sys/netinet/sctp_output.c

   1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
   2
   3 /*
   4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #if !(defined(__OpenBSD__) || defined (__APPLE__))
  33 #include "opt_ipsec.h"
  34 #endif
  35 #if defined(__FreeBSD__) || defined(__DragonFly__)
  36 #include "opt_compat.h"
  37 #include "opt_inet6.h"
  38 #include "opt_inet.h"
  39 #endif
  40 #if defined(__NetBSD__)
  41 #include "opt_inet.h"
  42 #endif
  43 #ifdef __APPLE__
  44 #include <sctp.h>
  45 #elif !defined(__OpenBSD__)
  46 #include "opt_sctp.h"
  47 #endif
  48 #include <sys/param.h>
  49 #include <sys/systm.h>
  50 #include <sys/malloc.h>
  51 #include <sys/mbuf.h>
  52 #ifndef __OpenBSD__
  53 #include <sys/domain.h>
  54 #endif
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/sysctl.h>
  61 #include <sys/resourcevar.h>
  62 #include <sys/uio.h>
  63 #ifdef INET6
  64 #include <sys/domain.h>
  65 #endif
  66 #include <sys/thread2.h>
  67 #include <sys/socketvar2.h>
  68
  69 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  70 #include <sys/limits.h>
  71 #else
  72 #include <machine/limits.h>
  73 #endif
  74 #include <machine/cpu.h>
  75
  76 #include <net/if.h>
  77 #include <net/if_types.h>
  78
  79 #if defined(__FreeBSD__) || defined(__DragonFly__)
  80 #include <net/if_var.h>
  81 #endif
  82
  83 #include <net/route.h>
  84
  85 #include <netinet/in.h>
  86 #include <netinet/in_systm.h>
  87 #include <netinet/ip.h>
  88 #include <netinet/in_pcb.h>
  89 #include <netinet/in_var.h>
  90 #include <netinet/ip_var.h>
  91
  92 #ifdef INET6
  93 #include <netinet/ip6.h>
  94 #include <netinet6/ip6_var.h>
  95 #include <netinet6/scope6_var.h>
  96 #include <netinet6/nd6.h>
  97
  98 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
  99 #include <netinet6/in6_pcb.h>
 100 #elif defined(__OpenBSD__)
 101 #include <netinet/in_pcb.h>
 102 #endif
 103
 104 #include <netinet/icmp6.h>
 105
 106 #endif /* INET6 */
 107
 108 #include <net/net_osdep.h>
 109
 110 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
 111 #ifndef in6pcb
 112 #define in6pcb          inpcb
 113 #endif
 114 #endif
 115
 116 #include <netinet/sctp_pcb.h>
 117
 118 #ifdef IPSEC
 119 #ifndef __OpenBSD__
 120 #include <netinet6/ipsec.h>
 121 #include <netproto/key/key.h>
 122 #else
 123 #undef IPSEC
 124 #endif
 125 #endif /* IPSEC */
 126
 127 #include <netinet/sctp_var.h>
 128 #include <netinet/sctp_header.h>
 129 #include <netinet/sctputil.h>
 130 #include <netinet/sctp_pcb.h>
 131 #include <netinet/sctp_output.h>
 132 #include <netinet/sctp_uio.h>
 133 #include <netinet/sctputil.h>
 134 #include <netinet/sctp_hashdriver.h>
 135 #include <netinet/sctp_timer.h>
 136 #include <netinet/sctp_asconf.h>
 137 #include <netinet/sctp_indata.h>
 138
 139 #ifdef SCTP_DEBUG
 140 extern uint32_t sctp_debug_on;
 141 #endif
 142
 143 extern int sctp_peer_chunk_oh;
 144
 145 static int
 146 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
 147 {
 148         struct cmsghdr cmh;
 149         int tlen, at;
 150
 151         tlen = control->m_len;
 152         at = 0;
 153         /*
 154          * Independent of how many mbufs, find the c_type inside the control
 155          * structure and copy out the data.
 156          */
 157         while (at < tlen) {
 158                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
 159                         /* not enough room for one more we are done. */
 160                         return (0);
 161                 }
 162                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
 163                 if ((cmh.cmsg_len + at) > tlen) {
 164                         /*
 165                          * this is real messed up since there is not enough
 166                          * data here to cover the cmsg header. We are done.
