
1561                 }
1562                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1563                 if (sin6 == NULL)
1564                         continue;
1565
1566                 if ((loopscope == 0) &&
1567                     (loc_scope == 0) &&
1568                     (sin_loop == 0) &&
1569                     (sin_local == 0)) {
1570                         /* all of global scope we are ok with it */
1571                         return (sin6);
1572                 }
1573                 if (loopscope && sin_loop)
1574                         /* both on the loopback, thats ok */
1575                         return (sin6);
1576                 if (loc_scope && sin_local)
1577                         /* both local scope */
1578                         return (sin6);
1579
1580         }
1581         /* if we reach here, we could not find two addresses
1582          * of the same scope to give out. Lets look for any higher level
1583          * scope for a source address.
1584          */
1585         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1586              laddr && (laddr != inp->next_addr_touse);
1587              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1588                 if (laddr->ifa == NULL) {
1589                         /* address has been removed */
1590                         continue;
1591                 }
1592                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1593                 if (sin6 == NULL)
1594                         continue;
1595                 return (sin6);
1596         }
1597         /* no address bound can be a source for the destination */
1598 #ifdef SCTP_DEBUG
1599         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1600                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1601         }
1602 #endif
1603         return (NULL);
1604 }
1605
1606
1607 static struct sockaddr_in6 *
1608 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1609                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1610 {
1611         struct ifaddr_container *ifac;
1612         struct sockaddr_in6 *sin6;
1613         int sin_loop, sin_local;
1614         int num_eligible_addr = 0;
1615
1616         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1617                 struct ifaddr *ifa = ifac->ifa;
1618
1619                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1620                 if (sin6 == NULL)
1621                         continue;
1622                 if (stcb) {
1623                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1624                                 /* It is restricted for some reason.. probably
1625                                  * not yet added.
1626                                  */
1627                                 continue;
1628                         }
1629                 }
1630                 if (match_scope) {
1631                         /* Here we are asked to match scope if possible */
1632                         if (loopscope && sin_loop)
1633                                 /* src and destination are loopback scope */
1634                                 return (sin6);
1635                         if (loc_scope && sin_local)
1636                                 /* src and destination are local scope */
1637                                 return (sin6);
1638                         if ((loopscope == 0) &&
1639                             (loc_scope == 0)  &&
1640                             (sin_loop == 0) &&
1641                             (sin_local == 0)) {
1642                                 /* src and destination are global scope */
1643                                 return (sin6);
1644                         }
1645                         continue;
1646                 }
1647                 if (num_eligible_addr == cur_addr_num) {
1648                         /* this is it */
1649                         return (sin6);
1650                 }
1651                 num_eligible_addr++;
1652         }
1653         return (NULL);
1654 }
1655
1656
1657 static int
1658 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1659                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1660 {
1661         struct ifaddr_container *ifac;
1662         struct sockaddr_in6 *sin6;
1663         int num_eligible_addr = 0;
1664         int sin_loop, sin_local;
1665
1666         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1667                 struct ifaddr *ifa = ifac->ifa;
1668
1669                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1670                 if (sin6 == NULL)
1671                         continue;
1672                 if (stcb) {
1673                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1674                                 /* It is restricted for some reason.. probably
1675                                  * not yet added.
1676                                  */
1677                                 continue;
1678                         }
1679                 }
1680                 num_eligible_addr++;
1681         }
1682         return (num_eligible_addr);
1683 }
1684
1685
1686 static struct sockaddr_in6 *
1687 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1688                         struct sctp_tcb *stcb,
1689                         struct sctp_nets *net,
1690                         struct rtentry *rt,
1691                         uint8_t loc_scope,
1692                         uint8_t loopscope,
1693                         int non_asoc_addr_ok)
1694 {
1695         /* Ok, we are bound all SO any address
1696          * is ok to use as long as it is NOT in the negative
1697          * list.
1698          */
1699         int num_eligible_addr;
1700         int cur_addr_num=0;
1701         int started_at_beginning=0;
1702         int match_scope_prefered;
1703         /* first question is, how many eligible addresses are
1704          * there for the destination ifn that we are using that
1705          * are within the proper scope?
1706          */
1707         struct ifnet *ifn;
1708         struct sockaddr_in6 *sin6;
1709
1710         ifn = rt->rt_ifp;
1711         if (net) {
1712                 cur_addr_num = net->indx_of_eligible_next_to_use;
1713         }
1714         if (cur_addr_num == 0) {
1715                 match_scope_prefered = 1;
1716         } else {
1717                 match_scope_prefered = 0;
1718         }
1719         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1720 #ifdef SCTP_DEBUG
1721         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1722                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1723         }
1724 #endif
1725         if (num_eligible_addr == 0) {
1726                 /* no eligible addresses, we must use some other
1727                  * interface address if we can find one.
1728                  */
1729                 goto bound_all_v6_plan_b;
1730         }
1731         /* Ok we have num_eligible_addr set with how many we can use,
1732          * this may vary from call to call due to addresses being deprecated etc..
1733          */
1734         if (cur_addr_num >= num_eligible_addr) {
1735                 cur_addr_num = 0;
1736         }
1737         /* select the nth address from the list (where cur_addr_num is the nth) and
1738          * 0 is the first one, 1 is the second one etc...
1739          */
1740 #ifdef SCTP_DEBUG
1741         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1742                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1743                        cur_addr_num, match_scope_prefered);
1744         }
1745 #endif
1746         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1747                                                           loc_scope, cur_addr_num, match_scope_prefered);
1748         if (match_scope_prefered && (sin6 == NULL)) {
1749                 /* retry without the preference for matching scope */
1750 #ifdef SCTP_DEBUG
1751         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1752                 kprintf("retry with no match_scope_prefered\n");
1753         }
1754 #endif
1755                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1756                                                                   loc_scope, cur_addr_num, 0);
1757         }
1758         if (sin6) {
1759 #ifdef SCTP_DEBUG
1760                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1761                         kprintf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1762                 }
1763 #endif
1764                 if (net) {
1765                         /* store so we get the next one */
1766                         if (cur_addr_num < 255)
1767                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1768                         else
1769                                 net->indx_of_eligible_next_to_use = 0;
1770                 }
1771                 return (sin6);
1772         }
1773         num_eligible_addr = 0;
1774  bound_all_v6_plan_b:
1775         /* ok, if we reach here we either fell through
1776          * due to something changing during an interupt (unlikely)
1777          * or we have NO eligible source addresses for the ifn
1778          * of the route (most likely). We must look at all the other
1779          * interfaces EXCEPT rt->rt_ifp and do the same game.
1780          */
1781 #ifdef SCTP_DEBUG
1782         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1783                 kprintf("bound-all Plan B\n");
1784         }
1785 #endif
1786         if (inp->next_ifn_touse == NULL) {
1787                 started_at_beginning=1;
1788                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1789 #ifdef SCTP_DEBUG
1790                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1791                         kprintf("Start at first IFN:%p\n", inp->next_ifn_touse);
1792                 }
1793 #endif
1794         } else {
1795                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1796 #ifdef SCTP_DEBUG
1797                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1798                         kprintf("Resume at IFN:%p\n", inp->next_ifn_touse);
1799                 }
1800 #endif
1801                 if (inp->next_ifn_touse == NULL) {
1802 #ifdef SCTP_DEBUG
1803                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1804                                 kprintf("IFN Resets\n");
1805                         }
1806 #endif
1807                         started_at_beginning=1;
1808                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1809                 }
1810         }
1811         for (ifn = inp->next_ifn_touse; ifn;
1812              ifn = TAILQ_NEXT(ifn, if_list)) {
1813                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1814                         /* wrong base scope */
1815                         continue;
1816                 }
1817                 if (loc_scope && (ifn->if_index != loc_scope)) {
1818                         /* by definition the scope (from to->sin6_scopeid)
1819                          * must match that of the interface. If not then
1820                          * we could pick a wrong scope for the address.
