a89a9c128771dc65c358698931c10bd9ad8e1097
[dragonfly.git] / sys / netinet / sctp_output.c
1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
2 /*      $DragonFly: src/sys/netinet/sctp_output.c,v 1.13 2008/03/07 11:34:20 sephe Exp $        */
3
4 /*
5  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32
33 #if !(defined(__OpenBSD__) || defined (__APPLE__))
34 #include "opt_ipsec.h"
35 #endif
36 #if defined(__FreeBSD__) || defined(__DragonFly__)
37 #include "opt_compat.h"
38 #include "opt_inet6.h"
39 #include "opt_inet.h"
40 #endif
41 #if defined(__NetBSD__)
42 #include "opt_inet.h"
43 #endif
44 #ifdef __APPLE__
45 #include <sctp.h>
46 #elif !defined(__OpenBSD__)
47 #include "opt_sctp.h"
48 #endif
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/malloc.h>
52 #include <sys/mbuf.h>
53 #ifndef __OpenBSD__
54 #include <sys/domain.h>
55 #endif
56 #include <sys/protosw.h>
57 #include <sys/socket.h>
58 #include <sys/socketvar.h>
59 #include <sys/proc.h>
60 #include <sys/kernel.h>
61 #include <sys/sysctl.h>
62 #include <sys/resourcevar.h>
63 #include <sys/uio.h>
64 #ifdef INET6
65 #include <sys/domain.h>
66 #endif
67 #include <sys/thread2.h>
68 #include <sys/socketvar2.h>
69
70 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
71 #include <sys/limits.h>
72 #else
73 #include <machine/limits.h>
74 #endif
75 #include <machine/cpu.h>
76
77 #include <net/if.h>
78 #include <net/if_types.h>
79
80 #if defined(__FreeBSD__) || defined(__DragonFly__)
81 #include <net/if_var.h>
82 #endif
83
84 #include <net/route.h>
85
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/ip.h>
89 #include <netinet/in_pcb.h>
90 #include <netinet/in_var.h>
91 #include <netinet/ip_var.h>
92
93 #ifdef INET6
94 #include <netinet/ip6.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/scope6_var.h>
97 #include <netinet6/nd6.h>
98
99 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
100 #include <netinet6/in6_pcb.h>
101 #elif defined(__OpenBSD__)
102 #include <netinet/in_pcb.h>
103 #endif
104
105 #include <netinet/icmp6.h>
106
107 #endif /* INET6 */
108
109 #include <net/net_osdep.h>
110
111 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
112 #ifndef in6pcb
113 #define in6pcb          inpcb
114 #endif
115 #endif
116
117 #include <netinet/sctp_pcb.h>
118
119 #ifdef IPSEC
120 #ifndef __OpenBSD__
121 #include <netinet6/ipsec.h>
122 #include <netproto/key/key.h>
123 #else
124 #undef IPSEC
125 #endif
126 #endif /* IPSEC */
127
128 #include <netinet/sctp_var.h>
129 #include <netinet/sctp_header.h>
130 #include <netinet/sctputil.h>
131 #include <netinet/sctp_pcb.h>
132 #include <netinet/sctp_output.h>
133 #include <netinet/sctp_uio.h>
134 #include <netinet/sctputil.h>
135 #include <netinet/sctp_hashdriver.h>
136 #include <netinet/sctp_timer.h>
137 #include <netinet/sctp_asconf.h>
138 #include <netinet/sctp_indata.h>
139
140 #ifdef SCTP_DEBUG
141 extern uint32_t sctp_debug_on;
142 #endif
143
144 extern int sctp_peer_chunk_oh;
145
146 static int
147 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
148 {
149         struct cmsghdr cmh;
150         int tlen, at;
151
152         tlen = control->m_len;
153         at = 0;
154         /*
155          * Independent of how many mbufs, find the c_type inside the control
156          * structure and copy out the data.
157          */
158         while (at < tlen) {
159                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
160                         /* not enough room for one more we are done. */
161                         return (0);
162                 }
163                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
164                 if ((cmh.cmsg_len + at) > tlen) {
165                         /*
166                          * this is real messed up since there is not enough
167                          * data here to cover the cmsg header. We are done.
168                          */
169                         return (0);
170                 }
171                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
172                     (c_type == cmh.cmsg_type)) {
173                         /* found the one we want, copy it out */
174                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
175                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
176                                 /*
177                                  * space of cmsg_len after header not
178                                  * big enough
179                                  */
180                                 return (0);
181                         }
182                         m_copydata(control, at, cpsize, data);
183                         return (1);
184                  } else {
185                         at += CMSG_ALIGN(cmh.cmsg_len);
186                         if (cmh.cmsg_len == 0) {
187                                 break;
188                         }
189                 }
190         }
191         /* not found */
192         return (0);
193 }
194
195 static struct mbuf *
196 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
197 {
198         struct sctp_paramhdr *parmh;
199         struct mbuf *mret;
200         int len;
201         if (ifa->ifa_addr->sa_family == AF_INET) {
202                 len = sizeof(struct sctp_ipv4addr_param);
203         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
204                 len = sizeof(struct sctp_ipv6addr_param);
205         } else {
206                 /* unknown type */
207                 return (m);
208         }
209
210         if (M_TRAILINGSPACE(m) >= len) {
211                 /* easy side we just drop it on the end */
212                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
213                 mret = m;
214         } else {
215                 /* Need more space */
216                 mret = m;
217                 while (mret->m_next != NULL) {
218                         mret = mret->m_next;
219                 }
220                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
221                 if (mret->m_next == NULL) {
222                         /* We are hosed, can't add more addresses */
223                         return (m);
224                 }
225                 mret = mret->m_next;
226                 parmh = mtod(mret, struct sctp_paramhdr *);
227         }
228         /* now add the parameter */
229         if (ifa->ifa_addr->sa_family == AF_INET) {
230                 struct sctp_ipv4addr_param *ipv4p;
231                 struct sockaddr_in *sin;
232                 sin = (struct sockaddr_in *)ifa->ifa_addr;
233                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
234                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
235                 parmh->param_length = htons(len);
236                 ipv4p->addr = sin->sin_addr.s_addr;
237                 mret->m_len += len;
238         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
239                 struct sctp_ipv6addr_param *ipv6p;
240                 struct sockaddr_in6 *sin6;
241                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
242                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
243                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
244                 parmh->param_length = htons(len);
245                 memcpy(ipv6p->addr, &sin6->sin6_addr,
246                     sizeof(ipv6p->addr));
247                 /* clear embedded scope in the address */
248                 in6_clearscope((struct in6_addr *)ipv6p->addr);
249                 mret->m_len += len;
250         } else {
251                 return (m);
252         }
253         return (mret);
254 }
255
256
257
258 static struct mbuf *
259 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
260     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
261 {
262         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
263         struct sctp_state_cookie *stc;
264         struct sctp_paramhdr *ph;
265         uint8_t *signature;
266         int sig_offset;
267         uint16_t cookie_sz;
268
269         mret = NULL;
270
271         MGET(mret, MB_DONTWAIT, MT_DATA);
272         if (mret == NULL) {
273                 return (NULL);
274         }
275         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
276         if (copy_init == NULL) {
277                 sctp_m_freem(mret);
278                 return (NULL);
279         }
280         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
281             MB_DONTWAIT);
282         if (copy_initack == NULL) {
283                 sctp_m_freem(mret);
284                 sctp_m_freem(copy_init);
285                 return (NULL);
286         }
287         /* easy side we just drop it on the end */
288         ph = mtod(mret, struct sctp_paramhdr *);
289         mret->m_len = sizeof(struct sctp_state_cookie) +
290             sizeof(struct sctp_paramhdr);
291         stc = (struct sctp_state_cookie *)((caddr_t)ph +
292             sizeof(struct sctp_paramhdr));
293         ph->param_type = htons(SCTP_STATE_COOKIE);
294         ph->param_length = 0;   /* fill in at the end */
295         /* Fill in the stc cookie data */
296         *stc = *stc_in;
297
298         /* tack the INIT and then the INIT-ACK onto the chain */
299         cookie_sz = 0;
300         m_at = mret;
301         for (m_at = mret; m_at; m_at = m_at->m_next) {
302                 cookie_sz += m_at->m_len;
303                 if (m_at->m_next == NULL) {
304                         m_at->m_next = copy_init;
305                         break;
306                 }
307         }
308
309         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
310                 cookie_sz += m_at->m_len;
311                 if (m_at->m_next == NULL) {
312                         m_at->m_next = copy_initack;
313                         break;
314                 }
315         }
316
317         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
318                 cookie_sz += m_at->m_len;
319                 if (m_at->m_next == NULL) {
320                         break;
321                 }
322         }
323         MGET(sig, MB_DONTWAIT, MT_DATA);
324         if (sig == NULL) {
325                 /* no space */
326                 sctp_m_freem(mret);
327                 sctp_m_freem(copy_init);
328                 sctp_m_freem(copy_initack);
329                 return (NULL);
330         }
331         sig->m_len = 0;
332         m_at->m_next = sig;
333         sig_offset = 0;
334         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
335         /* Time to sign the cookie */
336         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
337             (int)(inp->sctp_ep.current_secret_number)],
338             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
339             (uint8_t *)signature);
340         sig->m_len += SCTP_SIGNATURE_SIZE;
341         cookie_sz += SCTP_SIGNATURE_SIZE;
342
343         ph->param_length = htons(cookie_sz);
344         return (mret);
345 }
346
347
348 static struct sockaddr_in *
349 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
350 {
351         struct sockaddr_in *sin;
352         /*
353          * Here we determine if its a prefered address. A
354          * prefered address means it is the same scope or
355          * higher scope then the destination.
356          *  L = loopback, P = private, G = global
357          * -----------------------------------------
358          *  src    |      dest     |    result
359          *-----------------------------------------
360          *   L     |       L       |    yes
361          *-----------------------------------------
362          *   P     |       L       |    yes
363          *-----------------------------------------
364          *   G     |       L       |    yes
365          *-----------------------------------------
366          *   L     |       P       |    no
367          *-----------------------------------------
368          *   P     |       P       |    yes
369          *-----------------------------------------
370          *   G     |       P       |    no
371          *-----------------------------------------
372          *   L     |       G       |    no
373          *-----------------------------------------
374          *   P     |       G       |    no
375          *-----------------------------------------
376          *   G     |       G       |    yes
377          *-----------------------------------------
378          */
379
380         if (ifa->ifa_addr->sa_family != AF_INET) {
381                 /* forget non-v4 */
382                 return (NULL);
383         }
384         /* Ok the address may be ok */
385         sin = (struct sockaddr_in *)ifa->ifa_addr;
386         if (sin->sin_addr.s_addr == 0) {
387                 return (NULL);
388         }
389         *sin_local = *sin_loop = 0;
390         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
391             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
392                 *sin_loop = 1;
393                 *sin_local = 1;
394         }
395         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
396                 *sin_local = 1;
397         }
398         if (!loopscope && *sin_loop) {
399                 /* Its a loopback address and we don't have loop scope */
400                 return (NULL);
401         }
402         if (!ipv4_scope && *sin_local) {
403                 /* Its a private address, and we don't have private address scope */
404                 return (NULL);
405         }
406         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
407                 /* its a global src and a private dest */
408                 return (NULL);
409         }
410         /* its a prefered address */
411         return (sin);
412 }
413
414 static struct sockaddr_in *
415 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
416 {
417         struct sockaddr_in *sin;
418         /*
419          * Here we determine if its a acceptable address. A
420          * acceptable address means it is the same scope or
421          * higher scope but we can allow for NAT which means
422          * its ok to have a global dest and a private src.
423          *
424          *  L = loopback, P = private, G = global
425          * -----------------------------------------
426          *  src    |      dest     |    result
427          *-----------------------------------------
428          *   L     |       L       |    yes
429          *-----------------------------------------
430          *   P     |       L       |    yes
431          *-----------------------------------------
432          *   G     |       L       |    yes
433          *-----------------------------------------
434          *   L     |       P       |    no
435          *-----------------------------------------
436          *   P     |       P       |    yes
437          *-----------------------------------------
438          *   G     |       P       |    yes - probably this won't work.
439          *-----------------------------------------
440          *   L     |       G       |    no
441          *-----------------------------------------
442          *   P     |       G       |    yes
443          *-----------------------------------------
444          *   G     |       G       |    yes
445          *-----------------------------------------
446          */
447
448         if (ifa->ifa_addr->sa_family != AF_INET) {
449                 /* forget non-v4 */
450                 return (NULL);
451         }
452         /* Ok the address may be ok */
453         sin = (struct sockaddr_in *)ifa->ifa_addr;
454         if (sin->sin_addr.s_addr == 0) {
455                 return (NULL);
456         }
457         *sin_local = *sin_loop = 0;
458         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
459             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
460                 *sin_loop = 1;
461                 *sin_local = 1;
462         }
463         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
464                 *sin_local = 1;
465         }
466         if (!loopscope && *sin_loop) {
467                 /* Its a loopback address and we don't have loop scope */
468                 return (NULL);
469         }
470         /* its an acceptable address */
471         return (sin);
472 }
473
474 /*
475  * This treats the address list on the ep as a restricted list
476  * (negative list). If a the passed address is listed, then
477  * the address is NOT allowed on the association.