 167                          */
 168                         return (0);
 169                 }
 170                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
 171                     (c_type == cmh.cmsg_type)) {
 172                         /* found the one we want, copy it out */
 173                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
 174                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
 175                                 /*
 176                                  * space of cmsg_len after header not
 177                                  * big enough
 178                                  */
 179                                 return (0);
 180                         }
 181                         m_copydata(control, at, cpsize, data);
 182                         return (1);
 183                  } else {
 184                         at += CMSG_ALIGN(cmh.cmsg_len);
 185                         if (cmh.cmsg_len == 0) {
 186                                 break;
 187                         }
 188                 }
 189         }
 190         /* not found */
 191         return (0);
 192 }
 193
 194 static struct mbuf *
 195 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
 196 {
 197         struct sctp_paramhdr *parmh;
 198         struct mbuf *mret;
 199         int len;
 200         if (ifa->ifa_addr->sa_family == AF_INET) {
 201                 len = sizeof(struct sctp_ipv4addr_param);
 202         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 203                 len = sizeof(struct sctp_ipv6addr_param);
 204         } else {
 205                 /* unknown type */
 206                 return (m);
 207         }
 208
 209         if (M_TRAILINGSPACE(m) >= len) {
 210                 /* easy side we just drop it on the end */
 211                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
 212                 mret = m;
 213         } else {
 214                 /* Need more space */
 215                 mret = m;
 216                 while (mret->m_next != NULL) {
 217                         mret = mret->m_next;
 218                 }
 219                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
 220                 if (mret->m_next == NULL) {
 221                         /* We are hosed, can't add more addresses */
 222                         return (m);
 223                 }
 224                 mret = mret->m_next;
 225                 parmh = mtod(mret, struct sctp_paramhdr *);
 226         }
 227         /* now add the parameter */
 228         if (ifa->ifa_addr->sa_family == AF_INET) {
 229                 struct sctp_ipv4addr_param *ipv4p;
 230                 struct sockaddr_in *sin;
 231                 sin = (struct sockaddr_in *)ifa->ifa_addr;
 232                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
 233                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
 234                 parmh->param_length = htons(len);
 235                 ipv4p->addr = sin->sin_addr.s_addr;
 236                 mret->m_len += len;
 237         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 238                 struct sctp_ipv6addr_param *ipv6p;
 239                 struct sockaddr_in6 *sin6;
 240                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
 241                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
 242                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
 243                 parmh->param_length = htons(len);
 244                 memcpy(ipv6p->addr, &sin6->sin6_addr,
 245                     sizeof(ipv6p->addr));
 246                 /* clear embedded scope in the address */
 247                 in6_clearscope((struct in6_addr *)ipv6p->addr);
 248                 mret->m_len += len;
 249         } else {
 250                 return (m);
 251         }
 252         return (mret);
 253 }
 254
 255
 256
 257 static struct mbuf *
 258 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
 259     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
 260 {
 261         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
 262         struct sctp_state_cookie *stc;
 263         struct sctp_paramhdr *ph;
 264         uint8_t *signature;
 265         int sig_offset;
 266         uint16_t cookie_sz;
 267
 268         mret = NULL;
 269
 270         MGET(mret, MB_DONTWAIT, MT_DATA);
 271         if (mret == NULL) {
 272                 return (NULL);
 273         }
 274         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
 275         if (copy_init == NULL) {
 276                 sctp_m_freem(mret);
 277                 return (NULL);
 278         }
 279         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
 280             MB_DONTWAIT);
 281         if (copy_initack == NULL) {
 282                 sctp_m_freem(mret);
 283                 sctp_m_freem(copy_init);
 284                 return (NULL);
 285         }
 286         /* easy side we just drop it on the end */
 287         ph = mtod(mret, struct sctp_paramhdr *);
 288         mret->m_len = sizeof(struct sctp_state_cookie) +
 289             sizeof(struct sctp_paramhdr);
 290         stc = (struct sctp_state_cookie *)((caddr_t)ph +
 291             sizeof(struct sctp_paramhdr));
 292         ph->param_type = htons(SCTP_STATE_COOKIE);
 293         ph->param_length = 0;   /* fill in at the end */
 294         /* Fill in the stc cookie data */
 295         *stc = *stc_in;
 296
 297         /* tack the INIT and then the INIT-ACK onto the chain */
 298         cookie_sz = 0;
 299         m_at = mret;
 300         for (m_at = mret; m_at; m_at = m_at->m_next) {
 301                 cookie_sz += m_at->m_len;