1821                          * Ususally we don't hit plan-b since the route
1822                          * handles this. However we can hit plan-b when
1823                          * we send to local-host so the route is the
1824                          * loopback interface, but the destination is a
1825                          * link local.
1826                          */
1827                         continue;
1828                 }
1829                 if (ifn == rt->rt_ifp) {
1830                         /* already looked at this guy */
1831                         continue;
1832                 }
1833                 /* Address rotation will only work when we are not
1834                  * rotating sourced interfaces and are using the interface
1835                  * of the route. We would need to have a per interface index
1836                  * in order to do proper rotation.
1837                  */
1838                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1839 #ifdef SCTP_DEBUG
1840                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1841                         kprintf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1842                 }
1843 #endif
1844                 if (num_eligible_addr == 0) {
1845                         /* none we can use */
1846                         continue;
1847                 }
1848                 /* Ok we have num_eligible_addr set with how many we can use,
1849                  * this may vary from call to call due to addresses being deprecated etc..
1850                  */
1851                 inp->next_ifn_touse = ifn;
1852
1853                 /* select the first one we can find with perference for matching scope.
1854                  */
1855                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1856                 if (sin6 == NULL) {
1857                         /* can't find one with matching scope how about a source with higher
1858                          * scope
1859                          */
1860                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1861                         if (sin6 == NULL)
1862                                 /* Hmm, can't find one in the interface now */
1863                                 continue;
1864                 }
1865 #ifdef SCTP_DEBUG
1866                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1867                         kprintf("Selected the %d'th address of ifn:%p\n",
1868                                cur_addr_num,
1869                                ifn);
1870                 }
1871 #endif
1872                 return (sin6);
1873         }
1874         if (started_at_beginning == 0) {
1875                 /* we have not been through all of them yet, force
1876                  * us to go through them all.
1877                  */
1878 #ifdef SCTP_DEBUG
1879                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1880                         kprintf("Force a recycle\n");
1881                 }
1882 #endif
1883                 inp->next_ifn_touse = NULL;
1884                 goto bound_all_v6_plan_b;
1885         }
1886         return (NULL);
1887
1888 }
1889
1890 /* stcb and net may be NULL */
1891 struct in6_addr
1892 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1893     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1894     int non_asoc_addr_ok)
1895 {
1896         struct in6_addr ans;
1897         struct sockaddr_in6 *rt_addr;
1898         uint8_t loc_scope, loopscope;
1899         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1900
1901         /*
1902          * This routine is tricky standard v6 src address
1903          * selection cannot take into account what we have
1904          * bound etc, so we can't use it.
1905          *
1906          * Instead here is what we must do:
1907          * 1) Make sure we have a route, if we
1908          *    don't have a route we can never reach the peer.
1909          * 2) Once we have a route, determine the scope of the
1910          *     route. Link local, loopback or global.
1911          * 3) Next we divide into three types. Either we
1912          *    are bound all.. which means we want to use
1913          *    one of the addresses of the interface we are
1914          *    going out. <or>
1915          * 4a) We have not stcb, which means we are using the
1916          *    specific addresses bound on an inp, in this
1917          *    case we are similar to the stcb case (4b below)
1918          *    accept the list is always a positive list.<or>
1919          * 4b) We are bound specific with a stcb, which means we have a
1920          *    list of bound addresses and we must see if the
1921          *    ifn of the route is actually one of the bound addresses.
1922          *    If not, then we must rotate addresses amongst properly
1923          *    scoped bound addresses, if so we use the address
1924          *    of the interface.
1925          * 5) Always, no matter which path we take through the above
1926          *    we must be sure the source address we use is allowed to
1927          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1928          *    addresses cannot be used.
1929          * 6) Addresses that are deprecated MAY be used
1930          *              if (!ip6_use_deprecated) {
1931          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1932          *                        skip the address
1933          *                    }
1934          *              }
1935          */
1936
1937         /*** 1> determine route, if not already done */
1938         if (ro->ro_rt == NULL) {
1939                 /*
1940                  * Need a route to cache.
1941                  */
1942 #ifndef SCOPEDROUTING
1943                 int scope_save;
1944                 scope_save = to->sin6_scope_id;
1945                 to->sin6_scope_id = 0;
1946 #endif
1947
1948 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1949                 rtalloc_ign(ro, 0UL);
1950 #else
1951                 rtalloc(ro);
1952 #endif
1953 #ifndef SCOPEDROUTING
1954                 to->sin6_scope_id = scope_save;
1955 #endif
1956         }
1957         if (ro->ro_rt == NULL) {
1958                 /*
1959                  * no route to host. this packet is going no-where.
1960                  * We probably should make sure we arrange to send back
1961                  * an error.
1962                  */
1963 #ifdef SCTP_DEBUG
1964                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1965                         kprintf("No route to host, this packet cannot be sent!\n");
1966                 }
1967 #endif
1968                 memset(&ans, 0, sizeof(ans));
1969                 return (ans);
1970         }
1971
1972         /*** 2a> determine scope for outbound address/route */
1973         loc_scope = loopscope = 0;
1974         /*
1975          * We base our scope on the outbound packet scope and route,
1976          * NOT the TCB (if there is one). This way in local scope we will only
1977          * use a local scope src address when we send to a local address.
1978          */
1979
1980         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1981                 /* If the route goes to the loopback address OR
1982                  * the address is a loopback address, we are loopback
1983                  * scope.
1984                  */
1985 #ifdef SCTP_DEBUG
1986                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1987                         kprintf("Loopback scope is set\n");
1988                 }
1989 #endif
1990                 loc_scope = 0;
1991                 loopscope = 1;
1992                 if (net != NULL) {
1993                         /* mark it as local */
1994                         net->addr_is_local = 1;
1995                 }
1996
1997         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
1998 #ifdef SCTP_DEBUG
1999                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2000                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2001                 }
2002 #endif
2003                 if (to->sin6_scope_id)
2004                         loc_scope = to->sin6_scope_id;
2005                 else {
2006                         loc_scope = 1;
2007                 }
2008                 loopscope = 0;
2009         } else {
2010 #ifdef SCTP_DEBUG
2011                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2012                         kprintf("Global scope is set\n");
2013                 }
2014 #endif
2015         }
2016
2017         /* now, depending on which way we are bound we call the appropriate
2018          * routine to do steps 3-6
2019          */
2020 #ifdef SCTP_DEBUG
2021         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2022                 kprintf("Destination address:");
2023                 sctp_print_address((struct sockaddr *)to);
2024         }
2025 #endif
2026
2027         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2028 #ifdef SCTP_DEBUG
2029                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2030                         kprintf("Calling bound-all src addr selection for v6\n");
2031                 }
2032 #endif
2033                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2034         } else {
2035 #ifdef SCTP_DEBUG
2036                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2037                         kprintf("Calling bound-specific src addr selection for v6\n");
2038                 }
2039 #endif
2040                 if (stcb)
2041                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2042                 else
2043                         /* we can't have a non-asoc address since we have no association */
2044                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2045         }
2046         if (rt_addr == NULL) {
2047                 /* no suitable address? */
2048                 struct in6_addr in6;
2049 #ifdef SCTP_DEBUG
2050                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2051                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2052                 }