478  */
479 int
480 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
481 {
482         struct sctp_laddr *laddr;
483 #ifdef SCTP_DEBUG
484         int cnt=0;
485 #endif
486         if (stcb == NULL) {
487                 /* There are no restrictions, no TCB :-) */
488                 return (0);
489         }
490 #ifdef SCTP_DEBUG
491         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
492                 cnt++;
493         }
494         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
495                 kprintf("There are %d addresses on the restricted list\n", cnt);
496         }
497         cnt = 0;
498 #endif
499         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
500                 if (laddr->ifa == NULL) {
501 #ifdef SCTP_DEBUG
502                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
503                                 kprintf("Help I have fallen and I can't get up!\n");
504                         }
505 #endif
506                         continue;
507                 }
508 #ifdef SCTP_DEBUG
509                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
510                         cnt++;
511                         kprintf("Restricted address[%d]:", cnt);
512                         sctp_print_address(laddr->ifa->ifa_addr);
513                 }
514 #endif
515                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
516                         /* Yes it is on the list */
517                         return (1);
518                 }
519         }
520         return (0);
521 }
522
523 static int
524 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
525 {
526         struct sctp_laddr *laddr;
527
528         if (ifa == NULL)
529                 return (0);
530         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
531                 if (laddr->ifa == NULL) {
532 #ifdef SCTP_DEBUG
533                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
534                                 kprintf("Help I have fallen and I can't get up!\n");
535                         }
536 #endif
537                         continue;
538                 }
539                 if (laddr->ifa->ifa_addr == NULL)
540                         continue;
541                 if (laddr->ifa == ifa)
542                         /* same pointer */
543                         return (1);
544                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
545                         /* skip non compatible address comparison */
546                         continue;
547                 }
548                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
549                         /* Yes it is restricted */
550                         return (1);
551                 }
552         }
553         return (0);
554 }
555
556
557
558 static struct in_addr
559 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
560                                  struct rtentry *rt,
561                                  uint8_t ipv4_scope,
562                                  uint8_t loopscope)
563 {
564         struct in_addr ans;
565         struct sctp_laddr *laddr;
566         struct sockaddr_in *sin;
567         struct ifnet *ifn;
568         uint8_t sin_loop, sin_local;
569
570         /* first question, is the ifn we will emit on
571          * in our list, if so, we want that one.
572          */
573         ifn = rt->rt_ifp;
574         if (ifn) {
575                 struct ifaddr_container *ifac;
576
577                 /* is a prefered one on the interface we route out? */
578                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
579                         struct ifaddr *ifa = ifac->ifa;
580
581                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
582                         if (sin == NULL)
583                                 continue;
584                         if (sctp_is_addr_in_ep(inp, ifa)) {
585                                 return (sin->sin_addr);
586                         }
587                 }
588                 /* is an acceptable one on the interface we route out? */
589                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
590                         struct ifaddr *ifa = ifac->ifa;
591
592                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
593                         if (sin == NULL)
594                                 continue;
595                         if (sctp_is_addr_in_ep(inp, ifa)) {
596                                 return (sin->sin_addr);
597                         }
598                 }
599         }
600         /* ok, what about a prefered address in the inp */
601         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
602              laddr && (laddr != inp->next_addr_touse);
603              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
604                 if (laddr->ifa == NULL) {
605                         /* address has been removed */
606                         continue;
607                 }
608                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
609                 if (sin == NULL)
610                         continue;
611                 return (sin->sin_addr);
612
613         }
614         /* ok, what about an acceptable address in the inp */
615         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
616              laddr && (laddr != inp->next_addr_touse);
617              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
618                 if (laddr->ifa == NULL) {
619                         /* address has been removed */
620                         continue;
621                 }
622                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
623                 if (sin == NULL)
624                         continue;
625                 return (sin->sin_addr);
626
627         }
628
629         /* no address bound can be a source for the destination we are in trouble */
630 #ifdef SCTP_DEBUG
631         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
632                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
633         }
634 #endif
635         memset(&ans, 0, sizeof(ans));
636         return (ans);
637 }
638
639
640
641 static struct in_addr
642 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
643                                   struct sctp_tcb *stcb,
644                                   struct sctp_nets *net,
645                                   struct rtentry *rt,
646                                   uint8_t ipv4_scope,
647                                   uint8_t loopscope,
648                                   int non_asoc_addr_ok)
649 {
650         /*
651          * Here we have two cases, bound all asconf
652          * allowed. bound all asconf not allowed.
653          *
654          */
655         struct sctp_laddr *laddr, *starting_point;
656         struct in_addr ans;
657         struct ifnet *ifn;
658         uint8_t sin_loop, sin_local, start_at_beginning=0;
659         struct sockaddr_in *sin;
660
661         /* first question, is the ifn we will emit on
662          * in our list, if so, we want that one.
663          */
664         ifn = rt->rt_ifp;
665
666         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
667                 /*
668                  * Here we use the list of addresses on the endpoint. Then
669                  * the addresses listed on the "restricted" list is just that,
670                  * address that have not been added and can't be used (unless
671                  * the non_asoc_addr_ok is set).
672                  */
673 #ifdef SCTP_DEBUG
674                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
675                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
676                 }
677 #endif
678                 /* first question, is the ifn we will emit on
679                  * in our list, if so, we want that one.
680                  */
681                 if (ifn) {
682                         struct ifaddr_container *ifac;
683
684                         /* first try for an prefered address on the ep */
685                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
686                                 struct ifaddr *ifa = ifac->ifa;
687
688                                 if (sctp_is_addr_in_ep(inp, ifa)) {
689                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
690                                         if (sin == NULL)
691                                                 continue;
692                                         if ((non_asoc_addr_ok == 0) &&
693                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
694                                                 /* on the no-no list */
695                                                 continue;
696                                         }
697                                         return (sin->sin_addr);
698                                 }
699                         }
700                         /* next try for an acceptable address on the ep */
701                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
702                                 struct ifaddr *ifa = ifac->ifa;
703
704                                 if (sctp_is_addr_in_ep(inp, ifa)) {
705                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
706                                         if (sin == NULL)
707                                                 continue;
708                                         if ((non_asoc_addr_ok == 0) &&
709                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
710                                                 /* on the no-no list */
711                                                 continue;
712                                         }
713                                         return (sin->sin_addr);
714                                 }
715                         }
716
717                 }
718                 /* if we can't find one like that then we must
719                  * look at all addresses bound to pick one at
720                  * first prefereable then secondly acceptable.
721                  */
722                 starting_point = stcb->asoc.last_used_address;
723         sctpv4_from_the_top:
724                 if (stcb->asoc.last_used_address == NULL) {
725                         start_at_beginning=1;
726                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
727                 }
728                 /* search beginning with the last used address */
729                 for (laddr = stcb->asoc.last_used_address; laddr;
730                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
731                         if (laddr->ifa == NULL) {
732                                 /* address has been removed */
733                                 continue;
734                         }
735                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
736                         if (sin == NULL)
737                                 continue;
738                         if ((non_asoc_addr_ok == 0) &&
739                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
740                                 /* on the no-no list */
741                                 continue;
742                         }
743                         return (sin->sin_addr);
744
745                 }
746                 if (start_at_beginning == 0) {
747                         stcb->asoc.last_used_address = NULL;
748                         goto sctpv4_from_the_top;
749                 }
750                 /* now try for any higher scope than the destination */
751                 stcb->asoc.last_used_address = starting_point;
752                 start_at_beginning = 0;
753         sctpv4_from_the_top2:
754                 if (stcb->asoc.last_used_address == NULL) {
755                         start_at_beginning=1;
756                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
757                 }
758                 /* search beginning with the last used address */
759                 for (laddr = stcb->asoc.last_used_address; laddr;
760                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
761                         if (laddr->ifa == NULL) {
762                                 /* address has been removed */
763                                 continue;
764                         }
765                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
766                         if (sin == NULL)
767                                 continue;
768                         if ((non_asoc_addr_ok == 0) &&
769                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
770                                 /* on the no-no list */
771                                 continue;
772                         }
773                         return (sin->sin_addr);
774                 }
775                 if (start_at_beginning == 0) {
776                         stcb->asoc.last_used_address = NULL;
777                         goto sctpv4_from_the_top2;
778                 }
779         } else {
780                 /*
781                  * Here we have an address list on the association, thats the
782                  * only valid source addresses that we can use.
783                  */
784 #ifdef SCTP_DEBUG
785                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
786                         kprintf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
787                 }
788 #endif
789                 /* First look at all addresses for one that is on
790                  * the interface we route out
791                  */
792                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
793                              sctp_nxt_addr) {
794                         if (laddr->ifa == NULL) {
795                                 /* address has been removed */
796                                 continue;
797                         }
798                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
799                         if (sin == NULL)
800                                 continue;
801                         /* first question, is laddr->ifa an address associated with the emit interface */
802                         if (ifn) {
803                                 struct ifaddr_container *ifac;
804
805                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
806                                         struct ifaddr *ifa = ifac->ifa;
807
808                                         if (laddr->ifa == ifa) {
809                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
810                                                 return (sin->sin_addr);
811                                         }
812                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
813                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
814                                                 return (sin->sin_addr);
815                                         }
816                                 }
817                         }
818                 }
819                 /* what about an acceptable one on the interface? */
820                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
821                              sctp_nxt_addr) {
822                         if (laddr->ifa == NULL) {
823                                 /* address has been removed */
824                                 continue;
825                         }
826                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
827                         if (sin == NULL)
828                                 continue;
829                         /* first question, is laddr->ifa an address associated with the emit interface */
830                         if (ifn) {
831                                 struct ifaddr_container *ifac;
832
833                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
834                                         struct ifaddr *ifa = ifac->ifa;
835
836                                         if (laddr->ifa == ifa) {
837                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
838                                                 return (sin->sin_addr);
839                                         }
840                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
841                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
842                                                 return (sin->sin_addr);
843                                         }
844                                 }
845                         }
846                 }
847                 /* ok, next one that is preferable in general */
848                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
849                              sctp_nxt_addr) {
850                         if (laddr->ifa == NULL) {
851                                 /* address has been removed */
852                                 continue;
853                         }
854                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
855                         if (sin == NULL)
856                                 continue;
857                         return (sin->sin_addr);
858                 }
859
860                 /* last, what about one that is acceptable */
861                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
862                              sctp_nxt_addr) {
863                         if (laddr->ifa == NULL) {
864                                 /* address has been removed */
865                                 continue;
866                         }
867                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
868                         if (sin == NULL)
869                                 continue;
870                         return (sin->sin_addr);
871                 }
872         }
873         memset(&ans, 0, sizeof(ans));
874         return (ans);
875 }
876
877 static struct sockaddr_in *
878 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
879                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
880 {
881         struct ifaddr_container *ifac;
882         struct sockaddr_in *sin;
883         uint8_t sin_loop, sin_local;
884         int num_eligible_addr = 0;
885
886         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
887                 struct ifaddr *ifa = ifac->ifa;
888
889                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
890                 if (sin == NULL)
891                         continue;
892                 if (stcb) {
893                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
894                                 /* It is restricted for some reason.. probably
895                                  * not yet added.
896                                  */
897                                 continue;
898                         }
899                 }
900                 if (cur_addr_num == num_eligible_addr) {
901                         return (sin);
902                 }
903         }
904         return (NULL);
905 }
906
907
908 static int
909 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
910                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
911 {
912         struct ifaddr_container *ifac;
913         struct sockaddr_in *sin;
914         int num_eligible_addr = 0;
915
916         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
917                 struct ifaddr *ifa = ifac->ifa;
918
919                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
920                 if (sin == NULL)
921                         continue;
922                 if (stcb) {
923                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
924                                 /* It is restricted for some reason.. probably
925                                  * not yet added.
926                                  */
927                                 continue;
928                         }
929                 }
930                 num_eligible_addr++;
931         }
932         return (num_eligible_addr);
933
934 }
935
936 static struct in_addr
937 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
938                         struct sctp_tcb *stcb,
939                         struct sctp_nets *net,
940                         struct rtentry *rt,
941                         uint8_t ipv4_scope,
942                         uint8_t loopscope,
943                         int non_asoc_addr_ok)
944 {
945         int cur_addr_num=0, num_prefered=0;
946         uint8_t sin_loop, sin_local;
947         struct ifnet *ifn;
948         struct sockaddr_in *sin;
949         struct in_addr ans;
950         struct ifaddr_container *ifac;
951         /*
952          * For v4 we can use (in boundall) any address in the association. If
953          * non_asoc_addr_ok is set we can use any address (at least in theory).
954          * So we look for prefered addresses first. If we find one, we use it.
955          * Otherwise we next try to get an address on the interface, which we
956          * should be able to do (unless non_asoc_addr_ok is false and we are
957          * routed out that way). In these cases where we can't use the address
958          * of the interface we go through all the ifn's looking for an address
959          * we can use and fill that in. Punting means we send back address
960          * 0, which will probably cause problems actually since then IP will
961          * fill in the address of the route ifn, which means we probably already
962          * rejected it.. i.e. here comes an abort :-<.
963          */
964         ifn = rt->rt_ifp;
965         if (net) {
966                 cur_addr_num = net->indx_of_eligible_next_to_use;
967         }
968         if (ifn == NULL) {
969                 goto bound_all_v4_plan_c;
970         }
971         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
972 #ifdef SCTP_DEBUG
973         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
974                 kprintf("Found %d prefered source addresses\n", num_prefered);
975         }
976 #endif
977         if (num_prefered == 0) {
978                 /* no eligible addresses, we must use some other
979                  * interface address if we can find one.