 302                 if (m_at->m_next == NULL) {
 303                         m_at->m_next = copy_init;
 304                         break;
 305                 }
 306         }
 307
 308         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
 309                 cookie_sz += m_at->m_len;
 310                 if (m_at->m_next == NULL) {
 311                         m_at->m_next = copy_initack;
 312                         break;
 313                 }
 314         }
 315
 316         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
 317                 cookie_sz += m_at->m_len;
 318                 if (m_at->m_next == NULL) {
 319                         break;
 320                 }
 321         }
 322         MGET(sig, MB_DONTWAIT, MT_DATA);
 323         if (sig == NULL) {
 324                 /* no space */
 325                 sctp_m_freem(mret);
 326                 sctp_m_freem(copy_init);
 327                 sctp_m_freem(copy_initack);
 328                 return (NULL);
 329         }
 330         sig->m_len = 0;
 331         m_at->m_next = sig;
 332         sig_offset = 0;
 333         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
 334         /* Time to sign the cookie */
 335         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
 336             (int)(inp->sctp_ep.current_secret_number)],
 337             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr), signature);
 338         sig->m_len += SCTP_SIGNATURE_SIZE;
 339         cookie_sz += SCTP_SIGNATURE_SIZE;
 340
 341         ph->param_length = htons(cookie_sz);
 342         return (mret);
 343 }
 344
 345
 346 static struct sockaddr_in *
 347 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 348 {
 349         struct sockaddr_in *sin;
 350         /*
 351          * Here we determine if its a prefered address. A
 352          * prefered address means it is the same scope or
 353          * higher scope then the destination.
 354          *  L = loopback, P = private, G = global
 355          * -----------------------------------------
 356          *  src    |      dest     |    result
 357          *-----------------------------------------
 358          *   L     |       L       |    yes
 359          *-----------------------------------------
 360          *   P     |       L       |    yes
 361          *-----------------------------------------
 362          *   G     |       L       |    yes
 363          *-----------------------------------------
 364          *   L     |       P       |    no
 365          *-----------------------------------------
 366          *   P     |       P       |    yes
 367          *-----------------------------------------
 368          *   G     |       P       |    no
 369          *-----------------------------------------
 370          *   L     |       G       |    no
 371          *-----------------------------------------
 372          *   P     |       G       |    no
 373          *-----------------------------------------
 374          *   G     |       G       |    yes
 375          *-----------------------------------------
 376          */
 377
 378         if (ifa->ifa_addr->sa_family != AF_INET) {
 379                 /* forget non-v4 */
 380                 return (NULL);
 381         }
 382         /* Ok the address may be ok */
 383         sin = (struct sockaddr_in *)ifa->ifa_addr;
 384         if (sin->sin_addr.s_addr == 0) {
 385                 return (NULL);
 386         }
 387         *sin_local = *sin_loop = 0;
 388         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 389             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 390                 *sin_loop = 1;
 391                 *sin_local = 1;
 392         }
 393         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 394                 *sin_local = 1;
 395         }
 396         if (!loopscope && *sin_loop) {
 397                 /* Its a loopback address and we don't have loop scope */
 398                 return (NULL);
 399         }
 400         if (!ipv4_scope && *sin_local) {
 401                 /* Its a private address, and we don't have private address scope */
 402                 return (NULL);
 403         }
 404         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
 405                 /* its a global src and a private dest */
 406                 return (NULL);
 407         }
 408         /* its a prefered address */
 409         return (sin);
 410 }
 411
 412 static struct sockaddr_in *
 413 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 414 {
 415         struct sockaddr_in *sin;
 416         /*
 417          * Here we determine if its a acceptable address. A
 418          * acceptable address means it is the same scope or
 419          * higher scope but we can allow for NAT which means
 420          * its ok to have a global dest and a private src.
 421          *
 422          *  L = loopback, P = private, G = global
 423          * -----------------------------------------
 424          *  src    |      dest     |    result
 425          *-----------------------------------------
 426          *   L     |       L       |    yes
 427          *-----------------------------------------
 428          *   P     |       L       |    yes
 429          *-----------------------------------------
 430          *   G     |       L       |    yes
 431          *-----------------------------------------
 432          *   L     |       P       |    no
 433          *-----------------------------------------
 434          *   P     |       P       |    yes
 435          *-----------------------------------------
 436          *   G     |       P       |    yes - probably this won't work.