2053 #endif
2054                 memset(&in6, 0, sizeof(in6));
2055                 return (in6);
2056         }
2057 #ifdef SCTP_DEBUG
2058         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2059                 kprintf("Source address selected is:");
2060                 sctp_print_address((struct sockaddr *)rt_addr);
2061         }
2062 #endif
2063         return (rt_addr->sin6_addr);
2064 }
2065
2066 static uint8_t
2067 sctp_get_ect(struct sctp_tcb *stcb,
2068              struct sctp_tmit_chunk *chk)
2069 {
2070         uint8_t this_random;
2071
2072         /* Huh? */
2073         if (sctp_ecn == 0)
2074                 return (0);
2075
2076         if (sctp_ecn_nonce == 0)
2077                 /* no nonce, always return ECT0 */
2078                 return (SCTP_ECT0_BIT);
2079
2080         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2081                 /* Peer does NOT support it, so we send a ECT0 only */
2082                 return (SCTP_ECT0_BIT);
2083         }
2084
2085         if (chk == NULL)
2086            return (SCTP_ECT0_BIT);
2087
2088         if (((stcb->asoc.hb_random_idx == 3) &&
2089              (stcb->asoc.hb_ect_randombit > 7)) ||
2090              (stcb->asoc.hb_random_idx > 3)) {
2091                 uint32_t rndval;
2092                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2093                 memcpy(stcb->asoc.hb_random_values, &rndval,
2094                        sizeof(stcb->asoc.hb_random_values));
2095                 this_random = stcb->asoc.hb_random_values[0];
2096                 stcb->asoc.hb_random_idx = 0;
2097                 stcb->asoc.hb_ect_randombit = 0;
2098         } else {
2099                 if (stcb->asoc.hb_ect_randombit > 7) {
2100                   stcb->asoc.hb_ect_randombit = 0;
2101                   stcb->asoc.hb_random_idx++;
2102                 }
2103                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2104         }
2105         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2106                 if (chk != NULL)
2107                         /* ECN Nonce stuff */
2108                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2109                 stcb->asoc.hb_ect_randombit++;
2110                 return (SCTP_ECT1_BIT);
2111         } else {
2112                 stcb->asoc.hb_ect_randombit++;
2113                 return (SCTP_ECT0_BIT);
2114         }
2115 }
2116
2117 extern int sctp_no_csum_on_loopback;
2118
2119 static int
2120 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2121                            struct sctp_tcb *stcb,    /* may be NULL */
2122                            struct sctp_nets *net,
2123                            struct sockaddr *to,
2124                            struct mbuf *m,
2125                            int nofragment_flag,
2126                            int ecn_ok,
2127                            struct sctp_tmit_chunk *chk,
2128                            int out_of_asoc_ok)
2129         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2130 {
2131         /*
2132          * Given a mbuf chain (via m_next) that holds a packet header
2133          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2134          * - calculate SCTP checksum and fill in
2135          * - prepend a IP address header
2136          * - if boundall use INADDR_ANY
2137          * - if boundspecific do source address selection
2138          * - set fragmentation option for ipV4
2139          * - On return from IP output, check/adjust mtu size
2140          * - of output interface and smallest_mtu size as well.
2141          */
2142         struct sctphdr *sctphdr;
2143         int o_flgs;
2144         uint32_t csum;
2145         int ret;
2146         unsigned int have_mtu;
2147         struct route *ro;
2148
2149         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2150                 sctp_m_freem(m);
2151                 return (EFAULT);
2152         }
2153         if ((m->m_flags & M_PKTHDR) == 0) {
2154 #ifdef SCTP_DEBUG
2155                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2156                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2157                 }
2158 #endif
2159                 sctp_m_freem(m);
2160                 return (EFAULT);
2161         }
2162         /* Calculate the csum and fill in the length of the packet */
2163         sctphdr = mtod(m, struct sctphdr *);
2164         have_mtu = 0;
2165         if (sctp_no_csum_on_loopback &&
2166              (stcb) &&
2167              (stcb->asoc.loopback_scope)) {
2168                 sctphdr->checksum = 0;
2169                 m->m_pkthdr.len = sctp_calculate_len(m);
2170         } else {
2171                 sctphdr->checksum = 0;
2172                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2173                 sctphdr->checksum = csum;
2174         }
2175         if (to->sa_family == AF_INET) {
2176                 struct ip *ip;
2177                 struct route iproute;
2178                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2179                 if (m == NULL) {
2180                         /* failed to prepend data, give up */
2181                         return (ENOMEM);
2182                 }
2183                 ip = mtod(m, struct ip *);
2184                 ip->ip_v = IPVERSION;
2185                 ip->ip_hl = (sizeof(struct ip) >> 2);
2186                 if (nofragment_flag) {
2187 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2188 #if defined( __OpenBSD__) || defined(__NetBSD__)
2189                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2190                         ip->ip_off = htons(IP_DF);
2191 #else
2192                         ip->ip_off = IP_DF;
2193 #endif
2194 #else
2195                         ip->ip_off = htons(IP_DF);
2196 #endif
2197                 } else
2198                         ip->ip_off = 0;
2199
2200 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2201 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2202                 ip->ip_id = htons(ip_randomid());
2203 #else
2204                 ip->ip_id = htons(ip_id++);
2205 #endif
2206
2207 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2208                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2209 #else
2210                 ip->ip_ttl = inp->inp_ip_ttl;
2211 #endif
2212 #if defined(__OpenBSD__) || defined(__NetBSD__)
2213                 ip->ip_len = htons(m->m_pkthdr.len);
2214 #else
2215                 ip->ip_len = m->m_pkthdr.len;
2216 #endif
2217                 if (stcb) {
2218                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2219                                 /* Enable ECN */
2220 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2221                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2222                                                       sctp_get_ect(stcb, chk));
2223 #elif defined(__NetBSD__)
2224                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2225                                                       sctp_get_ect(stcb, chk));
2226 #else
2227                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2228                                                       sctp_get_ect(stcb, chk));
2229 #endif
2230                         } else {
2231                                 /* No ECN */
2232 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2233                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2234 #elif defined(__NetBSD__)
2235                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2236 #else
2237                                 ip->ip_tos = inp->inp_ip_tos;
2238 #endif
2239                         }
2240                 } else {
2241                         /* no association at all */
2242 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2243                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2244 #else
2245                         ip->ip_tos = inp->inp_ip_tos;
2246 #endif
2247                 }
2248                 ip->ip_p = IPPROTO_SCTP;
2249                 ip->ip_sum = 0;
2250                 if (net == NULL) {
2251                         ro = &iproute;
2252                         memset(&iproute, 0, sizeof(iproute));
2253                         memcpy(&ro->ro_dst, to, to->sa_len);
2254                 } else {
2255                         ro = (struct route *)&net->ro;
2256                 }
2257                 /* Now the address selection part */
2258                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2259
2260                 /* call the routine to select the src address */
2261                 if (net) {
2262                         if (net->src_addr_selected == 0) {
2263                                 /* Cache the source address */
2264                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2265                                     stcb,
2266                                     ro, net, out_of_asoc_ok);
2267                                 if (ro->ro_rt)
2268                                         net->src_addr_selected = 1;
2269                         }
2270                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2271                 } else {
2272                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2273                             stcb, ro, net, out_of_asoc_ok);
2274                 }
2275                 /*
2276                  * If source address selection fails and we find no route then
2277                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2278                  * type error. We probably should catch that somewhere and
2279                  * abort the association right away (assuming this is an INIT
2280                  * being sent).
2281                  */
2282                 if ((ro->ro_rt == NULL)) {
2283                         /*
2284                          * src addr selection failed to find a route (or valid
2285                          * source addr), so we can't get there from here!