980                  */
981                 goto bound_all_v4_plan_b;
982         }
983         /* Ok we have num_eligible_addr set with how many we can use,
984          * this may vary from call to call due to addresses being deprecated etc..
985          */
986         if (cur_addr_num >= num_prefered) {
987                 cur_addr_num = 0;
988         }
989         /* select the nth address from the list (where cur_addr_num is the nth) and
990          * 0 is the first one, 1 is the second one etc...
991          */
992 #ifdef SCTP_DEBUG
993         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
994                 kprintf("cur_addr_num:%d\n", cur_addr_num);
995         }
996 #endif
997         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
998                                                                    ipv4_scope, cur_addr_num);
999
1000         /* if sin is NULL something changed??, plan_a now */
1001         if (sin) {
1002                 return (sin->sin_addr);
1003         }
1004
1005         /*
1006          * plan_b: Look at the interface that we emit on
1007          *         and see if we can find an acceptable address.
1008          */
1009  bound_all_v4_plan_b:
1010         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1011                 struct ifaddr *ifa = ifac->ifa;
1012
1013                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1014                 if (sin == NULL)
1015                         continue;
1016                 if (stcb) {
1017                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1018                                 /* It is restricted for some reason.. probably
1019                                  * not yet added.
1020                                  */
1021                                 continue;
1022                         }
1023                 }
1024                 return (sin->sin_addr);
1025         }
1026         /*
1027          * plan_c: Look at all interfaces and find a prefered
1028          *         address. If we reache here we are in trouble I think.
1029          */
1030  bound_all_v4_plan_c:
1031         for (ifn = TAILQ_FIRST(&ifnet);
1032              ifn && (ifn != inp->next_ifn_touse);
1033              ifn=TAILQ_NEXT(ifn, if_list)) {
1034                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1035                         /* wrong base scope */
1036                         continue;
1037                 }
1038                 if (ifn == rt->rt_ifp)
1039                         /* already looked at this guy */
1040                         continue;
1041                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1042                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1043 #ifdef SCTP_DEBUG
1044                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1045                         kprintf("Found ifn:%x %d prefered source addresses\n", (u_int)ifn, num_prefered);
1046                 }
1047 #endif
1048                 if (num_prefered == 0) {
1049                         /*
1050                          * None on this interface.
1051                          */
1052                         continue;
1053                 }
1054                 /* Ok we have num_eligible_addr set with how many we can use,
1055                  * this may vary from call to call due to addresses being deprecated etc..
1056                  */
1057                 if (cur_addr_num >= num_prefered) {
1058                         cur_addr_num = 0;
1059                 }
1060                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1061                                                                           ipv4_scope, cur_addr_num);
1062                 if (sin == NULL)
1063                         continue;
1064                 return (sin->sin_addr);
1065
1066         }
1067
1068         /*
1069          * plan_d: We are in deep trouble. No prefered address on
1070          *         any interface. And the emit interface does not
1071          *         even have an acceptable address. Take anything
1072          *         we can get! If this does not work we are
1073          *         probably going to emit a packet that will
1074          *         illicit an ABORT, falling through.
1075          */
1076
1077         for (ifn = TAILQ_FIRST(&ifnet);
1078              ifn && (ifn != inp->next_ifn_touse);
1079              ifn=TAILQ_NEXT(ifn, if_list)) {
1080                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1081                         /* wrong base scope */
1082                         continue;
1083                 }
1084                 if (ifn == rt->rt_ifp)
1085                         /* already looked at this guy */
1086                         continue;
1087
1088                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1089                         struct ifaddr *ifa = ifac->ifa;
1090
1091                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1092                         if (sin == NULL)
1093                                 continue;
1094                         if (stcb) {
1095                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1096                                         /* It is restricted for some reason.. probably
1097                                          * not yet added.
1098                                          */
1099                                         continue;
1100                                 }
1101                         }
1102                         return (sin->sin_addr);
1103                 }
1104         }
1105         /*
1106          * Ok we can find NO address to source from that is
1107          * not on our negative list. It is either the special
1108          * ASCONF case where we are sourceing from a intf that
1109          * has been ifconfig'd to a different address (i.e.
1110          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1111          * address. OR we are hosed, and this baby is going
1112          * to abort the association.
1113          */
1114         if (non_asoc_addr_ok) {
1115                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1116         } else {
1117                 memset(&ans, 0, sizeof(ans));
1118                 return (ans);
1119         }
1120 }
1121
1122
1123
1124 /* tcb may be NULL */
1125 struct in_addr
1126 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1127     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1128     int non_asoc_addr_ok)
1129 {
1130         struct in_addr ans;
1131         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1132         uint8_t ipv4_scope, loopscope;
1133         /*
1134          * Rules:
1135          * - Find the route if needed, cache if I can.
1136          * - Look at interface address in route, Is it
1137          *   in the bound list. If so we have the best source.
1138          * - If not we must rotate amongst the addresses.
1139          *
1140          * Cavets and issues
1141          *
1142          * Do we need to pay attention to scope. We can have
1143          * a private address or a global address we are sourcing
1144          * or sending to. So if we draw it out
1145          *      source     *      dest   *  result
1146          *  ------------------------------------------
1147          *  a   Private    *     Global  *  NAT?
1148          *  ------------------------------------------
1149          *  b   Private    *     Private *  No problem
1150          *  ------------------------------------------
1151          *  c   Global     *     Private *  Huh, How will this work?
1152          *  ------------------------------------------
1153          *  d   Global     *     Global  *  No Problem
1154          *  ------------------------------------------
1155          *
1156          * And then we add to that what happens if there are multiple
1157          * addresses assigned to an interface. Remember the ifa on a
1158          * ifn is a linked list of addresses. So one interface can
1159          * have more than one IPv4 address. What happens if we
1160          * have both a private and a global address? Do we then
1161          * use context of destination to sort out which one is
1162          * best? And what about NAT's sending P->G may get you
1163          * a NAT translation, or should you select the G thats
1164          * on the interface in preference.
1165          *
1166          * Decisions:
1167          *
1168          *  - count the number of addresses on the interface.
1169          *  - if its one, no problem except case <c>. For <a>
1170          *    we will assume a NAT out there.
1171          *  - if there are more than one, then we need to worry
1172          *    about scope P or G. We should prefer G -> G and
1173          *    P -> P if possible. Then as a secondary fall back
1174          *    to mixed types G->P being a last ditch one.
1175          *  - The above all works for bound all, but bound
1176          *    specific we need to use the same concept but instead
1177          *    only consider the bound addresses. If the bound set
1178          *    is NOT assigned to the interface then we must use
1179          *    rotation amongst them.
1180          *
1181          * Notes: For v4, we can always punt and let ip_output
1182          * decide by sending back a source of 0.0.0.0
1183          */
1184
1185         if (ro->ro_rt == NULL) {
1186                 /*
1187                  * Need a route to cache.
1188                  *
1189                  */
1190 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1191                 rtalloc_ign(ro, 0UL);
1192 #else
1193                 rtalloc(ro);
1194 #endif
1195         }
1196         if (ro->ro_rt == NULL) {
1197                 /* No route to host .. punt */
1198                 memset(&ans, 0, sizeof(ans));
1199                 return (ans);
1200         }
1201         /* Setup our scopes */
1202         if (stcb) {
1203                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1204                 loopscope = stcb->asoc.loopback_scope;
1205         } else {
1206                 /* Scope based on outbound address */
1207                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1208                         ipv4_scope = 1;
1209                         loopscope = 0;
1210                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1211                         ipv4_scope = 1;
1212                         loopscope = 1;
1213                 } else {
1214                         ipv4_scope = 0;
1215                         loopscope = 0;
1216                 }
1217         }
1218 #ifdef SCTP_DEBUG
1219         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1220                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1221                        loopscope, ipv4_scope);
1222         }
1223 #endif
1224         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1225                 /*
1226                  * When bound to all if the address list is set
1227                  * it is a negative list. Addresses being added
1228                  * by asconf.
1229                  */
1230                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1231                     ipv4_scope, loopscope, non_asoc_addr_ok));
1232         }
1233         /*
1234          * Three possiblities here:
1235          *
1236          * a) stcb is NULL, which means we operate only from
1237          *    the list of addresses (ifa's) bound to the assoc and
1238          *    we care not about the list.
1239          * b) stcb is NOT-NULL, which means we have an assoc structure and
1240          *    auto-asconf is on. This means that the list of addresses is
1241          *    a NOT list. We use the list from the inp, but any listed address
1242          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1243          *    set we CAN use an address NOT available (i.e. being added). Its
1244          *    a negative list.
1245          * c) stcb is NOT-NULL, which means we have an assoc structure and
1246          *    auto-asconf is off. This means that the list of addresses is
1247          *    the ONLY addresses I can use.. its positive.
1248          *
1249          *    Note we collapse b & c into the same function just like in
1250          *    the v6 address selection.
1251          */
1252         if (stcb) {
1253                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1254                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1255         } else {
1256                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1257                     ipv4_scope, loopscope));
1258         }
1259         /* this should not be reached */
1260         memset(&ans, 0, sizeof(ans));
1261         return (ans);
1262 }
1263
1264
1265
1266 static struct sockaddr_in6 *
1267 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1268 {
1269         struct in6_ifaddr *ifa6;
1270         struct sockaddr_in6 *sin6;
1271
1272         if (ifa->ifa_addr->sa_family != AF_INET6) {
1273                 /* forget non-v6 */
1274                 return (NULL);
1275         }
1276         ifa6 = (struct in6_ifaddr *)ifa;
1277         /* ok to use deprecated addresses? */
1278         if (!ip6_use_deprecated) {
1279                 if (IFA6_IS_DEPRECATED(ifa6)) {
1280                         /* can't use this type */
1281                         return (NULL);
1282                 }
1283         }
1284         /* are we ok, with the current state of this address? */
1285         if (ifa6->ia6_flags &
1286             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1287                 /* Can't use these types */
1288                 return (NULL);
1289         }
1290         /* Ok the address may be ok */
1291         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1292         *sin_local = *sin_loop = 0;
1293         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1294             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1295                 *sin_loop = 1;
1296         }
1297         if (!loopscope && *sin_loop) {
1298                 /* Its a loopback address and we don't have loop scope */
1299                 return (NULL);
1300         }
1301         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1302                 /* we skip unspecifed addresses */
1303                 return (NULL);
1304         }
1305
1306         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1307                 *sin_local = 1;
1308         }
1309         if (!loc_scope && *sin_local) {
1310                 /* Its a link local address, and we don't have link local scope */
1311                 return (NULL);
1312         }
1313         return (sin6);
1314 }
1315
1316
1317 static struct sockaddr_in6 *
1318 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1319                                   struct sctp_tcb *stcb,
1320                                   struct sctp_nets *net,
1321                                   struct rtentry *rt,
1322                                   uint8_t loc_scope,
1323                                   uint8_t loopscope,
1324                                   int non_asoc_addr_ok)
1325 {
1326         /*
1327          *   Each endpoint has a list of local addresses associated
1328          *   with it. The address list is either a "negative list" i.e.
1329          *   those addresses that are NOT allowed to be used as a source OR
1330          *   a "postive list" i.e. those addresses that CAN be used.
1331          *
1332          *   Its a negative list if asconf is allowed. What we do
1333          *   in this case is use the ep address list BUT we have
1334          *   to cross check it against the negative list.
1335          *
1336          *   In the case where NO asconf is allowed, we have just
1337          *   a straight association level list that we must use to
1338          *   find a source address.
1339          */
1340         struct sctp_laddr *laddr, *starting_point;
1341         struct sockaddr_in6 *sin6;
1342         int sin_loop, sin_local;
1343         int start_at_beginning=0;
1344         struct ifnet *ifn;
1345
1346         ifn = rt->rt_ifp;
1347         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1348 #ifdef SCTP_DEBUG
1349                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1350                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1351                 }
1352 #endif
1353                 /* first question, is the ifn we will emit on
1354                  * in our list, if so, we want that one.