 437          *-----------------------------------------
 438          *   L     |       G       |    no
 439          *-----------------------------------------
 440          *   P     |       G       |    yes
 441          *-----------------------------------------
 442          *   G     |       G       |    yes
 443          *-----------------------------------------
 444          */
 445
 446         if (ifa->ifa_addr->sa_family != AF_INET) {
 447                 /* forget non-v4 */
 448                 return (NULL);
 449         }
 450         /* Ok the address may be ok */
 451         sin = (struct sockaddr_in *)ifa->ifa_addr;
 452         if (sin->sin_addr.s_addr == 0) {
 453                 return (NULL);
 454         }
 455         *sin_local = *sin_loop = 0;
 456         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 457             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 458                 *sin_loop = 1;
 459                 *sin_local = 1;
 460         }
 461         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 462                 *sin_local = 1;
 463         }
 464         if (!loopscope && *sin_loop) {
 465                 /* Its a loopback address and we don't have loop scope */
 466                 return (NULL);
 467         }
 468         /* its an acceptable address */
 469         return (sin);
 470 }
 471
 472 /*
 473  * This treats the address list on the ep as a restricted list
 474  * (negative list). If a the passed address is listed, then
 475  * the address is NOT allowed on the association.
 476  */
 477 int
 478 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
 479 {
 480         struct sctp_laddr *laddr;
 481 #ifdef SCTP_DEBUG
 482         int cnt=0;
 483 #endif
 484         if (stcb == NULL) {
 485                 /* There are no restrictions, no TCB :-) */
 486                 return (0);
 487         }
 488 #ifdef SCTP_DEBUG
 489         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 490                 cnt++;
 491         }
 492         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 493                 kprintf("There are %d addresses on the restricted list\n", cnt);
 494         }
 495         cnt = 0;
 496 #endif
 497         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 498                 if (laddr->ifa == NULL) {
 499 #ifdef SCTP_DEBUG
 500                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 501                                 kprintf("Help I have fallen and I can't get up!\n");
 502                         }
 503 #endif
 504                         continue;
 505                 }
 506 #ifdef SCTP_DEBUG
 507                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 508                         cnt++;
 509                         kprintf("Restricted address[%d]:", cnt);
 510                         sctp_print_address(laddr->ifa->ifa_addr);
 511                 }
 512 #endif
 513                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
 514                         /* Yes it is on the list */
 515                         return (1);
 516                 }
 517         }
 518         return (0);
 519 }
 520
 521 static int
 522 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 523 {
 524         struct sctp_laddr *laddr;
 525
 526         if (ifa == NULL)
 527                 return (0);
 528         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 529                 if (laddr->ifa == NULL) {
 530 #ifdef SCTP_DEBUG
 531                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 532                                 kprintf("Help I have fallen and I can't get up!\n");
 533                         }
 534 #endif
 535                         continue;
 536                 }
 537                 if (laddr->ifa->ifa_addr == NULL)
 538                         continue;
 539                 if (laddr->ifa == ifa)
 540                         /* same pointer */
 541                         return (1);
 542                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
 543                         /* skip non compatible address comparison */
 544                         continue;
 545                 }
 546                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 547                         /* Yes it is restricted */
 548                         return (1);
 549                 }
 550         }
 551         return (0);
 552 }
 553
 554
 555
 556 static struct in_addr
 557 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
 558                                  struct rtentry *rt,
 559                                  uint8_t ipv4_scope,
 560                                  uint8_t loopscope)
 561 {
 562         struct in_addr ans;
 563         struct sctp_laddr *laddr;
 564         struct sockaddr_in *sin;
 565         struct ifnet *ifn;
 566         uint8_t sin_loop, sin_local;
 567
 568         /* first question, is the ifn we will emit on
 569          * in our list, if so, we want that one.