2286                          */
2287 #ifdef SCTP_DEBUG
2288                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2289                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2290                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2291                         }
2292 #endif /* SCTP_DEBUG */
2293                         if (net) {
2294                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2295                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2296                                                         stcb,
2297                                                         SCTP_FAILED_THRESHOLD,
2298                                                         (void *)net);
2299                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2300                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2301                                 if (stcb) {
2302                                         if (net == stcb->asoc.primary_destination) {
2303                                                 /* need a new primary */
2304                                                 struct sctp_nets *alt;
2305                                                 alt = sctp_find_alternate_net(stcb, net);
2306                                                 if (alt != net) {
2307                                                         if (sctp_set_primary_addr(stcb,
2308                                                                               NULL,
2309                                                                                  alt) == 0) {
2310                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2311                                                                 net->src_addr_selected = 0;
2312                                                         }
2313                                                 }
2314                                         }
2315                                 }
2316                         }
2317                         sctp_m_freem(m);
2318                         return (EHOSTUNREACH);
2319                 } else {
2320                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2321                 }
2322
2323                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2324 #ifdef SCTP_DEBUG
2325                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2326                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2327                                (u_int)(ntohl(ip->ip_src.s_addr)));
2328                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2329                         kprintf("RTP route is %p through\n", ro->ro_rt);
2330                 }
2331 #endif
2332                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2333                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2334                 }
2335                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2336                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2337 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2338     || defined(__DragonFly__)
2339                                 , NULL
2340 #endif
2341 #if defined(__NetBSD__)
2342                                 ,(struct socket *)inp->sctp_socket
2343 #endif
2344
2345 );
2346                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2347                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2348                 }
2349                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2350 #ifdef SCTP_DEBUG
2351                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2352                         kprintf("Ip output returns %d\n", ret);
2353                 }
2354 #endif
2355                 if (net == NULL) {
2356                         /* free tempy routes */
2357                         if (ro->ro_rt)
2358                                 RTFREE(ro->ro_rt);
2359                 } else {
2360                         /* PMTU check versus smallest asoc MTU goes here */
2361                         if (ro->ro_rt != NULL) {
2362                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2363                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2364                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2365                                             ro->ro_rt->rt_rmx.rmx_mtu);
2366                                 }
2367                         } else {
2368                                 /* route was freed */
2369                                 net->src_addr_selected = 0;
2370                         }
2371                 }
2372                 return (ret);
2373         }
2374 #ifdef INET6
2375         else if (to->sa_family == AF_INET6) {
2376                 struct ip6_hdr *ip6h;
2377 #ifdef NEW_STRUCT_ROUTE
2378                 struct route ip6route;
2379 #else
2380                 struct route_in6 ip6route;
2381 #endif
2382                 struct ifnet *ifp;
2383                 u_char flowTop;
2384                 uint16_t flowBottom;
2385                 u_char tosBottom, tosTop;
2386                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2387                 struct sockaddr_in6 lsa6_storage;
2388                 int prev_scope=0;
2389                 int error;
2390                 u_short prev_port=0;
2391
2392                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2393                 if (m == NULL) {
2394                         /* failed to prepend data, give up */
2395                         return (ENOMEM);
2396                 }
2397                 ip6h = mtod(m, struct ip6_hdr *);
2398
2399                 /*
2400                  * We assume here that inp_flow is in host byte order within
2401                  * the TCB!
2402                  */
2403                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2404                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2405
2406                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2407
2408                 /* protect *sin6 from overwrite */
2409                 sin6 = (struct sockaddr_in6 *)to;
2410                 tmp = *sin6;
2411                 sin6 = &tmp;
2412
2413                 /* KAME hack: embed scopeid */
2414 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2415                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2416 #else
2417                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2418 #endif
2419                         return (EINVAL);
2420                 if (net == NULL) {
2421                         memset(&ip6route, 0, sizeof(ip6route));
2422                         ro = (struct route *)&ip6route;
2423                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2424                 } else {
2425                         ro = (struct route *)&net->ro;
2426                 }
2427                 if (stcb != NULL) {
2428                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2429                                 /* Enable ECN */
2430                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2431                         } else {
2432                                 /* No ECN */
2433                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2434                         }
2435                 } else {
2436                         /* we could get no asoc if it is a O-O-T-B packet */
2437                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2438                 }
2439                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2440                 ip6h->ip6_nxt = IPPROTO_SCTP;
2441                 ip6h->ip6_plen = m->m_pkthdr.len;
2442                 ip6h->ip6_dst = sin6->sin6_addr;
2443
2444                 /*
2445                  * Add SRC address selection here:
2446                  * we can only reuse to a limited degree the kame src-addr-sel,
2447                  * since we can try their selection but it may not be bound.
2448                  */
2449                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2450                 lsa6_tmp.sin6_family = AF_INET6;
2451                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2452                 lsa6 = &lsa6_tmp;
2453                 if (net) {
2454                         if (net->src_addr_selected == 0) {
2455                                 /* Cache the source address */
2456                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2457                                     stcb, ro, net, out_of_asoc_ok);
2458
2459                                 if (ro->ro_rt)
2460                                         net->src_addr_selected = 1;
2461                         }
2462                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2463                 } else {
2464                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2465                             inp, stcb, ro, net, out_of_asoc_ok);
2466                 }
2467                 lsa6->sin6_port = inp->sctp_lport;
2468
2469                 if ((ro->ro_rt ==  NULL)) {
2470                         /*
2471                          * src addr selection failed to find a route (or valid
2472                          * source addr), so we can't get there from here!
2473                          */
2474 #ifdef SCTP_DEBUG
2475                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2476                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2477                         }
2478 #endif
2479                         sctp_m_freem(m);
2480                         if (net) {
2481                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2482                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2483                                                         stcb,
2484                                                         SCTP_FAILED_THRESHOLD,
2485                                                         (void *)net);
2486                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2487                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2488                                 if (stcb) {
2489                                         if (net == stcb->asoc.primary_destination) {
2490                                                 /* need a new primary */
2491                                                 struct sctp_nets *alt;
2492                                                 alt = sctp_find_alternate_net(stcb, net);
2493                                                 if (alt != net) {
2494                                                         if (sctp_set_primary_addr(stcb,
2495                                                                               NULL,
2496                                                                                  alt) == 0) {
2497                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2498                                                                 net->src_addr_selected = 0;
2499                                                         }
2500                                                 }
2501                                         }
2502                                 }
2503                         }
2504                         return (EHOSTUNREACH);
2505                 }
2506
2507 #ifndef SCOPEDROUTING
2508                 /*
2509                  * XXX: sa6 may not have a valid sin6_scope_id in
2510                  * the non-SCOPEDROUTING case.
2511                  */
2512                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2513                 lsa6_storage.sin6_family = AF_INET6;
2514                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2515                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2516                                               NULL)) != 0) {
2517                         sctp_m_freem(m);
2518                         return (error);
2519                 }
2520                 /* XXX */
2521                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2522                 lsa6_storage.sin6_port = inp->sctp_lport;
2523                 lsa6 = &lsa6_storage;
2524 #endif /* SCOPEDROUTING */
2525                 ip6h->ip6_src = lsa6->sin6_addr;
2526
2527                 /*
2528                  * We set the hop limit now since there is a good chance that
2529                  * our ro pointer is now filled
2530                  */
2531                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2532                                                 (ro ?