1355                  */
1356                 if (ifn) {
1357                         struct ifaddr_container *ifac;
1358
1359                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1360                                 struct ifaddr *ifa = ifac->ifa;
1361
1362                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1363                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1364                                         if (sin6 == NULL)
1365                                                 continue;
1366                                         if ((non_asoc_addr_ok == 0) &&
1367                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1368                                                 /* on the no-no list */
1369                                                 continue;
1370                                         }
1371                                         return (sin6);
1372                                 }
1373                         }
1374                 }
1375                 starting_point = stcb->asoc.last_used_address;
1376                 /* First try for matching scope */
1377         sctp_from_the_top:
1378                 if (stcb->asoc.last_used_address == NULL) {
1379                         start_at_beginning=1;
1380                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1381                 }
1382                 /* search beginning with the last used address */
1383                 for (laddr = stcb->asoc.last_used_address; laddr;
1384                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1385                         if (laddr->ifa == NULL) {
1386                                 /* address has been removed */
1387                                 continue;
1388                         }
1389                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1390                         if (sin6 == NULL)
1391                                 continue;
1392                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1393                                 /* on the no-no list */
1394                                 continue;
1395                         }
1396                         /* is it of matching scope ? */
1397                         if ((loopscope == 0) &&
1398                             (loc_scope == 0) &&
1399                             (sin_loop == 0) &&
1400                             (sin_local == 0)) {
1401                                 /* all of global scope we are ok with it */
1402                                 return (sin6);
1403                         }
1404                         if (loopscope && sin_loop)
1405                                 /* both on the loopback, thats ok */
1406                                 return (sin6);
1407                         if (loc_scope && sin_local)
1408                                 /* both local scope */
1409                                 return (sin6);
1410
1411                 }
1412                 if (start_at_beginning == 0) {
1413                         stcb->asoc.last_used_address = NULL;
1414                         goto sctp_from_the_top;
1415                 }
1416                 /* now try for any higher scope than the destination */
1417                 stcb->asoc.last_used_address = starting_point;
1418                 start_at_beginning = 0;
1419         sctp_from_the_top2:
1420                 if (stcb->asoc.last_used_address == NULL) {
1421                         start_at_beginning=1;
1422                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1423                 }
1424                 /* search beginning with the last used address */
1425                 for (laddr = stcb->asoc.last_used_address; laddr;
1426                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1427                         if (laddr->ifa == NULL) {
1428                                 /* address has been removed */
1429                                 continue;
1430                         }
1431                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1432                         if (sin6 == NULL)
1433                                 continue;
1434                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1435                                 /* on the no-no list */
1436                                 continue;
1437                         }
1438                         return (sin6);
1439                 }
1440                 if (start_at_beginning == 0) {
1441                         stcb->asoc.last_used_address = NULL;
1442                         goto sctp_from_the_top2;
1443                 }
1444         } else {
1445 #ifdef SCTP_DEBUG
1446                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1447                         kprintf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
1448                 }
1449 #endif
1450                 /* First try for interface output match */
1451                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1452                              sctp_nxt_addr) {
1453                         if (laddr->ifa == NULL) {
1454                                 /* address has been removed */
1455                                 continue;
1456                         }
1457                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1458                         if (sin6 == NULL)
1459                                 continue;
1460                         /* first question, is laddr->ifa an address associated with the emit interface */
1461                         if (ifn) {
1462                                 struct ifaddr_container *ifac;
1463
1464                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1465                                         struct ifaddr *ifa = ifac->ifa;
1466
1467                                         if (laddr->ifa == ifa) {
1468                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1469                                                 return (sin6);
1470                                         }
1471                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1472                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1473                                                 return (sin6);
1474                                         }
1475                                 }
1476                         }
1477                 }
1478                 /* Next try for matching scope */
1479                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1480                              sctp_nxt_addr) {
1481                         if (laddr->ifa == NULL) {
1482                                 /* address has been removed */
1483                                 continue;
1484                         }
1485                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1486                         if (sin6 == NULL)
1487                                 continue;
1488
1489                         if ((loopscope == 0) &&
1490                             (loc_scope == 0) &&
1491                             (sin_loop == 0) &&
1492                             (sin_local == 0)) {
1493                                 /* all of global scope we are ok with it */
1494                                 return (sin6);
1495                         }
1496                         if (loopscope && sin_loop)
1497                                 /* both on the loopback, thats ok */
1498                                 return (sin6);
1499                         if (loc_scope && sin_local)
1500                                 /* both local scope */
1501                                 return (sin6);
1502                 }
1503                 /* ok, now try for a higher scope in the source address */
1504                 /* First try for matching scope */
1505                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1506                              sctp_nxt_addr) {
1507                         if (laddr->ifa == NULL) {
1508                                 /* address has been removed */
1509                                 continue;
1510                         }
1511                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1512                         if (sin6 == NULL)
1513                                 continue;
1514                         return (sin6);
1515                 }
1516         }
1517         return (NULL);
1518 }
1519
1520 static struct sockaddr_in6 *
1521 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1522                                  struct rtentry *rt,
1523                                  uint8_t loc_scope,
1524                                  uint8_t loopscope)
1525 {
1526         /*
1527          * Here we are bound specific and have only
1528          * an inp. We must find an address that is bound
1529          * that we can give out as a src address. We
1530          * prefer two addresses of same scope if we can
1531          * find them that way.
1532          */
1533         struct sctp_laddr *laddr;
1534         struct sockaddr_in6 *sin6;
1535         struct ifnet *ifn;
1536         int sin_loop, sin_local;
1537
1538         /* first question, is the ifn we will emit on
1539          * in our list, if so, we want that one.
1540          */
1541
1542         ifn = rt->rt_ifp;
1543         if (ifn) {
1544                 struct ifaddr_container *ifac;
1545
1546                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1547                         struct ifaddr *ifa = ifac->ifa;
1548
1549                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1550                         if (sin6 == NULL)
1551                                 continue;
1552                         if (sctp_is_addr_in_ep(inp, ifa)) {
1553                                 return (sin6);
1554                         }
1555                 }
1556         }
1557         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1558              laddr && (laddr != inp->next_addr_touse);
1559              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1560                 if (laddr->ifa == NULL) {
1561                         /* address has been removed */
1562                         continue;
1563                 }
1564                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1565                 if (sin6 == NULL)
1566                         continue;
1567
1568                 if ((loopscope == 0) &&
1569                     (loc_scope == 0) &&
1570                     (sin_loop == 0) &&
1571                     (sin_local == 0)) {
1572                         /* all of global scope we are ok with it */
1573                         return (sin6);
1574                 }
1575                 if (loopscope && sin_loop)
1576                         /* both on the loopback, thats ok */
1577                         return (sin6);
1578                 if (loc_scope && sin_local)
1579                         /* both local scope */
1580                         return (sin6);
1581
1582         }
1583         /* if we reach here, we could not find two addresses
1584          * of the same scope to give out. Lets look for any higher level
1585          * scope for a source address.
1586          */
1587         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1588              laddr && (laddr != inp->next_addr_touse);
1589              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1590                 if (laddr->ifa == NULL) {
1591                         /* address has been removed */
1592                         continue;
1593                 }
1594                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1595                 if (sin6 == NULL)
1596                         continue;
1597                 return (sin6);
1598         }
1599         /* no address bound can be a source for the destination */
1600 #ifdef SCTP_DEBUG
1601         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1602                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1603         }
1604 #endif
1605         return (NULL);
1606 }
1607
1608
1609 static struct sockaddr_in6 *
1610 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1611                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1612 {
1613         struct ifaddr_container *ifac;
1614         struct sockaddr_in6 *sin6;
1615         int sin_loop, sin_local;
1616         int num_eligible_addr = 0;
1617
1618         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1619                 struct ifaddr *ifa = ifac->ifa;
1620
1621                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1622                 if (sin6 == NULL)
1623                         continue;
1624                 if (stcb) {
1625                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1626                                 /* It is restricted for some reason.. probably
1627                                  * not yet added.
1628                                  */
1629                                 continue;
1630                         }
1631                 }
1632                 if (match_scope) {
1633                         /* Here we are asked to match scope if possible */
1634                         if (loopscope && sin_loop)
1635                                 /* src and destination are loopback scope */
1636                                 return (sin6);
1637                         if (loc_scope && sin_local)
1638                                 /* src and destination are local scope */
1639                                 return (sin6);
1640                         if ((loopscope == 0) &&
1641                             (loc_scope == 0)  &&
1642                             (sin_loop == 0) &&
1643                             (sin_local == 0)) {
1644                                 /* src and destination are global scope */
1645                                 return (sin6);
1646                         }
1647                         continue;
1648                 }
1649                 if (num_eligible_addr == cur_addr_num) {
1650                         /* this is it */
1651                         return (sin6);
1652                 }
1653                 num_eligible_addr++;
1654         }
1655         return (NULL);
1656 }
1657
1658
1659 static int
1660 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1661                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1662 {
1663         struct ifaddr_container *ifac;
1664         struct sockaddr_in6 *sin6;
1665         int num_eligible_addr = 0;
1666         int sin_loop, sin_local;
1667
1668         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1669                 struct ifaddr *ifa = ifac->ifa;
1670
1671                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1672                 if (sin6 == NULL)
1673                         continue;
1674                 if (stcb) {
1675                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1676                                 /* It is restricted for some reason.. probably
1677                                  * not yet added.
1678                                  */
1679                                 continue;
1680                         }
1681                 }
1682                 num_eligible_addr++;
1683         }
1684         return (num_eligible_addr);
1685 }
1686
1687
1688 static struct sockaddr_in6 *
1689 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1690                         struct sctp_tcb *stcb,
1691                         struct sctp_nets *net,
1692                         struct rtentry *rt,
1693                         uint8_t loc_scope,
1694                         uint8_t loopscope,
1695                         int non_asoc_addr_ok)
1696 {
1697         /* Ok, we are bound all SO any address
1698          * is ok to use as long as it is NOT in the negative
1699          * list.
1700          */
1701         int num_eligible_addr;
1702         int cur_addr_num=0;
1703         int started_at_beginning=0;
1704         int match_scope_prefered;
1705         /* first question is, how many eligible addresses are
1706          * there for the destination ifn that we are using that
1707          * are within the proper scope?
1708          */
1709         struct ifnet *ifn;
1710         struct sockaddr_in6 *sin6;
1711
1712         ifn = rt->rt_ifp;
1713         if (net) {
1714                 cur_addr_num = net->indx_of_eligible_next_to_use;
1715         }
1716         if (cur_addr_num == 0) {
1717                 match_scope_prefered = 1;
1718         } else {
1719                 match_scope_prefered = 0;
1720         }
1721         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1722 #ifdef SCTP_DEBUG
1723         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1724                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1725         }
1726 #endif
1727         if (num_eligible_addr == 0) {
1728                 /* no eligible addresses, we must use some other
1729                  * interface address if we can find one.
1730                  */
1731                 goto bound_all_v6_plan_b;
1732         }
1733         /* Ok we have num_eligible_addr set with how many we can use,
1734          * this may vary from call to call due to addresses being deprecated etc..
1735          */
1736         if (cur_addr_num >= num_eligible_addr) {
1737                 cur_addr_num = 0;
1738         }
1739         /* select the nth address from the list (where cur_addr_num is the nth) and
1740          * 0 is the first one, 1 is the second one etc...
1741          */
1742 #ifdef SCTP_DEBUG
1743         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1744                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1745                        cur_addr_num, match_scope_prefered);
1746         }
1747 #endif
1748         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1749                                                           loc_scope, cur_addr_num, match_scope_prefered);
1750         if (match_scope_prefered && (sin6 == NULL)) {
1751                 /* retry without the preference for matching scope */
1752 #ifdef SCTP_DEBUG
1753         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1754                 kprintf("retry with no match_scope_prefered\n");
1755         }
1756 #endif
1757                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1758                                                                   loc_scope, cur_addr_num, 0);
1759         }
1760         if (sin6) {
1761 #ifdef SCTP_DEBUG
1762                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1763                         kprintf("Selected address %d ifn:%x for the route\n", cur_addr_num, (u_int)ifn);
1764                 }
1765 #endif
1766                 if (net) {
1767                         /* store so we get the next one */
1768                         if (cur_addr_num < 255)
1769                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1770                         else
1771                                 net->indx_of_eligible_next_to_use = 0;
1772                 }
1773                 return (sin6);
1774         }
1775         num_eligible_addr = 0;
1776  bound_all_v6_plan_b:
1777         /* ok, if we reach here we either fell through
1778          * due to something changing during an interupt (unlikely)
1779          * or we have NO eligible source addresses for the ifn
1780          * of the route (most likely). We must look at all the other
1781          * interfaces EXCEPT rt->rt_ifp and do the same game.
1782          */
1783 #ifdef SCTP_DEBUG
1784         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1785                 kprintf("bound-all Plan B\n");
1786         }
1787 #endif
1788         if (inp->next_ifn_touse == NULL) {
1789                 started_at_beginning=1;
1790                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1791 #ifdef SCTP_DEBUG
1792                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1793                         kprintf("Start at first IFN:%x\n", (u_int)inp->next_ifn_touse);
1794                 }
1795 #endif
1796         } else {
1797                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1798 #ifdef SCTP_DEBUG
1799                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1800                         kprintf("Resume at IFN:%x\n", (u_int)inp->next_ifn_touse);
1801                 }
1802 #endif
1803                 if (inp->next_ifn_touse == NULL) {
1804 #ifdef SCTP_DEBUG
1805                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1806                                 kprintf("IFN Resets\n");
1807                         }
1808 #endif
1809                         started_at_beginning=1;
1810                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1811                 }
1812         }
1813         for (ifn = inp->next_ifn_touse; ifn;
1814              ifn = TAILQ_NEXT(ifn, if_list)) {
1815                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1816                         /* wrong base scope */
1817                         continue;
1818                 }
1819                 if (loc_scope && (ifn->if_index != loc_scope)) {
1820                         /* by definition the scope (from to->sin6_scopeid)
1821                          * must match that of the interface. If not then
1822                          * we could pick a wrong scope for the address.
1823                          * Ususally we don't hit plan-b since the route
1824                          * handles this. However we can hit plan-b when
1825                          * we send to local-host so the route is the
1826                          * loopback interface, but the destination is a
1827                          * link local.
1828                          */
1829                         continue;
1830                 }
1831                 if (ifn == rt->rt_ifp) {
1832                         /* already looked at this guy */
1833                         continue;
1834                 }
1835                 /* Address rotation will only work when we are not
1836                  * rotating sourced interfaces and are using the interface
1837                  * of the route. We would need to have a per interface index
1838                  * in order to do proper rotation.