 570          */
 571         ifn = rt->rt_ifp;
 572         if (ifn) {
 573                 struct ifaddr_container *ifac;
 574
 575                 /* is a prefered one on the interface we route out? */
 576                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 577                         struct ifaddr *ifa = ifac->ifa;
 578
 579                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 580                         if (sin == NULL)
 581                                 continue;
 582                         if (sctp_is_addr_in_ep(inp, ifa)) {
 583                                 return (sin->sin_addr);
 584                         }
 585                 }
 586                 /* is an acceptable one on the interface we route out? */
 587                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 588                         struct ifaddr *ifa = ifac->ifa;
 589
 590                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 591                         if (sin == NULL)
 592                                 continue;
 593                         if (sctp_is_addr_in_ep(inp, ifa)) {
 594                                 return (sin->sin_addr);
 595                         }
 596                 }
 597         }
 598         /* ok, what about a prefered address in the inp */
 599         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 600              laddr && (laddr != inp->next_addr_touse);
 601              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 602                 if (laddr->ifa == NULL) {
 603                         /* address has been removed */
 604                         continue;
 605                 }
 606                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 607                 if (sin == NULL)
 608                         continue;
 609                 return (sin->sin_addr);
 610
 611         }
 612         /* ok, what about an acceptable address in the inp */
 613         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 614              laddr && (laddr != inp->next_addr_touse);
 615              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 616                 if (laddr->ifa == NULL) {
 617                         /* address has been removed */
 618                         continue;
 619                 }
 620                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 621                 if (sin == NULL)
 622                         continue;
 623                 return (sin->sin_addr);
 624
 625         }
 626
 627         /* no address bound can be a source for the destination we are in trouble */
 628 #ifdef SCTP_DEBUG
 629         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 630                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
 631         }
 632 #endif
 633         memset(&ans, 0, sizeof(ans));
 634         return (ans);
 635 }
 636
 637
 638
 639 static struct in_addr
 640 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
 641                                   struct sctp_tcb *stcb,
 642                                   struct sctp_nets *net,
 643                                   struct rtentry *rt,
 644                                   uint8_t ipv4_scope,
 645                                   uint8_t loopscope,
 646                                   int non_asoc_addr_ok)
 647 {
 648         /*
 649          * Here we have two cases, bound all asconf
 650          * allowed. bound all asconf not allowed.
 651          *
 652          */
 653         struct sctp_laddr *laddr, *starting_point;
 654         struct in_addr ans;
 655         struct ifnet *ifn;
 656         uint8_t sin_loop, sin_local, start_at_beginning=0;
 657         struct sockaddr_in *sin;
 658
 659         /* first question, is the ifn we will emit on
 660          * in our list, if so, we want that one.
 661          */
 662         ifn = rt->rt_ifp;
 663
 664         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
 665                 /*
 666                  * Here we use the list of addresses on the endpoint. Then
 667                  * the addresses listed on the "restricted" list is just that,
 668                  * address that have not been added and can't be used (unless
 669                  * the non_asoc_addr_ok is set).
 670                  */
 671 #ifdef SCTP_DEBUG
 672                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 673                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
 674                 }
 675 #endif
 676                 /* first question, is the ifn we will emit on
 677                  * in our list, if so, we want that one.
 678                  */
 679                 if (ifn) {
 680                         struct ifaddr_container *ifac;
 681
 682                         /* first try for an prefered address on the ep */
 683                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 684                                 struct ifaddr *ifa = ifac->ifa;
 685
 686                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 687                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 688                                         if (sin == NULL)
 689                                                 continue;
 690                                         if ((non_asoc_addr_ok == 0) &&
 691                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 692                                                 /* on the no-no list */
 693                                                 continue;
 694                                         }
 695                                         return (sin->sin_addr);
 696                                 }
 697                         }
 698                         /* next try for an acceptable address on the ep */
 699                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 700                                 struct ifaddr *ifa = ifac->ifa;
 701
 702                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 703                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 704                                         if (sin == NULL)
 705                                                 continue;
 706                                         if ((non_asoc_addr_ok == 0) &&
 707                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 708                                                 /* on the no-no list */
 709                                                 continue;
 710                                         }
 711                                         return (sin->sin_addr);
 712                                 }
 713                         }
 714
 715                 }
 716                 /* if we can't find one like that then we must
 717                  * look at all addresses bound to pick one at
 718                  * first prefereable then secondly acceptable.