2533                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2534                                                  (NULL)));
2535                 o_flgs = 0;
2536                 ifp = ro->ro_rt->rt_ifp;
2537 #ifdef SCTP_DEBUG
2538                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2539                         /* Copy to be sure something bad is not happening */
2540                         sin6->sin6_addr = ip6h->ip6_dst;
2541                         lsa6->sin6_addr = ip6h->ip6_src;
2542
2543                         kprintf("Calling ipv6 output routine from low level\n");
2544                         kprintf("src: ");
2545                         sctp_print_address((struct sockaddr *)lsa6);
2546                         kprintf("dst: ");
2547                         sctp_print_address((struct sockaddr *)sin6);
2548                 }
2549 #endif /* SCTP_DEBUG */
2550                 if (net) {
2551                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2552                         /* preserve the port and scope for link local send */
2553                         prev_scope = sin6->sin6_scope_id;
2554                         prev_port = sin6->sin6_port;
2555                 }
2556                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2557 #ifdef NEW_STRUCT_ROUTE
2558                                  ro,
2559 #else
2560                                  (struct route_in6 *)ro,
2561 #endif
2562                                  o_flgs,
2563                                  ((struct in6pcb *)inp)->in6p_moptions,
2564 #if defined(__NetBSD__)
2565                                  (struct socket *)inp->sctp_socket,
2566 #endif
2567                                  &ifp
2568 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2569                     , NULL
2570 #endif
2571                         );
2572                 if (net) {
2573                         /* for link local this must be done */
2574                         sin6->sin6_scope_id = prev_scope;
2575                         sin6->sin6_port = prev_port;
2576                 }
2577 #ifdef SCTP_DEBUG
2578                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2579                         kprintf("return from send is %d\n", ret);
2580                 }
2581 #endif /* SCTP_DEBUG_OUTPUT */
2582                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2583                 if (net == NULL) {
2584                         /* Now if we had a temp route free it */
2585                         if (ro->ro_rt) {
2586                                 RTFREE(ro->ro_rt);
2587                         }
2588                 } else {
2589                         /* PMTU check versus smallest asoc MTU goes here */
2590                         if (ro->ro_rt == NULL) {
2591                                 /* Route was freed */
2592                                 net->src_addr_selected = 0;
2593                         }
2594                         if (ro->ro_rt != NULL) {
2595                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2596                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2597                                         sctp_mtu_size_reset(inp,
2598                                                             &stcb->asoc,
2599                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2600                                 }
2601                         } else if (ifp) {
2602 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2603 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2604 #endif /* SCTP_BASE_FREEBSD */
2605                                 if (ND_IFINFO(ifp)->linkmtu &&
2606                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2607                                         sctp_mtu_size_reset(inp,
2608                                                             &stcb->asoc,
2609                                                             ND_IFINFO(ifp)->linkmtu);
2610                                 }
2611                         }
2612                 }
2613                 return (ret);
2614         }
2615 #endif
2616         else {
2617 #ifdef SCTP_DEBUG
2618                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2619                         kprintf("Unknown protocol (TSNH) type %d\n",
2620                             to->sa_family);
2621                 }
2622 #endif
2623                 sctp_m_freem(m);
2624                 return (EFAULT);
2625         }
2626 }
2627
2628 static int
2629 sctp_is_address_in_scope(struct ifaddr *ifa,
2630                          int ipv4_addr_legal,
2631                          int ipv6_addr_legal,
2632                          int loopback_scope,
2633                          int ipv4_local_scope,
2634                          int local_scope,
2635                          int site_scope)
2636 {
2637         if ((loopback_scope == 0) &&
2638             (ifa->ifa_ifp) &&
2639             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2640                 /* skip loopback if not in scope *
2641                  */
2642                 return (0);
2643         }
2644         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2645                 struct sockaddr_in *sin;
2646                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2647                 if (sin->sin_addr.s_addr == 0) {
2648                         /* not in scope , unspecified */
2649                         return (0);
2650                 }
2651                 if ((ipv4_local_scope == 0) &&
2652                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2653                         /* private address not in scope */
2654                         return (0);
2655                 }
2656         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2657                 struct sockaddr_in6 *sin6;
2658                 struct in6_ifaddr *ifa6;
2659
2660                 ifa6 = (struct in6_ifaddr *)ifa;
2661                 /* ok to use deprecated addresses? */
2662                 if (!ip6_use_deprecated) {
2663                         if (ifa6->ia6_flags &
2664                             IN6_IFF_DEPRECATED) {
2665                                 return (0);
2666                         }
2667                 }
2668                 if (ifa6->ia6_flags &
2669                     (IN6_IFF_DETACHED |
2670                      IN6_IFF_ANYCAST |
2671                      IN6_IFF_NOTREADY)) {
2672                         return (0);
2673                 }
2674                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2675                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2676                         /* skip unspecifed addresses */
2677                         return (0);
2678                 }
2679                 if (/*(local_scope == 0) && */
2680                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2681                         return (0);
2682                 }
2683                 if ((site_scope == 0) &&
2684                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2685                         return (0);
2686                 }
2687         } else {
2688                 return (0);
2689         }
2690         return (1);
2691 }
2692
2693
2694 void
2695 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2696 {
2697         struct mbuf *m, *m_at, *m_last;
2698         struct sctp_nets *net;
2699         struct sctp_init_msg *initm;
2700         struct sctp_supported_addr_param *sup_addr;
2701         struct sctp_ecn_supported_param *ecn;
2702         struct sctp_prsctp_supported_param *prsctp;
2703         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2704         struct sctp_supported_chunk_types_param *pr_supported;
2705         int cnt_inits_to=0;
2706         int padval, ret;
2707
2708         /* INIT's always go to the primary (and usually ONLY address) */
2709         m_last = NULL;
2710         net = stcb->asoc.primary_destination;
2711         if (net == NULL) {
2712                 net = TAILQ_FIRST(&stcb->asoc.nets);
2713                 if (net == NULL) {
2714                         /* TSNH */
2715                         return;
2716                 }
2717                 /* we confirm any address we send an INIT to */
2718                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2719                 sctp_set_primary_addr(stcb, NULL, net);
2720         } else {
2721                 /* we confirm any address we send an INIT to */
2722                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2723         }
2724 #ifdef SCTP_DEBUG
2725         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2726                 kprintf("Sending INIT to ");
2727                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2728         }
2729 #endif
2730         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2731                 /* special hook, if we are sending to link local
2732                  * it will not show up in our private address count.
2733                  */
2734                 struct sockaddr_in6 *sin6l;
2735                 sin6l = &net->ro._l_addr.sin6;
2736                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2737                         cnt_inits_to = 1;
2738         }
2739         if (callout_pending(&net->rxt_timer.timer)) {
2740                 /* This case should not happen */
2741                 return;
2742         }
2743         /* start the INIT timer */
2744         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2745                 /* we are hosed since I can't start the INIT timer? */
2746                 return;
2747         }
2748         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2749         if (m == NULL) {
2750                 /* No memory, INIT timer will re-attempt. */
2751                 return;
2752         }
2753         /* make it into a M_EXT */
2754         MCLGET(m, MB_DONTWAIT);
2755         if ((m->m_flags & M_EXT) != M_EXT) {
2756                 /* Failed to get cluster buffer */
2757                 sctp_m_freem(m);
2758                 return;
2759         }
2760         m->m_data += SCTP_MIN_OVERHEAD;
2761         m->m_len = sizeof(struct sctp_init_msg);
2762         /* Now lets put the SCTP header in place */
2763         initm = mtod(m, struct sctp_init_msg *);
2764         initm->sh.src_port = inp->sctp_lport;
2765         initm->sh.dest_port = stcb->rport;
2766         initm->sh.v_tag = 0;
2767         initm->sh.checksum = 0; /* calculate later */
2768         /* now the chunk header */
2769         initm->msg.ch.chunk_type = SCTP_INITIATION;
2770         initm->msg.ch.chunk_flags = 0;
2771         /* fill in later from mbuf we build */
2772         initm->msg.ch.chunk_length = 0;
2773         /* place in my tag */
2774         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2775         /* set up some of the credits. */
2776         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2777             SCTP_MINIMAL_RWND));
2778
2779         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2780         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2781         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2782         /* now the address restriction */
2783         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2784             sizeof(*initm));
2785         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2786         /* we support 2 types IPv6/IPv4 */
2787         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2788                                           sizeof(uint16_t));
2789         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2790         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2791         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2792
2793 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2794         if (inp->sctp_ep.adaption_layer_indicator) {
2795                 struct sctp_adaption_layer_indication *ali;
2796                 ali = (struct sctp_adaption_layer_indication *)(