1839                  */
1840                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1841 #ifdef SCTP_DEBUG
1842                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1843                         kprintf("IFN:%x has %d eligible\n", (u_int)ifn, num_eligible_addr);
1844                 }
1845 #endif
1846                 if (num_eligible_addr == 0) {
1847                         /* none we can use */
1848                         continue;
1849                 }
1850                 /* Ok we have num_eligible_addr set with how many we can use,
1851                  * this may vary from call to call due to addresses being deprecated etc..
1852                  */
1853                 inp->next_ifn_touse = ifn;
1854
1855                 /* select the first one we can find with perference for matching scope.
1856                  */
1857                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1858                 if (sin6 == NULL) {
1859                         /* can't find one with matching scope how about a source with higher
1860                          * scope
1861                          */
1862                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1863                         if (sin6 == NULL)
1864                                 /* Hmm, can't find one in the interface now */
1865                                 continue;
1866                 }
1867 #ifdef SCTP_DEBUG
1868                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1869                         kprintf("Selected the %d'th address of ifn:%x\n",
1870                                cur_addr_num,
1871                                (u_int)ifn);
1872                 }
1873 #endif
1874                 return (sin6);
1875         }
1876         if (started_at_beginning == 0) {
1877                 /* we have not been through all of them yet, force
1878                  * us to go through them all.
1879                  */
1880 #ifdef SCTP_DEBUG
1881                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1882                         kprintf("Force a recycle\n");
1883                 }
1884 #endif
1885                 inp->next_ifn_touse = NULL;
1886                 goto bound_all_v6_plan_b;
1887         }
1888         return (NULL);
1889
1890 }
1891
1892 /* stcb and net may be NULL */
1893 struct in6_addr
1894 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1895     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1896     int non_asoc_addr_ok)
1897 {
1898         struct in6_addr ans;
1899         struct sockaddr_in6 *rt_addr;
1900         uint8_t loc_scope, loopscope;
1901         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1902
1903         /*
1904          * This routine is tricky standard v6 src address
1905          * selection cannot take into account what we have
1906          * bound etc, so we can't use it.
1907          *
1908          * Instead here is what we must do:
1909          * 1) Make sure we have a route, if we
1910          *    don't have a route we can never reach the peer.
1911          * 2) Once we have a route, determine the scope of the
1912          *     route. Link local, loopback or global.
1913          * 3) Next we divide into three types. Either we
1914          *    are bound all.. which means we want to use
1915          *    one of the addresses of the interface we are
1916          *    going out. <or>
1917          * 4a) We have not stcb, which means we are using the
1918          *    specific addresses bound on an inp, in this
1919          *    case we are similar to the stcb case (4b below)
1920          *    accept the list is always a positive list.<or>
1921          * 4b) We are bound specific with a stcb, which means we have a
1922          *    list of bound addresses and we must see if the
1923          *    ifn of the route is actually one of the bound addresses.
1924          *    If not, then we must rotate addresses amongst properly
1925          *    scoped bound addresses, if so we use the address
1926          *    of the interface.
1927          * 5) Always, no matter which path we take through the above
1928          *    we must be sure the source address we use is allowed to
1929          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1930          *    addresses cannot be used.
1931          * 6) Addresses that are deprecated MAY be used
1932          *              if (!ip6_use_deprecated) {
1933          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1934          *                        skip the address
1935          *                    }
1936          *              }
1937          */
1938
1939         /*** 1> determine route, if not already done */
1940         if (ro->ro_rt == NULL) {
1941                 /*
1942                  * Need a route to cache.
1943                  */
1944 #ifndef SCOPEDROUTING
1945                 int scope_save;
1946                 scope_save = to->sin6_scope_id;
1947                 to->sin6_scope_id = 0;
1948 #endif
1949
1950 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1951                 rtalloc_ign(ro, 0UL);
1952 #else
1953                 rtalloc(ro);
1954 #endif
1955 #ifndef SCOPEDROUTING
1956                 to->sin6_scope_id = scope_save;
1957 #endif
1958         }
1959         if (ro->ro_rt == NULL) {
1960                 /*
1961                  * no route to host. this packet is going no-where.
1962                  * We probably should make sure we arrange to send back
1963                  * an error.
1964                  */
1965 #ifdef SCTP_DEBUG
1966                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1967                         kprintf("No route to host, this packet cannot be sent!\n");
1968                 }
1969 #endif
1970                 memset(&ans, 0, sizeof(ans));
1971                 return (ans);
1972         }
1973
1974         /*** 2a> determine scope for outbound address/route */
1975         loc_scope = loopscope = 0;
1976         /*
1977          * We base our scope on the outbound packet scope and route,
1978          * NOT the TCB (if there is one). This way in local scope we will only
1979          * use a local scope src address when we send to a local address.
1980          */
1981
1982         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1983                 /* If the route goes to the loopback address OR
1984                  * the address is a loopback address, we are loopback
1985                  * scope.
1986                  */
1987 #ifdef SCTP_DEBUG
1988                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1989                         kprintf("Loopback scope is set\n");
1990                 }
1991 #endif
1992                 loc_scope = 0;
1993                 loopscope = 1;
1994                 if (net != NULL) {
1995                         /* mark it as local */
1996                         net->addr_is_local = 1;
1997                 }
1998
1999         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
2000 #ifdef SCTP_DEBUG
2001                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2002                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2003                 }
2004 #endif
2005                 if (to->sin6_scope_id)
2006                         loc_scope = to->sin6_scope_id;
2007                 else {
2008                         loc_scope = 1;
2009                 }
2010                 loopscope = 0;
2011         } else {
2012 #ifdef SCTP_DEBUG
2013                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2014                         kprintf("Global scope is set\n");
2015                 }
2016 #endif
2017         }
2018
2019         /* now, depending on which way we are bound we call the appropriate
2020          * routine to do steps 3-6
2021          */
2022 #ifdef SCTP_DEBUG
2023         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2024                 kprintf("Destination address:");
2025                 sctp_print_address((struct sockaddr *)to);
2026         }
2027 #endif
2028
2029         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2030 #ifdef SCTP_DEBUG
2031                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2032                         kprintf("Calling bound-all src addr selection for v6\n");
2033                 }
2034 #endif
2035                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2036         } else {
2037 #ifdef SCTP_DEBUG
2038                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2039                         kprintf("Calling bound-specific src addr selection for v6\n");
2040                 }
2041 #endif
2042                 if (stcb)
2043                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2044                 else
2045                         /* we can't have a non-asoc address since we have no association */
2046                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2047         }
2048         if (rt_addr == NULL) {
2049                 /* no suitable address? */
2050                 struct in6_addr in6;
2051 #ifdef SCTP_DEBUG
2052                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2053                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2054                 }
2055 #endif
2056                 memset(&in6, 0, sizeof(in6));
2057                 return (in6);
2058         }
2059 #ifdef SCTP_DEBUG
2060         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2061                 kprintf("Source address selected is:");
2062                 sctp_print_address((struct sockaddr *)rt_addr);
2063         }
2064 #endif
2065         return (rt_addr->sin6_addr);
2066 }
2067
2068 static uint8_t
2069 sctp_get_ect(struct sctp_tcb *stcb,
2070              struct sctp_tmit_chunk *chk)
2071 {
2072         uint8_t this_random;
2073
2074         /* Huh? */
2075         if (sctp_ecn == 0)
2076                 return (0);
2077
2078         if (sctp_ecn_nonce == 0)
2079                 /* no nonce, always return ECT0 */
2080                 return (SCTP_ECT0_BIT);
2081
2082         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2083                 /* Peer does NOT support it, so we send a ECT0 only */
2084                 return (SCTP_ECT0_BIT);
2085         }
2086
2087         if (chk == NULL)
2088            return (SCTP_ECT0_BIT);
2089
2090         if (((stcb->asoc.hb_random_idx == 3) &&
2091              (stcb->asoc.hb_ect_randombit > 7)) ||
2092              (stcb->asoc.hb_random_idx > 3)) {
2093                 uint32_t rndval;
2094                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2095                 memcpy(stcb->asoc.hb_random_values, &rndval,
2096                        sizeof(stcb->asoc.hb_random_values));
2097                 this_random = stcb->asoc.hb_random_values[0];
2098                 stcb->asoc.hb_random_idx = 0;
2099                 stcb->asoc.hb_ect_randombit = 0;
2100         } else {
2101                 if (stcb->asoc.hb_ect_randombit > 7) {
2102                   stcb->asoc.hb_ect_randombit = 0;
2103                   stcb->asoc.hb_random_idx++;
2104                 }
2105                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2106         }
2107         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2108                 if (chk != NULL)
2109                         /* ECN Nonce stuff */
2110                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2111                 stcb->asoc.hb_ect_randombit++;
2112                 return (SCTP_ECT1_BIT);
2113         } else {
2114                 stcb->asoc.hb_ect_randombit++;
2115                 return (SCTP_ECT0_BIT);
2116         }
2117 }
2118
2119 extern int sctp_no_csum_on_loopback;
2120
2121 static int
2122 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2123                            struct sctp_tcb *stcb,    /* may be NULL */
2124                            struct sctp_nets *net,
2125                            struct sockaddr *to,
2126                            struct mbuf *m,
2127                            int nofragment_flag,
2128                            int ecn_ok,
2129                            struct sctp_tmit_chunk *chk,
2130                            int out_of_asoc_ok)
2131         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2132 {
2133         /*
2134          * Given a mbuf chain (via m_next) that holds a packet header
2135          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2136          * - calculate SCTP checksum and fill in
2137          * - prepend a IP address header
2138          * - if boundall use INADDR_ANY
2139          * - if boundspecific do source address selection
2140          * - set fragmentation option for ipV4
2141          * - On return from IP output, check/adjust mtu size
2142          * - of output interface and smallest_mtu size as well.
2143          */
2144         struct sctphdr *sctphdr;
2145         int o_flgs;
2146         uint32_t csum;
2147         int ret;
2148         unsigned int have_mtu;
2149         struct route *ro;
2150
2151         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2152                 sctp_m_freem(m);
2153                 return (EFAULT);
2154         }
2155         if ((m->m_flags & M_PKTHDR) == 0) {
2156 #ifdef SCTP_DEBUG
2157                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2158                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2159                 }
2160 #endif
2161                 sctp_m_freem(m);
2162                 return (EFAULT);
2163         }
2164         /* Calculate the csum and fill in the length of the packet */
2165         sctphdr = mtod(m, struct sctphdr *);
2166         have_mtu = 0;
2167         if (sctp_no_csum_on_loopback &&
2168              (stcb) &&
2169              (stcb->asoc.loopback_scope)) {
2170                 sctphdr->checksum = 0;
2171                 m->m_pkthdr.len = sctp_calculate_len(m);
2172         } else {
2173                 sctphdr->checksum = 0;
2174                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2175                 sctphdr->checksum = csum;
2176         }
2177         if (to->sa_family == AF_INET) {
2178                 struct ip *ip;
2179                 struct route iproute;
2180                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2181                 if (m == NULL) {
2182                         /* failed to prepend data, give up */
2183                         return (ENOMEM);
2184                 }
2185                 ip = mtod(m, struct ip *);
2186                 ip->ip_v = IPVERSION;
2187                 ip->ip_hl = (sizeof(struct ip) >> 2);
2188                 if (nofragment_flag) {
2189 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2190 #if defined( __OpenBSD__) || defined(__NetBSD__)
2191                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2192                         ip->ip_off = htons(IP_DF);
2193 #else
2194                         ip->ip_off = IP_DF;
2195 #endif
2196 #else
2197                         ip->ip_off = htons(IP_DF);
2198 #endif
2199                 } else
2200                         ip->ip_off = 0;
2201
2202 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2203 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2204                 ip->ip_id = htons(ip_randomid());
2205 #else
2206                 ip->ip_id = htons(ip_id++);
2207 #endif
2208
2209 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2210                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2211 #else
2212                 ip->ip_ttl = inp->inp_ip_ttl;
2213 #endif
2214 #if defined(__OpenBSD__) || defined(__NetBSD__)
2215                 ip->ip_len = htons(m->m_pkthdr.len);
2216 #else
2217                 ip->ip_len = m->m_pkthdr.len;
2218 #endif
2219                 if (stcb) {
2220                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2221                                 /* Enable ECN */
2222 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2223                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2224                                                       sctp_get_ect(stcb, chk));
2225 #elif defined(__NetBSD__)
2226                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2227                                                       sctp_get_ect(stcb, chk));
2228 #else
2229                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2230                                                       sctp_get_ect(stcb, chk));
2231 #endif
2232                         } else {
2233                                 /* No ECN */
2234 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2235                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2236 #elif defined(__NetBSD__)
2237                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2238 #else
2239                                 ip->ip_tos = inp->inp_ip_tos;
2240 #endif
2241                         }
2242                 } else {
2243                         /* no association at all */
2244 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2245                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2246 #else
2247                         ip->ip_tos = inp->inp_ip_tos;
2248 #endif
2249                 }
2250                 ip->ip_p = IPPROTO_SCTP;
2251                 ip->ip_sum = 0;
2252                 if (net == NULL) {
2253                         ro = &iproute;
2254                         memset(&iproute, 0, sizeof(iproute));
2255                         memcpy(&ro->ro_dst, to, to->sa_len);
2256                 } else {
2257                         ro = (struct route *)&net->ro;
2258                 }
2259                 /* Now the address selection part */
2260                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2261
2262                 /* call the routine to select the src address */
2263                 if (net) {
2264                         if (net->src_addr_selected == 0) {
2265                                 /* Cache the source address */
2266                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2267                                     stcb,
2268                                     ro, net, out_of_asoc_ok);
2269                                 if (ro->ro_rt)
2270                                         net->src_addr_selected = 1;
2271                         }
2272                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2273                 } else {
2274                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2275                             stcb, ro, net, out_of_asoc_ok);
2276                 }
2277                 /*
2278                  * If source address selection fails and we find no route then
2279                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2280                  * type error. We probably should catch that somewhere and
2281                  * abort the association right away (assuming this is an INIT
2282                  * being sent).