 719                  */
 720                 starting_point = stcb->asoc.last_used_address;
 721         sctpv4_from_the_top:
 722                 if (stcb->asoc.last_used_address == NULL) {
 723                         start_at_beginning=1;
 724                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 725                 }
 726                 /* search beginning with the last used address */
 727                 for (laddr = stcb->asoc.last_used_address; laddr;
 728                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 729                         if (laddr->ifa == NULL) {
 730                                 /* address has been removed */
 731                                 continue;
 732                         }
 733                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 734                         if (sin == NULL)
 735                                 continue;
 736                         if ((non_asoc_addr_ok == 0) &&
 737                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 738                                 /* on the no-no list */
 739                                 continue;
 740                         }
 741                         return (sin->sin_addr);
 742
 743                 }
 744                 if (start_at_beginning == 0) {
 745                         stcb->asoc.last_used_address = NULL;
 746                         goto sctpv4_from_the_top;
 747                 }
 748                 /* now try for any higher scope than the destination */
 749                 stcb->asoc.last_used_address = starting_point;
 750                 start_at_beginning = 0;
 751         sctpv4_from_the_top2:
 752                 if (stcb->asoc.last_used_address == NULL) {
 753                         start_at_beginning=1;
 754                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 755                 }
 756                 /* search beginning with the last used address */
 757                 for (laddr = stcb->asoc.last_used_address; laddr;
 758                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 759                         if (laddr->ifa == NULL) {
 760                                 /* address has been removed */
 761                                 continue;
 762                         }
 763                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 764                         if (sin == NULL)
 765                                 continue;
 766                         if ((non_asoc_addr_ok == 0) &&
 767                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 768                                 /* on the no-no list */
 769                                 continue;
 770                         }
 771                         return (sin->sin_addr);
 772                 }
 773                 if (start_at_beginning == 0) {
 774                         stcb->asoc.last_used_address = NULL;
 775                         goto sctpv4_from_the_top2;
 776                 }
 777         } else {
 778                 /*
 779                  * Here we have an address list on the association, thats the
 780                  * only valid source addresses that we can use.
 781                  */
 782 #ifdef SCTP_DEBUG
 783                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 784                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
 785                 }
 786 #endif
 787                 /* First look at all addresses for one that is on
 788                  * the interface we route out
 789                  */
 790                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 791                              sctp_nxt_addr) {
 792                         if (laddr->ifa == NULL) {
 793                                 /* address has been removed */
 794                                 continue;
 795                         }
 796                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 797                         if (sin == NULL)
 798                                 continue;
 799                         /* first question, is laddr->ifa an address associated with the emit interface */
 800                         if (ifn) {
 801                                 struct ifaddr_container *ifac;
 802
 803                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 804                                         struct ifaddr *ifa = ifac->ifa;
 805
 806                                         if (laddr->ifa == ifa) {
 807                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 808                                                 return (sin->sin_addr);
 809                                         }
 810                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 811                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 812                                                 return (sin->sin_addr);
 813                                         }
 814                                 }
 815                         }
 816                 }
 817                 /* what about an acceptable one on the interface? */
 818                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 819                              sctp_nxt_addr) {
 820                         if (laddr->ifa == NULL) {
 821                                 /* address has been removed */
 822                                 continue;
 823                         }
 824                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 825                         if (sin == NULL)
 826                                 continue;
 827                         /* first question, is laddr->ifa an address associated with the emit interface */
 828                         if (ifn) {
 829                                 struct ifaddr_container *ifac;
 830
 831                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 832                                         struct ifaddr *ifa = ifac->ifa;
 833
 834                                         if (laddr->ifa == ifa) {
 835                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 836                                                 return (sin->sin_addr);
 837                                         }
 838                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 839                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 840                                                 return (sin->sin_addr);
 841                                         }
 842                                 }
 843                         }
 844                 }
 845                 /* ok, next one that is preferable in general */
 846                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 847                              sctp_nxt_addr) {
 848                         if (laddr->ifa == NULL) {
 849                                 /* address has been removed */
 850                                 continue;
 851                         }
 852                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 853                         if (sin == NULL)
 854                                 continue;
 855                         return (sin->sin_addr);
 856                 }
 857
 858                 /* last, what about one that is acceptable */
 859                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 860                              sctp_nxt_addr) {
 861                         if (laddr->ifa == NULL) {
 862                                 /* address has been removed */
 863                                 continue;
 864                         }
 865                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 866                         if (sin == NULL)
 867                                 continue;
 868                         return (sin->sin_addr);
 869                 }
 870         }
 871         memset(&ans, 0, sizeof(ans));
 872         return (ans);
 873 }
 874
 875 static struct sockaddr_in *
 876 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 877                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
 878 {
 879         struct ifaddr_container *ifac;
 880         struct sockaddr_in *sin;
 881         uint8_t sin_loop, sin_local;
 882         int num_eligible_addr = 0;
 883
 884         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 885                 struct ifaddr *ifa = ifac->ifa;
 886
 887                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 888                 if (sin == NULL)
 889                         continue;
 890                 if (stcb) {
 891                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 892                                 /* It is restricted for some reason.. probably
 893                                  * not yet added.