2797                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2798                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2799                 ali->ph.param_length = htons(sizeof(*ali));
2800                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2801                 m->m_len += sizeof(*ali);
2802                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2803                     sizeof(*ali));
2804         } else {
2805                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2806                     sizeof(*sup_addr) + sizeof(uint16_t));
2807         }
2808
2809         /* now any cookie time extensions */
2810         if (stcb->asoc.cookie_preserve_req) {
2811                 struct sctp_cookie_perserve_param *cookie_preserve;
2812                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2813                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2814                 cookie_preserve->ph.param_length = htons(
2815                     sizeof(*cookie_preserve));
2816                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2817                 m->m_len += sizeof(*cookie_preserve);
2818                 ecn = (struct sctp_ecn_supported_param *)(
2819                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2820                 stcb->asoc.cookie_preserve_req = 0;
2821         }
2822
2823         /* ECN parameter */
2824         if (sctp_ecn == 1) {
2825                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2826                 ecn->ph.param_length = htons(sizeof(*ecn));
2827                 m->m_len += sizeof(*ecn);
2828                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2829                     sizeof(*ecn));
2830         } else {
2831                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2832         }
2833         /* And now tell the peer we do pr-sctp */
2834         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2835         prsctp->ph.param_length = htons(sizeof(*prsctp));
2836         m->m_len += sizeof(*prsctp);
2837
2838
2839         /* And now tell the peer we do all the extensions */
2840         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2841            sizeof(*prsctp));
2842
2843         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2844         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2845         pr_supported->chunk_types[0] = SCTP_ASCONF;
2846         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2847         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2848         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2849         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2850         pr_supported->chunk_types[5] = 0; /* pad */
2851         pr_supported->chunk_types[6] = 0; /* pad */
2852         pr_supported->chunk_types[7] = 0; /* pad */
2853
2854         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2855         /* ECN nonce: And now tell the peer we support ECN nonce */
2856
2857         if (sctp_ecn_nonce) {
2858                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2859                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2860                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2861                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2862                 m->m_len += sizeof(*ecn_nonce);
2863         }
2864
2865         m_at = m;
2866         /* now the addresses */
2867         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2868                 struct ifnet *ifn;
2869                 int cnt;
2870
2871                 cnt = cnt_inits_to;
2872                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2873                         struct ifaddr_container *ifac;
2874
2875                         if ((stcb->asoc.loopback_scope == 0) &&
2876                             (ifn->if_type == IFT_LOOP)) {
2877                                 /*
2878                                  * Skip loopback devices if loopback_scope
2879                                  * not set
2880                                  */
2881                                 continue;
2882                         }
2883                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2884                                 struct ifaddr *ifa = ifac->ifa;
2885
2886                                 if (sctp_is_address_in_scope(ifa,
2887                                     stcb->asoc.ipv4_addr_legal,
2888                                     stcb->asoc.ipv6_addr_legal,
2889                                     stcb->asoc.loopback_scope,
2890                                     stcb->asoc.ipv4_local_scope,
2891                                     stcb->asoc.local_scope,
2892                                     stcb->asoc.site_scope) == 0) {
2893                                         continue;
2894                                 }
2895                                 cnt++;
2896                         }
2897                 }
2898                 if (cnt > 1) {
2899                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2900                                 struct ifaddr_container *ifac;
2901
2902                                 if ((stcb->asoc.loopback_scope == 0) &&
2903                                     (ifn->if_type == IFT_LOOP)) {
2904                                         /*
2905                                          * Skip loopback devices if loopback_scope
2906                                          * not set
2907                                          */
2908                                         continue;
2909                                 }
2910                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2911                                         struct ifaddr *ifa = ifac->ifa;
2912
2913                                         if (sctp_is_address_in_scope(ifa,
2914                                             stcb->asoc.ipv4_addr_legal,
2915                                             stcb->asoc.ipv6_addr_legal,
2916                                             stcb->asoc.loopback_scope,
2917                                             stcb->asoc.ipv4_local_scope,
2918                                             stcb->asoc.local_scope,
2919                                             stcb->asoc.site_scope) == 0) {
2920                                                 continue;
2921                                         }
2922                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2923                                 }
2924                         }
2925                 }
2926         } else {
2927                 struct sctp_laddr *laddr;
2928                 int cnt;
2929                 cnt = cnt_inits_to;
2930                 /* First, how many ? */
2931                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2932                         if (laddr->ifa == NULL) {
2933                                 continue;
2934                         }
2935                         if (laddr->ifa->ifa_addr == NULL)
2936                                 continue;
2937                         if (sctp_is_address_in_scope(laddr->ifa,
2938                             stcb->asoc.ipv4_addr_legal,
2939                             stcb->asoc.ipv6_addr_legal,
2940                             stcb->asoc.loopback_scope,
2941                             stcb->asoc.ipv4_local_scope,
2942                             stcb->asoc.local_scope,
2943                             stcb->asoc.site_scope) == 0) {
2944                                 continue;
2945                         }
2946                         cnt++;
2947                 }
2948                 /* To get through a NAT we only list addresses if
2949                  * we have more than one. That way if you just
2950                  * bind a single address we let the source of the init
2951                  * dictate our address.
2952                  */
2953                 if (cnt > 1) {
2954                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2955                                 if (laddr->ifa == NULL) {
2956                                         continue;
2957                                 }
2958                                 if (laddr->ifa->ifa_addr == NULL) {
2959                                         continue;
2960                                 }
2961
2962                                 if (sctp_is_address_in_scope(laddr->ifa,
2963                                     stcb->asoc.ipv4_addr_legal,
2964                                     stcb->asoc.ipv6_addr_legal,
2965                                     stcb->asoc.loopback_scope,
2966                                     stcb->asoc.ipv4_local_scope,
2967                                     stcb->asoc.local_scope,
2968                                     stcb->asoc.site_scope) == 0) {
2969                                         continue;
2970                                 }
2971                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2972                         }
2973                 }
2974         }
2975         /* calulate the size and update pkt header and chunk header */
2976         m->m_pkthdr.len = 0;
2977         for (m_at = m; m_at; m_at = m_at->m_next) {
2978                 if (m_at->m_next == NULL)
2979                         m_last = m_at;
2980                 m->m_pkthdr.len += m_at->m_len;
2981         }
2982         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2983             sizeof(struct sctphdr)));
2984         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2985          * ignore the return here since the timer will drive
2986          * a retranmission.
2987          */
2988
2989         /* I don't expect this to execute but we will be safe here */
2990         padval = m->m_pkthdr.len % 4;
2991         if ((padval) && (m_last)) {
2992                 /* The compiler worries that m_last may not be
2993                  * set even though I think it is impossible :->
2994                  * however we add m_last here just in case.
2995                  */
2996                 int ret;
2997                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2998                 if (ret) {
2999                         /* Houston we have a problem, no space */
3000                         sctp_m_freem(m);
3001                         return;
3002                 }
3003                 m->m_pkthdr.len += padval;
3004         }
3005 #ifdef SCTP_DEBUG
3006         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3007                 kprintf("Calling lowlevel output stcb:%p net:%p\n", stcb, net);
3008         }
3009 #endif
3010         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3011                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3012 #ifdef SCTP_DEBUG
3013         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3014                 kprintf("Low level output returns %d\n", ret);
3015         }
3016 #endif
3017         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3018         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3019 }
3020
3021 struct mbuf *
3022 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3023     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3024 {
3025         /* Given a mbuf containing an INIT or INIT-ACK
3026          * with the param_offset being equal to the
3027          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3028          * parse through the parameters to the end of the mbuf verifying
3029          * that all parameters are known.
3030          *
3031          * For unknown parameters build and return a mbuf with
3032          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3033          * to stop processing this chunk stop, and set *abort_processing
3034          * to 1.
3035          *
3036          * By having param_offset be pre-set to where parameters begin
3037          * it is hoped that this routine may be reused in the future
3038          * by new features.