2283                  */
2284                 if ((ro->ro_rt == NULL)) {
2285                         /*
2286                          * src addr selection failed to find a route (or valid
2287                          * source addr), so we can't get there from here!
2288                          */
2289 #ifdef SCTP_DEBUG
2290                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2291                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2292                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2293                         }
2294 #endif /* SCTP_DEBUG */
2295                         if (net) {
2296                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2297                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2298                                                         stcb,
2299                                                         SCTP_FAILED_THRESHOLD,
2300                                                         (void *)net);
2301                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2302                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2303                                 if (stcb) {
2304                                         if (net == stcb->asoc.primary_destination) {
2305                                                 /* need a new primary */
2306                                                 struct sctp_nets *alt;
2307                                                 alt = sctp_find_alternate_net(stcb, net);
2308                                                 if (alt != net) {
2309                                                         if (sctp_set_primary_addr(stcb,
2310                                                                               (struct sockaddr *)NULL,
2311                                                                                  alt) == 0) {
2312                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2313                                                                 net->src_addr_selected = 0;
2314                                                         }
2315                                                 }
2316                                         }
2317                                 }
2318                         }
2319                         sctp_m_freem(m);
2320                         return (EHOSTUNREACH);
2321                 } else {
2322                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2323                 }
2324
2325                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2326 #ifdef SCTP_DEBUG
2327                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2328                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2329                                (u_int)(ntohl(ip->ip_src.s_addr)));
2330                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2331                         kprintf("RTP route is %p through\n", ro->ro_rt);
2332                 }
2333 #endif
2334                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2335                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2336                 }
2337                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2338                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2339 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2340     || defined(__DragonFly__)
2341                                 , (struct inpcb *)NULL
2342 #endif
2343 #if defined(__NetBSD__)
2344                                 ,(struct socket *)inp->sctp_socket
2345 #endif
2346
2347 );
2348                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2349                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2350                 }
2351                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2352 #ifdef SCTP_DEBUG
2353                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2354                         kprintf("Ip output returns %d\n", ret);
2355                 }
2356 #endif
2357                 if (net == NULL) {
2358                         /* free tempy routes */
2359                         if (ro->ro_rt)
2360                                 RTFREE(ro->ro_rt);
2361                 } else {
2362                         /* PMTU check versus smallest asoc MTU goes here */
2363                         if (ro->ro_rt != NULL) {
2364                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2365                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2366                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2367                                             ro->ro_rt->rt_rmx.rmx_mtu);
2368                                 }
2369                         } else {
2370                                 /* route was freed */
2371                                 net->src_addr_selected = 0;
2372                         }
2373                 }
2374                 return (ret);
2375         }
2376 #ifdef INET6
2377         else if (to->sa_family == AF_INET6) {
2378                 struct ip6_hdr *ip6h;
2379 #ifdef NEW_STRUCT_ROUTE
2380                 struct route ip6route;
2381 #else
2382                 struct route_in6 ip6route;
2383 #endif
2384                 struct ifnet *ifp;
2385                 u_char flowTop;
2386                 uint16_t flowBottom;
2387                 u_char tosBottom, tosTop;
2388                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2389                 struct sockaddr_in6 lsa6_storage;
2390                 int prev_scope=0;
2391                 int error;
2392                 u_short prev_port=0;
2393
2394                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2395                 if (m == NULL) {
2396                         /* failed to prepend data, give up */
2397                         return (ENOMEM);
2398                 }
2399                 ip6h = mtod(m, struct ip6_hdr *);
2400
2401                 /*
2402                  * We assume here that inp_flow is in host byte order within
2403                  * the TCB!
2404                  */
2405                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2406                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2407
2408                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2409
2410                 /* protect *sin6 from overwrite */
2411                 sin6 = (struct sockaddr_in6 *)to;
2412                 tmp = *sin6;
2413                 sin6 = &tmp;
2414
2415                 /* KAME hack: embed scopeid */
2416 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2417                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2418 #else
2419                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2420 #endif
2421                         return (EINVAL);
2422                 if (net == NULL) {
2423                         memset(&ip6route, 0, sizeof(ip6route));
2424                         ro = (struct route *)&ip6route;
2425                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2426                 } else {
2427                         ro = (struct route *)&net->ro;
2428                 }
2429                 if (stcb != NULL) {
2430                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2431                                 /* Enable ECN */
2432                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2433                         } else {
2434                                 /* No ECN */
2435                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2436                         }
2437                 } else {
2438                         /* we could get no asoc if it is a O-O-T-B packet */
2439                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2440                 }
2441                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2442                 ip6h->ip6_nxt = IPPROTO_SCTP;
2443                 ip6h->ip6_plen = m->m_pkthdr.len;
2444                 ip6h->ip6_dst = sin6->sin6_addr;
2445
2446                 /*
2447                  * Add SRC address selection here:
2448                  * we can only reuse to a limited degree the kame src-addr-sel,
2449                  * since we can try their selection but it may not be bound.
2450                  */
2451                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2452                 lsa6_tmp.sin6_family = AF_INET6;
2453                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2454                 lsa6 = &lsa6_tmp;
2455                 if (net) {
2456                         if (net->src_addr_selected == 0) {
2457                                 /* Cache the source address */
2458                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2459                                     stcb, ro, net, out_of_asoc_ok);
2460
2461                                 if (ro->ro_rt)
2462                                         net->src_addr_selected = 1;
2463                         }
2464                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2465                 } else {
2466                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2467                             inp, stcb, ro, net, out_of_asoc_ok);
2468                 }
2469                 lsa6->sin6_port = inp->sctp_lport;
2470
2471                 if ((ro->ro_rt ==  NULL)) {
2472                         /*
2473                          * src addr selection failed to find a route (or valid
2474                          * source addr), so we can't get there from here!
2475                          */
2476 #ifdef SCTP_DEBUG
2477                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2478                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2479                         }
2480 #endif
2481                         sctp_m_freem(m);
2482                         if (net) {
2483                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2484                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2485                                                         stcb,
2486                                                         SCTP_FAILED_THRESHOLD,
2487                                                         (void *)net);
2488                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2489                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2490                                 if (stcb) {
2491                                         if (net == stcb->asoc.primary_destination) {
2492                                                 /* need a new primary */
2493                                                 struct sctp_nets *alt;
2494                                                 alt = sctp_find_alternate_net(stcb, net);
2495                                                 if (alt != net) {
2496                                                         if (sctp_set_primary_addr(stcb,
2497                                                                               (struct sockaddr *)NULL,
2498                                                                                  alt) == 0) {
2499                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2500                                                                 net->src_addr_selected = 0;
2501                                                         }
2502                                                 }
2503                                         }
2504                                 }
2505                         }
2506                         return (EHOSTUNREACH);
2507                 }
2508
2509 #ifndef SCOPEDROUTING
2510                 /*
2511                  * XXX: sa6 may not have a valid sin6_scope_id in
2512                  * the non-SCOPEDROUTING case.
2513                  */
2514                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2515                 lsa6_storage.sin6_family = AF_INET6;
2516                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2517                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2518                                               NULL)) != 0) {
2519                         sctp_m_freem(m);
2520                         return (error);
2521                 }
2522                 /* XXX */
2523                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2524                 lsa6_storage.sin6_port = inp->sctp_lport;
2525                 lsa6 = &lsa6_storage;
2526 #endif /* SCOPEDROUTING */
2527                 ip6h->ip6_src = lsa6->sin6_addr;
2528
2529                 /*
2530                  * We set the hop limit now since there is a good chance that
2531                  * our ro pointer is now filled
2532                  */
2533                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2534                                                 (ro ?
2535                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2536                                                  (NULL)));
2537                 o_flgs = 0;
2538                 ifp = ro->ro_rt->rt_ifp;
2539 #ifdef SCTP_DEBUG
2540                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2541                         /* Copy to be sure something bad is not happening */
2542                         sin6->sin6_addr = ip6h->ip6_dst;
2543                         lsa6->sin6_addr = ip6h->ip6_src;
2544
2545                         kprintf("Calling ipv6 output routine from low level\n");
2546                         kprintf("src: ");
2547                         sctp_print_address((struct sockaddr *)lsa6);
2548                         kprintf("dst: ");
2549                         sctp_print_address((struct sockaddr *)sin6);
2550                 }
2551 #endif /* SCTP_DEBUG */
2552                 if (net) {
2553                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2554                         /* preserve the port and scope for link local send */
2555                         prev_scope = sin6->sin6_scope_id;
2556                         prev_port = sin6->sin6_port;
2557                 }
2558                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2559 #ifdef NEW_STRUCT_ROUTE
2560                                  ro,
2561 #else
2562                                  (struct route_in6 *)ro,
2563 #endif
2564                                  o_flgs,
2565                                  ((struct in6pcb *)inp)->in6p_moptions,
2566 #if defined(__NetBSD__)
2567                                  (struct socket *)inp->sctp_socket,
2568 #endif
2569                                  &ifp
2570 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2571                     , NULL
2572 #endif
2573                         );
2574                 if (net) {
2575                         /* for link local this must be done */
2576                         sin6->sin6_scope_id = prev_scope;
2577                         sin6->sin6_port = prev_port;
2578                 }
2579 #ifdef SCTP_DEBUG
2580                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2581                         kprintf("return from send is %d\n", ret);
2582                 }
2583 #endif /* SCTP_DEBUG_OUTPUT */
2584                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2585                 if (net == NULL) {
2586                         /* Now if we had a temp route free it */
2587                         if (ro->ro_rt) {
2588                                 RTFREE(ro->ro_rt);
2589                         }
2590                 } else {
2591                         /* PMTU check versus smallest asoc MTU goes here */
2592                         if (ro->ro_rt == NULL) {
2593                                 /* Route was freed */
2594                                 net->src_addr_selected = 0;
2595                         }
2596                         if (ro->ro_rt != NULL) {
2597                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2598                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2599                                         sctp_mtu_size_reset(inp,
2600                                                             &stcb->asoc,
2601                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2602                                 }
2603                         } else if (ifp) {
2604 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2605 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2606 #endif /* SCTP_BASE_FREEBSD */
2607                                 if (ND_IFINFO(ifp)->linkmtu &&
2608                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2609                                         sctp_mtu_size_reset(inp,
2610                                                             &stcb->asoc,
2611                                                             ND_IFINFO(ifp)->linkmtu);
2612                                 }
2613                         }
2614                 }
2615                 return (ret);
2616         }
2617 #endif
2618         else {
2619 #ifdef SCTP_DEBUG
2620                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2621                         kprintf("Unknown protocol (TSNH) type %d\n", ((struct sockaddr *)to)->sa_family);
2622                 }
2623 #endif
2624                 sctp_m_freem(m);
2625                 return (EFAULT);
2626         }
2627 }
2628
2629 static int
2630 sctp_is_address_in_scope(struct ifaddr *ifa,
2631                          int ipv4_addr_legal,
2632                          int ipv6_addr_legal,
2633                          int loopback_scope,
2634                          int ipv4_local_scope,
2635                          int local_scope,
2636                          int site_scope)
2637 {
2638         if ((loopback_scope == 0) &&
2639             (ifa->ifa_ifp) &&
2640             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2641                 /* skip loopback if not in scope *
2642                  */
2643                 return (0);
2644         }
2645         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2646                 struct sockaddr_in *sin;
2647                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2648                 if (sin->sin_addr.s_addr == 0) {
2649                         /* not in scope , unspecified */
2650                         return (0);
2651                 }
2652                 if ((ipv4_local_scope == 0) &&
2653                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2654                         /* private address not in scope */
2655                         return (0);
2656                 }
2657         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2658                 struct sockaddr_in6 *sin6;
2659                 struct in6_ifaddr *ifa6;
2660
2661                 ifa6 = (struct in6_ifaddr *)ifa;
2662                 /* ok to use deprecated addresses? */
2663                 if (!ip6_use_deprecated) {
2664                         if (ifa6->ia6_flags &
2665                             IN6_IFF_DEPRECATED) {
2666                                 return (0);
2667                         }
2668                 }
2669                 if (ifa6->ia6_flags &
2670                     (IN6_IFF_DETACHED |
2671                      IN6_IFF_ANYCAST |
2672                      IN6_IFF_NOTREADY)) {
2673                         return (0);
2674                 }
2675                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2676                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2677                         /* skip unspecifed addresses */
2678                         return (0);
2679                 }
2680                 if (/*(local_scope == 0) && */
2681                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2682                         return (0);
2683                 }
2684                 if ((site_scope == 0) &&
2685                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2686                         return (0);
2687                 }
2688         } else {
2689                 return (0);
2690         }
2691         return (1);
2692 }
2693
2694
2695 void
2696 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2697 {
2698         struct mbuf *m, *m_at, *m_last;
2699         struct sctp_nets *net;
2700         struct sctp_init_msg *initm;
2701         struct sctp_supported_addr_param *sup_addr;
2702         struct sctp_ecn_supported_param *ecn;
2703         struct sctp_prsctp_supported_param *prsctp;
2704         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2705         struct sctp_supported_chunk_types_param *pr_supported;
2706         int cnt_inits_to=0;
2707         int padval, ret;
2708
2709         /* INIT's always go to the primary (and usually ONLY address) */
2710         m_last = NULL;
2711         net = stcb->asoc.primary_destination;
2712         if (net == NULL) {
2713                 net = TAILQ_FIRST(&stcb->asoc.nets);
2714                 if (net == NULL) {
2715                         /* TSNH */
2716                         return;
2717                 }
2718                 /* we confirm any address we send an INIT to */
2719                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2720                 sctp_set_primary_addr(stcb, NULL, net);
2721         } else {
2722                 /* we confirm any address we send an INIT to */
2723                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2724         }
2725 #ifdef SCTP_DEBUG
2726         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2727                 kprintf("Sending INIT to ");
2728                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2729         }
2730 #endif
2731         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2732                 /* special hook, if we are sending to link local
2733                  * it will not show up in our private address count.