 894                                  */
 895                                 continue;
 896                         }
 897                 }
 898                 if (cur_addr_num == num_eligible_addr) {
 899                         return (sin);
 900                 }
 901         }
 902         return (NULL);
 903 }
 904
 905
 906 static int
 907 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 908                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 909 {
 910         struct ifaddr_container *ifac;
 911         struct sockaddr_in *sin;
 912         int num_eligible_addr = 0;
 913
 914         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 915                 struct ifaddr *ifa = ifac->ifa;
 916
 917                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
 918                 if (sin == NULL)
 919                         continue;
 920                 if (stcb) {
 921                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 922                                 /* It is restricted for some reason.. probably
 923                                  * not yet added.
 924                                  */
 925                                 continue;
 926                         }
 927                 }
 928                 num_eligible_addr++;
 929         }
 930         return (num_eligible_addr);
 931
 932 }
 933
 934 static struct in_addr
 935 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
 936                         struct sctp_tcb *stcb,
 937                         struct sctp_nets *net,
 938                         struct rtentry *rt,
 939                         uint8_t ipv4_scope,
 940                         uint8_t loopscope,
 941                         int non_asoc_addr_ok)
 942 {
 943         int cur_addr_num=0, num_prefered=0;
 944         uint8_t sin_loop, sin_local;
 945         struct ifnet *ifn;
 946         struct sockaddr_in *sin;
 947         struct in_addr ans;
 948         struct ifaddr_container *ifac;
 949         /*
 950          * For v4 we can use (in boundall) any address in the association. If
 951          * non_asoc_addr_ok is set we can use any address (at least in theory).
 952          * So we look for prefered addresses first. If we find one, we use it.
 953          * Otherwise we next try to get an address on the interface, which we
 954          * should be able to do (unless non_asoc_addr_ok is false and we are
 955          * routed out that way). In these cases where we can't use the address
 956          * of the interface we go through all the ifn's looking for an address
 957          * we can use and fill that in. Punting means we send back address
 958          * 0, which will probably cause problems actually since then IP will
 959          * fill in the address of the route ifn, which means we probably already
 960          * rejected it.. i.e. here comes an abort :-<.
 961          */
 962         ifn = rt->rt_ifp;
 963         if (net) {
 964                 cur_addr_num = net->indx_of_eligible_next_to_use;
 965         }
 966         if (ifn == NULL) {
 967                 goto bound_all_v4_plan_c;
 968         }
 969         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
 970 #ifdef SCTP_DEBUG
 971         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 972                 kprintf("Found %d preferred source addresses\n", num_prefered);
 973         }
 974 #endif
 975         if (num_prefered == 0) {
 976                 /* no eligible addresses, we must use some other
 977                  * interface address if we can find one.
 978                  */
 979                 goto bound_all_v4_plan_b;
 980         }
 981         /* Ok we have num_eligible_addr set with how many we can use,
 982          * this may vary from call to call due to addresses being deprecated etc..
 983          */
 984         if (cur_addr_num >= num_prefered) {
 985                 cur_addr_num = 0;
 986         }
 987         /* select the nth address from the list (where cur_addr_num is the nth) and
 988          * 0 is the first one, 1 is the second one etc...
 989          */
 990 #ifdef SCTP_DEBUG
 991         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 992                 kprintf("cur_addr_num:%d\n", cur_addr_num);
 993         }
 994 #endif
 995         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
 996                                                                    ipv4_scope, cur_addr_num);
 997
 998         /* if sin is NULL something changed??, plan_a now */
 999         if (sin) {
1000                 return (sin->sin_addr);
1001         }
1002
1003         /*
1004          * plan_b: Look at the interface that we emit on
1005          *         and see if we can find an acceptable address.
1006          */
1007  bound_all_v4_plan_b:
1008         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1009                 struct ifaddr *ifa = ifac->ifa;
1010
1011                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1012                 if (sin == NULL)
1013                         continue;
1014                 if (stcb) {
1015                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1016                                 /* It is restricted for some reason.. probably
1017                                  * not yet added.
1018                                  */
1019                                 continue;
1020                         }
1021                 }
1022                 return (sin->sin_addr);
1023         }
1024         /*
1025          * plan_c: Look at all interfaces and find a prefered
1026          *         address. If we reache here we are in trouble I think.
1027          */
1028  bound_all_v4_plan_c:
1029         for (ifn = TAILQ_FIRST(&ifnet);
1030              ifn && (ifn != inp->next_ifn_touse);
1031              ifn=TAILQ_NEXT(ifn, if_list)) {
1032                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1033                         /* wrong base scope */
1034                         continue;
1035                 }
1036                 if (ifn == rt->rt_ifp)
1037                         /* already looked at this guy */
1038                         continue;
1039                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1040                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1041 #ifdef SCTP_DEBUG
1042                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1043                         kprintf("Found ifn:%p %d preferred source addresses\n", ifn, num_prefered);
1044                 }
1045 #endif
1046                 if (num_prefered == 0) {
1047                         /*
1048                          * None on this interface.