3039          */
3040         struct sctp_paramhdr *phdr, params;
3041
3042         struct mbuf *mat, *op_err;
3043         char tempbuf[2048];
3044         int at, limit, pad_needed;
3045         uint16_t ptype, plen;
3046         int err_at;
3047
3048         *abort_processing = 0;
3049         mat = in_initpkt;
3050         err_at = 0;
3051         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3052 #ifdef SCTP_DEBUG
3053         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3054                 kprintf("Limit is %d bytes\n", limit);
3055         }
3056 #endif
3057         at = param_offset;
3058         op_err = NULL;
3059
3060         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3061         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3062                 ptype = ntohs(phdr->param_type);
3063                 plen = ntohs(phdr->param_length);
3064                 limit -= SCTP_SIZE32(plen);
3065                 if (plen < sizeof(struct sctp_paramhdr)) {
3066 #ifdef SCTP_DEBUG
3067         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3068                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3069         }
3070 #endif
3071                         *abort_processing = 1;
3072                         break;
3073                 }
3074                 /* All parameters for all chunks that we
3075                  * know/understand are listed here. We process
3076                  * them other places and make appropriate
3077                  * stop actions per the upper bits. However
3078                  * this is the generic routine processor's can
3079                  * call to get back an operr.. to either incorporate (init-ack)
3080                  * or send.
3081                  */
3082                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3083                     (ptype == SCTP_IPV4_ADDRESS) ||
3084                     (ptype == SCTP_IPV6_ADDRESS) ||
3085                     (ptype == SCTP_STATE_COOKIE) ||
3086                     (ptype == SCTP_UNRECOG_PARAM) ||
3087                     (ptype == SCTP_COOKIE_PRESERVE) ||
3088                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3089                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3090                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3091                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3092                     (ptype == SCTP_ECN_CAPABLE) ||
3093                     (ptype == SCTP_ULP_ADAPTION) ||
3094                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3095                     (ptype == SCTP_SET_PRIM_ADDR) ||
3096                     (ptype == SCTP_SUCCESS_REPORT) ||
3097                     (ptype == SCTP_ULP_ADAPTION) ||
3098                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3099                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3100                         ) {
3101                         /* no skip it */
3102                         at += SCTP_SIZE32(plen);
3103                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3104                         /* We can NOT handle HOST NAME addresses!! */
3105 #ifdef SCTP_DEBUG
3106         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3107                 kprintf("Can't handle hostname addresses.. abort processing\n");
3108         }
3109 #endif
3110                         *abort_processing = 1;
3111                         if (op_err == NULL) {
3112                                 /* Ok need to try to get a mbuf */
3113                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3114                                 if (op_err) {
3115                                         op_err->m_len = 0;
3116                                         op_err->m_pkthdr.len = 0;
3117                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3118                                         op_err->m_data += sizeof(struct ip6_hdr);
3119                                         op_err->m_data += sizeof(struct sctphdr);
3120                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3121                                 }
3122                         }
3123                         if (op_err) {
3124                                 /* If we have space */
3125                                 struct sctp_paramhdr s;
3126                                 if (err_at % 4) {
3127                                         u_int32_t cpthis=0;
3128                                         pad_needed = 4 - (err_at % 4);
3129                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3130                                         err_at += pad_needed;
3131                                 }
3132                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3133                                 s.param_length = htons(sizeof(s) + plen);
3134                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3135                                 err_at += sizeof(s);
3136                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3137                                 if (phdr == NULL) {
3138                                         sctp_m_freem(op_err);
3139                                         /* we are out of memory but we
3140                                          * still need to have a look at what to
3141                                          * do (the system is in trouble though).
3142                                          */
3143                                         return (NULL);
3144                                 }
3145                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3146                                 err_at += plen;
3147                         }
3148                         return (op_err);
3149                 } else {
3150                         /* we do not recognize the parameter
3151                          * figure out what we do.
3152                          */
3153 #ifdef SCTP_DEBUG
3154                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3155                                 kprintf("Got parameter type %x - unknown\n",
3156                                        (u_int)ptype);
3157                         }
3158 #endif
3159                         if ((ptype & 0x4000) == 0x4000) {
3160                                 /* Report bit is set?? */
3161 #ifdef SCTP_DEBUG
3162                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3163                                         kprintf("Report bit is set\n");
3164                                 }
3165 #endif
3166                                 if (op_err == NULL) {
3167                                         /* Ok need to try to get an mbuf */
3168                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3169                                         if (op_err) {
3170                                                 op_err->m_len = 0;
3171                                                 op_err->m_pkthdr.len = 0;
3172                                                 op_err->m_data += sizeof(struct ip6_hdr);
3173                                                 op_err->m_data += sizeof(struct sctphdr);
3174                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3175                                         }
3176                                 }
3177                                 if (op_err) {
3178                                         /* If we have space */
3179                                         struct sctp_paramhdr s;
3180                                         if (err_at % 4) {
3181                                                 u_int32_t cpthis=0;
3182                                                 pad_needed = 4 - (err_at % 4);
3183                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3184                                                 err_at += pad_needed;
3185                                         }
3186                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3187                                         s.param_length = htons(sizeof(s) + plen);
3188                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3189                                         err_at += sizeof(s);
3190                                         if (plen > sizeof(tempbuf)) {
3191                                                 plen = sizeof(tempbuf);
3192                                         }
3193                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3194                                         if (phdr == NULL) {
3195                                                 sctp_m_freem(op_err);
3196                                                 /* we are out of memory but we
3197                                                  * still need to have a look at what to
3198                                                  * do (the system is in trouble though).
3199                                                  */
3200                                                 goto more_processing;
3201                                         }
3202                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3203                                         err_at += plen;
3204                                 }
3205                         }
3206                 more_processing:
3207                         if ((ptype & 0x8000) == 0x0000) {
3208 #ifdef SCTP_DEBUG
3209                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3210                                         kprintf("Abort bit is now setting1\n");
3211                                 }
3212 #endif
3213                                 return (op_err);
3214                         } else {
3215                                 /* skip this chunk and continue processing */
3216                                 at += SCTP_SIZE32(plen);
3217                         }
3218
3219                 }
3220                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3221         }
3222         return (op_err);
3223 }
3224
3225 static int
3226 sctp_are_there_new_addresses(struct sctp_association *asoc,
3227     struct mbuf *in_initpkt, int iphlen, int offset)
3228 {
3229         /*
3230          * Given a INIT packet, look through the packet to verify that
3231          * there are NO new addresses. As we go through the parameters
3232          * add reports of any un-understood parameters that require an
3233          * error.  Also we must return (1) to drop the packet if we see
3234          * a un-understood parameter that tells us to drop the chunk.