2734                  */
2735                 struct sockaddr_in6 *sin6l;
2736                 sin6l = &net->ro._l_addr.sin6;
2737                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2738                         cnt_inits_to = 1;
2739         }
2740         if (callout_pending(&net->rxt_timer.timer)) {
2741                 /* This case should not happen */
2742                 return;
2743         }
2744         /* start the INIT timer */
2745         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2746                 /* we are hosed since I can't start the INIT timer? */
2747                 return;
2748         }
2749         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2750         if (m == NULL) {
2751                 /* No memory, INIT timer will re-attempt. */
2752                 return;
2753         }
2754         /* make it into a M_EXT */
2755         MCLGET(m, MB_DONTWAIT);
2756         if ((m->m_flags & M_EXT) != M_EXT) {
2757                 /* Failed to get cluster buffer */
2758                 sctp_m_freem(m);
2759                 return;
2760         }
2761         m->m_data += SCTP_MIN_OVERHEAD;
2762         m->m_len = sizeof(struct sctp_init_msg);
2763         /* Now lets put the SCTP header in place */
2764         initm = mtod(m, struct sctp_init_msg *);
2765         initm->sh.src_port = inp->sctp_lport;
2766         initm->sh.dest_port = stcb->rport;
2767         initm->sh.v_tag = 0;
2768         initm->sh.checksum = 0; /* calculate later */
2769         /* now the chunk header */
2770         initm->msg.ch.chunk_type = SCTP_INITIATION;
2771         initm->msg.ch.chunk_flags = 0;
2772         /* fill in later from mbuf we build */
2773         initm->msg.ch.chunk_length = 0;
2774         /* place in my tag */
2775         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2776         /* set up some of the credits. */
2777         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2778             SCTP_MINIMAL_RWND));
2779
2780         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2781         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2782         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2783         /* now the address restriction */
2784         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2785             sizeof(*initm));
2786         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2787         /* we support 2 types IPv6/IPv4 */
2788         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2789                                           sizeof(uint16_t));
2790         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2791         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2792         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2793
2794 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2795         if (inp->sctp_ep.adaption_layer_indicator) {
2796                 struct sctp_adaption_layer_indication *ali;
2797                 ali = (struct sctp_adaption_layer_indication *)(
2798                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2799                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2800                 ali->ph.param_length = htons(sizeof(*ali));
2801                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2802                 m->m_len += sizeof(*ali);
2803                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2804                     sizeof(*ali));
2805         } else {
2806                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2807                     sizeof(*sup_addr) + sizeof(uint16_t));
2808         }
2809
2810         /* now any cookie time extensions */
2811         if (stcb->asoc.cookie_preserve_req) {
2812                 struct sctp_cookie_perserve_param *cookie_preserve;
2813                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2814                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2815                 cookie_preserve->ph.param_length = htons(
2816                     sizeof(*cookie_preserve));
2817                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2818                 m->m_len += sizeof(*cookie_preserve);
2819                 ecn = (struct sctp_ecn_supported_param *)(
2820                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2821                 stcb->asoc.cookie_preserve_req = 0;
2822         }
2823
2824         /* ECN parameter */
2825         if (sctp_ecn == 1) {
2826                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2827                 ecn->ph.param_length = htons(sizeof(*ecn));
2828                 m->m_len += sizeof(*ecn);
2829                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2830                     sizeof(*ecn));
2831         } else {
2832                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2833         }
2834         /* And now tell the peer we do pr-sctp */
2835         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2836         prsctp->ph.param_length = htons(sizeof(*prsctp));
2837         m->m_len += sizeof(*prsctp);
2838
2839
2840         /* And now tell the peer we do all the extensions */
2841         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2842            sizeof(*prsctp));
2843
2844         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2845         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2846         pr_supported->chunk_types[0] = SCTP_ASCONF;
2847         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2848         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2849         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2850         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2851         pr_supported->chunk_types[5] = 0; /* pad */
2852         pr_supported->chunk_types[6] = 0; /* pad */
2853         pr_supported->chunk_types[7] = 0; /* pad */
2854
2855         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2856         /* ECN nonce: And now tell the peer we support ECN nonce */
2857
2858         if (sctp_ecn_nonce) {
2859                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2860                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2861                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2862                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2863                 m->m_len += sizeof(*ecn_nonce);
2864         }
2865
2866         m_at = m;
2867         /* now the addresses */
2868         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2869                 struct ifnet *ifn;
2870                 int cnt;
2871
2872                 cnt = cnt_inits_to;
2873                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2874                         struct ifaddr_container *ifac;
2875
2876                         if ((stcb->asoc.loopback_scope == 0) &&
2877                             (ifn->if_type == IFT_LOOP)) {
2878                                 /*
2879                                  * Skip loopback devices if loopback_scope
2880                                  * not set
2881                                  */
2882                                 continue;
2883                         }
2884                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2885                                 struct ifaddr *ifa = ifac->ifa;
2886
2887                                 if (sctp_is_address_in_scope(ifa,
2888                                     stcb->asoc.ipv4_addr_legal,
2889                                     stcb->asoc.ipv6_addr_legal,
2890                                     stcb->asoc.loopback_scope,
2891                                     stcb->asoc.ipv4_local_scope,
2892                                     stcb->asoc.local_scope,
2893                                     stcb->asoc.site_scope) == 0) {
2894                                         continue;
2895                                 }
2896                                 cnt++;
2897                         }
2898                 }
2899                 if (cnt > 1) {
2900                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2901                                 struct ifaddr_container *ifac;
2902
2903                                 if ((stcb->asoc.loopback_scope == 0) &&
2904                                     (ifn->if_type == IFT_LOOP)) {
2905                                         /*
2906                                          * Skip loopback devices if loopback_scope
2907                                          * not set
2908                                          */
2909                                         continue;
2910                                 }
2911                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2912                                         struct ifaddr *ifa = ifac->ifa;
2913
2914                                         if (sctp_is_address_in_scope(ifa,
2915                                             stcb->asoc.ipv4_addr_legal,
2916                                             stcb->asoc.ipv6_addr_legal,
2917                                             stcb->asoc.loopback_scope,
2918                                             stcb->asoc.ipv4_local_scope,
2919                                             stcb->asoc.local_scope,
2920                                             stcb->asoc.site_scope) == 0) {
2921                                                 continue;
2922                                         }
2923                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2924                                 }
2925                         }
2926                 }
2927         } else {
2928                 struct sctp_laddr *laddr;
2929                 int cnt;
2930                 cnt = cnt_inits_to;
2931                 /* First, how many ? */
2932                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2933                         if (laddr->ifa == NULL) {
2934                                 continue;
2935                         }
2936                         if (laddr->ifa->ifa_addr == NULL)
2937                                 continue;
2938                         if (sctp_is_address_in_scope(laddr->ifa,
2939                             stcb->asoc.ipv4_addr_legal,
2940                             stcb->asoc.ipv6_addr_legal,
2941                             stcb->asoc.loopback_scope,
2942                             stcb->asoc.ipv4_local_scope,
2943                             stcb->asoc.local_scope,
2944                             stcb->asoc.site_scope) == 0) {
2945                                 continue;
2946                         }
2947                         cnt++;
2948                 }
2949                 /* To get through a NAT we only list addresses if
2950                  * we have more than one. That way if you just
2951                  * bind a single address we let the source of the init
2952                  * dictate our address.
2953                  */
2954                 if (cnt > 1) {
2955                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2956                                 if (laddr->ifa == NULL) {
2957                                         continue;
2958                                 }
2959                                 if (laddr->ifa->ifa_addr == NULL) {
2960                                         continue;
2961                                 }
2962
2963                                 if (sctp_is_address_in_scope(laddr->ifa,
2964                                     stcb->asoc.ipv4_addr_legal,
2965                                     stcb->asoc.ipv6_addr_legal,
2966                                     stcb->asoc.loopback_scope,
2967                                     stcb->asoc.ipv4_local_scope,
2968                                     stcb->asoc.local_scope,
2969                                     stcb->asoc.site_scope) == 0) {
2970                                         continue;
2971                                 }
2972                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2973                         }
2974                 }
2975         }
2976         /* calulate the size and update pkt header and chunk header */
2977         m->m_pkthdr.len = 0;
2978         for (m_at = m; m_at; m_at = m_at->m_next) {
2979                 if (m_at->m_next == NULL)
2980                         m_last = m_at;
2981                 m->m_pkthdr.len += m_at->m_len;
2982         }
2983         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2984             sizeof(struct sctphdr)));
2985         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2986          * ignore the return here since the timer will drive
2987          * a retranmission.
2988          */
2989
2990         /* I don't expect this to execute but we will be safe here */
2991         padval = m->m_pkthdr.len % 4;
2992         if ((padval) && (m_last)) {
2993                 /* The compiler worries that m_last may not be
2994                  * set even though I think it is impossible :->
2995                  * however we add m_last here just in case.
2996                  */
2997                 int ret;
2998                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2999                 if (ret) {
3000                         /* Houston we have a problem, no space */
3001                         sctp_m_freem(m);
3002                         return;
3003                 }
3004                 m->m_pkthdr.len += padval;
3005         }
3006 #ifdef SCTP_DEBUG
3007         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3008                 kprintf("Calling lowlevel output stcb:%x net:%x\n",
3009                        (u_int)stcb, (u_int)net);
3010         }
3011 #endif
3012         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3013                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3014 #ifdef SCTP_DEBUG
3015         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3016                 kprintf("Low level output returns %d\n", ret);
3017         }
3018 #endif
3019         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3020         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3021 }
3022
3023 struct mbuf *
3024 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3025     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3026 {
3027         /* Given a mbuf containing an INIT or INIT-ACK
3028          * with the param_offset being equal to the
3029          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3030          * parse through the parameters to the end of the mbuf verifying
3031          * that all parameters are known.
3032          *
3033          * For unknown parameters build and return a mbuf with
3034          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3035          * to stop processing this chunk stop, and set *abort_processing
3036          * to 1.
3037          *
3038          * By having param_offset be pre-set to where parameters begin
3039          * it is hoped that this routine may be reused in the future
3040          * by new features.
3041          */
3042         struct sctp_paramhdr *phdr, params;
3043
3044         struct mbuf *mat, *op_err;
3045         char tempbuf[2048];
3046         int at, limit, pad_needed;
3047         uint16_t ptype, plen;
3048         int err_at;
3049
3050         *abort_processing = 0;
3051         mat = in_initpkt;
3052         err_at = 0;
3053         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3054 #ifdef SCTP_DEBUG
3055         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3056                 kprintf("Limit is %d bytes\n", limit);
3057         }
3058 #endif
3059         at = param_offset;
3060         op_err = NULL;
3061
3062         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3063         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3064                 ptype = ntohs(phdr->param_type);
3065                 plen = ntohs(phdr->param_length);
3066                 limit -= SCTP_SIZE32(plen);
3067                 if (plen < sizeof(struct sctp_paramhdr)) {
3068 #ifdef SCTP_DEBUG
3069         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3070                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3071         }
3072 #endif
3073                         *abort_processing = 1;
3074                         break;
3075                 }
3076                 /* All parameters for all chunks that we
3077                  * know/understand are listed here. We process
3078                  * them other places and make appropriate
3079                  * stop actions per the upper bits. However
3080                  * this is the generic routine processor's can
3081                  * call to get back an operr.. to either incorporate (init-ack)
3082                  * or send.