3235          */
3236         struct sockaddr_in sin4, *sa4;
3237         struct sockaddr_in6 sin6, *sa6;
3238         struct sockaddr *sa_touse;
3239         struct sockaddr *sa;
3240         struct sctp_paramhdr *phdr, params;
3241         struct ip *iph;
3242         struct mbuf *mat;
3243         uint16_t ptype, plen;
3244         int err_at;
3245         uint8_t fnd;
3246         struct sctp_nets *net;
3247
3248         memset(&sin4, 0, sizeof(sin4));
3249         memset(&sin6, 0, sizeof(sin6));
3250         sin4.sin_family = AF_INET;
3251         sin4.sin_len = sizeof(sin4);
3252         sin6.sin6_family = AF_INET6;
3253         sin6.sin6_len = sizeof(sin6);
3254
3255         sa_touse = NULL;
3256         /* First what about the src address of the pkt ? */
3257         iph = mtod(in_initpkt, struct ip *);
3258         if (iph->ip_v == IPVERSION) {
3259                 /* source addr is IPv4 */
3260                 sin4.sin_addr = iph->ip_src;
3261                 sa_touse = (struct sockaddr *)&sin4;
3262         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3263                 /* source addr is IPv6 */
3264                 struct ip6_hdr *ip6h;
3265                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3266                 sin6.sin6_addr = ip6h->ip6_src;
3267                 sa_touse = (struct sockaddr *)&sin6;
3268         } else {
3269                 return (1);
3270         }
3271
3272         fnd = 0;
3273         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3274                 sa = (struct sockaddr *)&net->ro._l_addr;
3275                 if (sa->sa_family == sa_touse->sa_family) {
3276                         if (sa->sa_family == AF_INET) {
3277                             sa4 = (struct sockaddr_in *)sa;
3278                                 if (sa4->sin_addr.s_addr ==
3279                                     sin4.sin_addr.s_addr) {
3280                                         fnd = 1;
3281                                         break;
3282                                 }
3283                         } else if (sa->sa_family == AF_INET6) {
3284                                 sa6 = (struct sockaddr_in6 *)sa;
3285                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3286                                     &sin6.sin6_addr)) {
3287                                         fnd = 1;
3288                                         break;
3289                                 }
3290                         }
3291                 }
3292         }
3293         if (fnd == 0) {
3294                 /* New address added! no need to look futher. */
3295                 return (1);
3296         }
3297         /* Ok so far lets munge through the rest of the packet */
3298         mat = in_initpkt;
3299         err_at = 0;
3300         sa_touse = NULL;
3301         offset += sizeof(struct sctp_init_chunk);
3302         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3303         while (phdr) {
3304                 ptype = ntohs(phdr->param_type);
3305                 plen = ntohs(phdr->param_length);
3306                 if (ptype == SCTP_IPV4_ADDRESS) {
3307                         struct sctp_ipv4addr_param *p4, p4_buf;
3308
3309                         phdr = sctp_get_next_param(mat, offset,
3310                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3311                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3312                             phdr == NULL) {
3313                                 return (1);
3314                         }
3315                         p4 = (struct sctp_ipv4addr_param *)phdr;
3316                         sin4.sin_addr.s_addr = p4->addr;
3317                         sa_touse = (struct sockaddr *)&sin4;
3318                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3319                         struct sctp_ipv6addr_param *p6, p6_buf;
3320
3321                         phdr = sctp_get_next_param(mat, offset,
3322                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3323                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3324                             phdr == NULL) {
3325                                 return (1);
3326                         }
3327                         p6 = (struct sctp_ipv6addr_param *)phdr;
3328                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3329                             sizeof(p6->addr));
3330                         sa_touse = (struct sockaddr *)&sin4;
3331                 }
3332
3333                 if (sa_touse) {
3334                         /* ok, sa_touse points to one to check */
3335                         fnd = 0;
3336                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3337                                 sa = (struct sockaddr *)&net->ro._l_addr;
3338                                 if (sa->sa_family != sa_touse->sa_family) {
3339                                         continue;
3340                                 }
3341                                 if (sa->sa_family == AF_INET) {
3342                                         sa4 = (struct sockaddr_in *)sa;
3343                                         if (sa4->sin_addr.s_addr ==
3344                                             sin4.sin_addr.s_addr) {
3345                                                 fnd = 1;
3346                                                 break;
3347                                         }
3348                                 } else if (sa->sa_family == AF_INET6) {
3349                                         sa6 = (struct sockaddr_in6 *)sa;
3350                                         if (SCTP6_ARE_ADDR_EQUAL(
3351                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3352                                                 fnd = 1;
3353                                                 break;
3354                                         }
3355                                 }
3356                         }
3357                         if (!fnd) {
3358                                 /* New addr added! no need to look further */
3359                                 return (1);
3360                         }
3361                 }
3362                 offset += SCTP_SIZE32(plen);
3363                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3364         }
3365         return (0);
3366 }
3367
3368 /*
3369  * Given a MBUF chain that was sent into us containing an
3370  * INIT. Build a INIT-ACK with COOKIE and send back.
3371  * We assume that the in_initpkt has done a pullup to
3372  * include IPv6/4header, SCTP header and initial part of
3373  * INIT message (i.e. the struct sctp_init_msg).
3374  */
3375 void
3376 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3377     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3378     struct sctp_init_chunk *init_chk)
3379 {
3380         struct sctp_association *asoc;
3381         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3382         struct sctp_init_msg *initackm_out;
3383         struct sctp_ecn_supported_param *ecn;
3384         struct sctp_prsctp_supported_param *prsctp;
3385         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3386         struct sctp_supported_chunk_types_param *pr_supported;
3387         struct sockaddr_storage store;
3388         struct sockaddr_in *sin;
3389         struct sockaddr_in6 *sin6;
3390         struct route *ro;
3391         struct ip *iph;
3392         struct ip6_hdr *ip6;
3393         struct sockaddr *to;
3394         struct sctp_state_cookie stc;
3395         struct sctp_nets *net=NULL;
3396         int cnt_inits_to=0;
3397         uint16_t his_limit, i_want;
3398         int abort_flag, padval, sz_of;
3399
3400         if (stcb) {
3401                 asoc = &stcb->asoc;
3402         } else {
3403                 asoc = NULL;
3404         }
3405         m_last = NULL;
3406         if ((asoc != NULL) &&
3407             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3408             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3409                 /* new addresses, out of here in non-cookie-wait states */
3410                 /*
3411                  * Send a ABORT, we don't add the new address error clause though
3412                  * we even set the T bit and copy in the 0 tag.. this looks no
3413                  * different than if no listner was present.
3414                  */
3415                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3416                 return;
3417         }
3418         abort_flag = 0;
3419         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3420             (offset+sizeof(struct sctp_init_chunk)),
3421             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3422         if (abort_flag) {
3423                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3424                 return;
3425         }
3426         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3427         if (m == NULL) {
3428                 /* No memory, INIT timer will re-attempt. */
3429                 if (op_err)
3430                         sctp_m_freem(op_err);
3431                 return;
3432         }
3433         MCLGET(m, MB_DONTWAIT);
3434         if ((m->m_flags & M_EXT) != M_EXT) {
3435                 /* Failed to get cluster buffer */
3436                 if (op_err)
3437                         sctp_m_freem(op_err);
3438                 sctp_m_freem(m);
3439                 return;
3440         }
3441         m->m_data += SCTP_MIN_OVERHEAD;
3442         m->m_pkthdr.rcvif = 0;
3443         m->m_len = sizeof(struct sctp_init_msg);
3444
3445         /* the time I built cookie */
3446         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3447
3448         /* populate any tie tags */
3449         if (asoc != NULL) {
3450                 /* unlock before tag selections */
3451                 SCTP_TCB_UNLOCK(stcb);
3452                 if (asoc->my_vtag_nonce == 0)
3453                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3454                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3455
3456                 if (asoc->peer_vtag_nonce == 0)
3457                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3458                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3459
3460                 stc.cookie_life = asoc->cookie_life;
3461                 net = asoc->primary_destination;
3462                 /* now we must relock */
3463                 SCTP_INP_RLOCK(inp);
3464                 /* we may be in trouble here if the inp got freed
3465                  * most likely this set of tests will protect
3466                  * us but there is a chance not.
3467                  */
3468                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3469                         if (op_err)
3470                                 sctp_m_freem(op_err);
3471                         sctp_m_freem(m);
3472                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3473                         return;
3474                 }
3475                 SCTP_TCB_LOCK(stcb);
3476                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3477         } else {
3478                 stc.tie_tag_my_vtag = 0;
3479                 stc.tie_tag_peer_vtag = 0;
3480                 /* life I will award this cookie */
3481                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3482         }
3483
3484         /* copy in the ports for later check */
3485         stc.myport = sh->dest_port;
3486         stc.peerport = sh->src_port;
3487
3488         /*
3489          * If we wanted to honor cookie life extentions, we would add
3490          * to stc.cookie_life. For now we should NOT honor any extension
3491          */
3492         stc.site_scope = stc.local_scope = stc.loopback_scope&nb