3083                  */
3084                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3085                     (ptype == SCTP_IPV4_ADDRESS) ||
3086                     (ptype == SCTP_IPV6_ADDRESS) ||
3087                     (ptype == SCTP_STATE_COOKIE) ||
3088                     (ptype == SCTP_UNRECOG_PARAM) ||
3089                     (ptype == SCTP_COOKIE_PRESERVE) ||
3090                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3091                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3092                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3093                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3094                     (ptype == SCTP_ECN_CAPABLE) ||
3095                     (ptype == SCTP_ULP_ADAPTION) ||
3096                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3097                     (ptype == SCTP_SET_PRIM_ADDR) ||
3098                     (ptype == SCTP_SUCCESS_REPORT) ||
3099                     (ptype == SCTP_ULP_ADAPTION) ||
3100                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3101                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3102                         ) {
3103                         /* no skip it */
3104                         at += SCTP_SIZE32(plen);
3105                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3106                         /* We can NOT handle HOST NAME addresses!! */
3107 #ifdef SCTP_DEBUG
3108         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3109                 kprintf("Can't handle hostname addresses.. abort processing\n");
3110         }
3111 #endif
3112                         *abort_processing = 1;
3113                         if (op_err == NULL) {
3114                                 /* Ok need to try to get a mbuf */
3115                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3116                                 if (op_err) {
3117                                         op_err->m_len = 0;
3118                                         op_err->m_pkthdr.len = 0;
3119                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3120                                         op_err->m_data += sizeof(struct ip6_hdr);
3121                                         op_err->m_data += sizeof(struct sctphdr);
3122                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3123                                 }
3124                         }
3125                         if (op_err) {
3126                                 /* If we have space */
3127                                 struct sctp_paramhdr s;
3128                                 if (err_at % 4) {
3129                                         u_int32_t cpthis=0;
3130                                         pad_needed = 4 - (err_at % 4);
3131                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3132                                         err_at += pad_needed;
3133                                 }
3134                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3135                                 s.param_length = htons(sizeof(s) + plen);
3136                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3137                                 err_at += sizeof(s);
3138                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3139                                 if (phdr == NULL) {
3140                                         sctp_m_freem(op_err);
3141                                         /* we are out of memory but we
3142                                          * still need to have a look at what to
3143                                          * do (the system is in trouble though).
3144                                          */
3145                                         return (NULL);
3146                                 }
3147                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3148                                 err_at += plen;
3149                         }
3150                         return (op_err);
3151                 } else {
3152                         /* we do not recognize the parameter
3153                          * figure out what we do.
3154                          */
3155 #ifdef SCTP_DEBUG
3156                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3157                                 kprintf("Got parameter type %x - unknown\n",
3158                                        (u_int)ptype);
3159                         }
3160 #endif
3161                         if ((ptype & 0x4000) == 0x4000) {
3162                                 /* Report bit is set?? */
3163 #ifdef SCTP_DEBUG
3164                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3165                                         kprintf("Report bit is set\n");
3166                                 }
3167 #endif
3168                                 if (op_err == NULL) {
3169                                         /* Ok need to try to get an mbuf */
3170                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3171                                         if (op_err) {
3172                                                 op_err->m_len = 0;
3173                                                 op_err->m_pkthdr.len = 0;
3174                                                 op_err->m_data += sizeof(struct ip6_hdr);
3175                                                 op_err->m_data += sizeof(struct sctphdr);
3176                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3177                                         }
3178                                 }
3179                                 if (op_err) {
3180                                         /* If we have space */
3181                                         struct sctp_paramhdr s;
3182                                         if (err_at % 4) {
3183                                                 u_int32_t cpthis=0;
3184                                                 pad_needed = 4 - (err_at % 4);
3185                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3186                                                 err_at += pad_needed;
3187                                         }
3188                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3189                                         s.param_length = htons(sizeof(s) + plen);
3190                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3191                                         err_at += sizeof(s);
3192                                         if (plen > sizeof(tempbuf)) {
3193                                                 plen = sizeof(tempbuf);
3194                                         }
3195                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3196                                         if (phdr == NULL) {
3197                                                 sctp_m_freem(op_err);
3198                                                 /* we are out of memory but we
3199                                                  * still need to have a look at what to
3200                                                  * do (the system is in trouble though).
3201                                                  */
3202                                                 goto more_processing;
3203                                         }
3204                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3205                                         err_at += plen;
3206                                 }
3207                         }
3208                 more_processing:
3209                         if ((ptype & 0x8000) == 0x0000) {
3210 #ifdef SCTP_DEBUG
3211                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3212                                         kprintf("Abort bit is now setting1\n");
3213                                 }
3214 #endif
3215                                 return (op_err);
3216                         } else {
3217                                 /* skip this chunk and continue processing */
3218                                 at += SCTP_SIZE32(plen);
3219                         }
3220
3221                 }
3222                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3223         }
3224         return (op_err);
3225 }
3226
3227 static int
3228 sctp_are_there_new_addresses(struct sctp_association *asoc,
3229     struct mbuf *in_initpkt, int iphlen, int offset)
3230 {
3231         /*
3232          * Given a INIT packet, look through the packet to verify that
3233          * there are NO new addresses. As we go through the parameters
3234          * add reports of any un-understood parameters that require an
3235          * error.  Also we must return (1) to drop the packet if we see
3236          * a un-understood parameter that tells us to drop the chunk.
3237          */
3238         struct sockaddr_in sin4, *sa4;
3239         struct sockaddr_in6 sin6, *sa6;
3240         struct sockaddr *sa_touse;
3241         struct sockaddr *sa;
3242         struct sctp_paramhdr *phdr, params;
3243         struct ip *iph;
3244         struct mbuf *mat;
3245         uint16_t ptype, plen;
3246         int err_at;
3247         uint8_t fnd;
3248         struct sctp_nets *net;
3249
3250         memset(&sin4, 0, sizeof(sin4));
3251         memset(&sin6, 0, sizeof(sin6));
3252         sin4.sin_family = AF_INET;
3253         sin4.sin_len = sizeof(sin4);
3254         sin6.sin6_family = AF_INET6;
3255         sin6.sin6_len = sizeof(sin6);
3256
3257         sa_touse = NULL;
3258         /* First what about the src address of the pkt ? */
3259         iph = mtod(in_initpkt, struct ip *);
3260         if (iph->ip_v == IPVERSION) {
3261                 /* source addr is IPv4 */
3262                 sin4.sin_addr = iph->ip_src;
3263                 sa_touse = (struct sockaddr *)&sin4;
3264         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3265                 /* source addr is IPv6 */
3266                 struct ip6_hdr *ip6h;
3267                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3268                 sin6.sin6_addr = ip6h->ip6_src;
3269                 sa_touse = (struct sockaddr *)&sin6;
3270         } else {
3271                 return (1);
3272         }
3273
3274         fnd = 0;
3275         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3276                 sa = (struct sockaddr *)&net->ro._l_addr;
3277                 if (sa->sa_family == sa_touse->sa_family) {
3278                         if (sa->sa_family == AF_INET) {
3279                             sa4 = (struct sockaddr_in *)sa;
3280                                 if (sa4->sin_addr.s_addr ==
3281                                     sin4.sin_addr.s_addr) {
3282                                         fnd = 1;
3283                                         break;
3284                                 }
3285                         } else if (sa->sa_family == AF_INET6) {
3286                                 sa6 = (struct sockaddr_in6 *)sa;
3287                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3288                                     &sin6.sin6_addr)) {
3289                                         fnd = 1;
3290                                         break;
3291                                 }
3292                         }
3293                 }
3294         }
3295         if (fnd == 0) {
3296                 /* New address added! no need to look futher. */
3297                 return (1);
3298         }
3299         /* Ok so far lets munge through the rest of the packet */
3300         mat = in_initpkt;
3301         err_at = 0;
3302         sa_touse = NULL;
3303         offset += sizeof(struct sctp_init_chunk);
3304         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3305         while (phdr) {
3306                 ptype = ntohs(phdr->param_type);
3307                 plen = ntohs(phdr->param_length);
3308                 if (ptype == SCTP_IPV4_ADDRESS) {
3309                         struct sctp_ipv4addr_param *p4, p4_buf;
3310
3311                         phdr = sctp_get_next_param(mat, offset,
3312                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3313                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3314                             phdr == NULL) {
3315                                 return (1);
3316                         }
3317                         p4 = (struct sctp_ipv4addr_param *)phdr;
3318                         sin4.sin_addr.s_addr = p4->addr;
3319                         sa_touse = (struct sockaddr *)&sin4;
3320                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3321                         struct sctp_ipv6addr_param *p6, p6_buf;
3322
3323                         phdr = sctp_get_next_param(mat, offset,
3324                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3325                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3326                             phdr == NULL) {
3327                                 return (1);
3328                         }
3329                         p6 = (struct sctp_ipv6addr_param *)phdr;
3330                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3331                             sizeof(p6->addr));
3332                         sa_touse = (struct sockaddr *)&sin4;
3333                 }
3334
3335                 if (sa_touse) {
3336                         /* ok, sa_touse points to one to check */
3337                         fnd = 0;
3338                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3339                                 sa = (struct sockaddr *)&net->ro._l_addr;
3340                                 if (sa->sa_family != sa_touse->sa_family) {
3341                                         continue;
3342                                 }
3343                                 if (sa->sa_family == AF_INET) {
3344                                         sa4 = (struct sockaddr_in *)sa;
3345                                         if (sa4->sin_addr.s_addr ==
3346                                             sin4.sin_addr.s_addr) {
3347                                                 fnd = 1;
3348                                                 break;
3349                                         }
3350                                 } else if (sa->sa_family == AF_INET6) {
3351                                         sa6 = (struct sockaddr_in6 *)sa;
3352                                         if (SCTP6_ARE_ADDR_EQUAL(
3353                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3354                                                 fnd = 1;
3355                                                 break;
3356                                         }
3357                                 }
3358                         }
3359                         if (!fnd) {
3360                                 /* New addr added! no need to look further */
3361                                 return (1);
3362                         }
3363                 }
3364                 offset += SCTP_SIZE32(plen);
3365                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3366         }
3367         return (0);
3368 }
3369
3370 /*
3371  * Given a MBUF chain that was sent into us containing an
3372  * INIT. Build a INIT-ACK with COOKIE and send back.
3373  * We assume that the in_initpkt has done a pullup to
3374  * include IPv6/4header, SCTP header and initial part of
3375  * INIT message (i.e. the struct sctp_init_msg).
3376  */
3377 void
3378 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3379     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3380     struct sctp_init_chunk *init_chk)
3381 {
3382         struct sctp_association *asoc;
3383         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3384         struct sctp_init_msg *initackm_out;
3385         struct sctp_ecn_supported_param *ecn;
3386         struct sctp_prsctp_supported_param *prsctp;
3387         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3388         struct sctp_supported_chunk_types_param *pr_supported;
3389         struct sockaddr_storage store;
3390         struct sockaddr_in *sin;
3391         struct sockaddr_in6 *sin6;
3392         struct route *ro;
3393         struct ip *iph;
3394         struct ip6_hdr *ip6;
3395         struct sockaddr *to;
3396         struct sctp_state_cookie stc;
3397         struct sctp_nets *net=NULL;
3398         int cnt_inits_to=0;
3399         uint16_t his_limit, i_want;
3400         int abort_flag, padval, sz_of;
3401
3402         if (stcb) {
3403                 asoc = &stcb->asoc;
3404         } else {
3405                 asoc = NULL;
3406         }
3407         m_last = NULL;
3408         if ((asoc != NULL) &&
3409             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3410             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3411                 /* new addresses, out of here in non-cookie-wait states */
3412                 /*
3413                  * Send a ABORT, we don't add the new address error clause though
3414                  * we even set the T bit and copy in the 0 tag.. this looks no
3415                  * different than if no listner was present.
3416                  */
3417                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3418                 return;
3419         }
3420         abort_flag = 0;
3421         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3422             (offset+sizeof(struct sctp_init_chunk)),
3423             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3424         if (abort_flag) {
3425                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3426                 return;
3427         }
3428         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3429         if (m == NULL) {
3430                 /* No memory, INIT timer will re-attempt. */
3431                 if (op_err)
3432                         sctp_m_freem(op_err);
3433                 return;
3434         }
3435         MCLGET(m, MB_DONTWAIT);
3436         if ((m->m_flags & M_EXT) != M_EXT) {
3437                 /* Failed to get cluster buffer */
3438                 if (op_err)
3439                         sctp_m_freem(op_err);
3440                 sctp_m_freem(m);
3441                 return;
3442         }
3443         m->m_data += SCTP_MIN_OVERHEAD;
3444         m->m_pkthdr.rcvif = 0;
3445         m->m_len = sizeof(struct sctp_init_msg);
3446
3447         /* the time I built cookie */
3448         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3449
3450         /* populate any tie tags */
3451         if (asoc != NULL) {
3452                 /* unlock before tag selections */
3453                 SCTP_TCB_UNLOCK(stcb);
3454                 if (asoc->my_vtag_nonce == 0)
3455                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3456                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3457
3458                 if (asoc->peer_vtag_nonce == 0)
3459                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3460                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3461
3462                 stc.cookie_life = asoc->cookie_life;
3463                 net = asoc->primary_destination;
3464                 /* now we must relock */
3465                 SCTP_INP_RLOCK(inp);
3466                 /* we may be in trouble here if the inp got freed
3467                  * most likely this set of tests will protect
3468                  * us but there is a chance not.
3469                  */
3470                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3471                         if (op_err)
3472                                 sctp_m_freem(op_err);
3473                         sctp_m_freem(m);
3474                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3475                         return;
3476                 }
3477                 SCTP_TCB_LOCK(stcb);
3478                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3479         } else {
3480                 stc.tie_tag_my_vtag = 0;
3481                 stc.tie_tag_peer_vtag = 0;
3482                 /* life I will award this cookie */
3483                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3484         }
3485
3486         /* copy in the ports for later check */
3487         stc.myport = sh->dest_port;
3488         stc.peerport = sh->src_port;
3489
3490         /*
3491          * If we wanted to honor cookie life extentions, we would add