1049                          */
1050                         continue;
1051                 }
1052                 /* Ok we have num_eligible_addr set with how many we can use,
1053                  * this may vary from call to call due to addresses being deprecated etc..
1054                  */
1055                 if (cur_addr_num >= num_prefered) {
1056                         cur_addr_num = 0;
1057                 }
1058                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1059                                                                           ipv4_scope, cur_addr_num);
1060                 if (sin == NULL)
1061                         continue;
1062                 return (sin->sin_addr);
1063
1064         }
1065
1066         /*
1067          * plan_d: We are in deep trouble. No prefered address on
1068          *         any interface. And the emit interface does not
1069          *         even have an acceptable address. Take anything
1070          *         we can get! If this does not work we are
1071          *         probably going to emit a packet that will
1072          *         illicit an ABORT, falling through.
1073          */
1074
1075         for (ifn = TAILQ_FIRST(&ifnet);
1076              ifn && (ifn != inp->next_ifn_touse);
1077              ifn=TAILQ_NEXT(ifn, if_list)) {
1078                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1079                         /* wrong base scope */
1080                         continue;
1081                 }
1082                 if (ifn == rt->rt_ifp)
1083                         /* already looked at this guy */
1084                         continue;
1085
1086                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1087                         struct ifaddr *ifa = ifac->ifa;
1088
1089                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1090                         if (sin == NULL)
1091                                 continue;
1092                         if (stcb) {
1093                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1094                                         /* It is restricted for some reason.. probably
1095                                          * not yet added.
1096                                          */
1097                                         continue;
1098                                 }
1099                         }
1100                         return (sin->sin_addr);
1101                 }
1102         }
1103         /*
1104          * Ok we can find NO address to source from that is
1105          * not on our negative list. It is either the special
1106          * ASCONF case where we are sourceing from a intf that
1107          * has been ifconfig'd to a different address (i.e.
1108          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1109          * address. OR we are hosed, and this baby is going
1110          * to abort the association.
1111          */
1112         if (non_asoc_addr_ok) {
1113                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1114         } else {
1115                 memset(&ans, 0, sizeof(ans));
1116                 return (ans);
1117         }
1118 }
1119
1120
1121
1122 /* tcb may be NULL */
1123 struct in_addr
1124 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1125     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1126     int non_asoc_addr_ok)
1127 {
1128         struct in_addr ans;
1129         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1130         uint8_t ipv4_scope, loopscope;
1131         /*
1132          * Rules:
1133          * - Find the route if needed, cache if I can.
1134          * - Look at interface address in route, Is it
1135          *   in the bound list. If so we have the best source.
1136          * - If not we must rotate amongst the addresses.
1137          *
1138          * Cavets and issues
1139          *
1140          * Do we need to pay attention to scope. We can have
1141          * a private address or a global address we are sourcing
1142          * or sending to. So if we draw it out
1143          *      source     *      dest   *  result
1144          *  ------------------------------------------
1145          *  a   Private    *     Global  *  NAT?
1146          *  ------------------------------------------
1147          *  b   Private    *     Private *  No problem
1148          *  ------------------------------------------
1149          *  c   Global     *     Private *  Huh, How will this work?
1150          *  ------------------------------------------
1151          *  d   Global     *     Global  *  No Problem
1152          *  ------------------------------------------
1153          *
1154          * And then we add to that what happens if there are multiple
1155          * addresses assigned to an interface. Remember the ifa on a
1156          * ifn is a linked list of addresses. So one interface can
1157          * have more than one IPv4 address. What happens if we
1158          * have both a private and a global address? Do we then
1159          * use context of destination to sort out which one is
1160          * best? And what about NAT's sending P->G may get you
1161          * a NAT translation, or should you select the G thats
1162          * on the interface in preference.
1163          *
1164          * Decisions:
1165          *
1166          *  - count the number of addresses on the interface.
1167          *  - if its one, no problem except case <c>. For <a>
1168          *    we will assume a NAT out there.
1169          *  - if there are more than one, then we need to worry
1170          *    about scope P or G. We should prefer G -> G and
1171          *    P -> P if possible. Then as a secondary fall back
1172          *    to mixed types G->P being a last ditch one.
1173          *  - The above all works for bound all, but bound
1174          *    specific we need to use the same concept but instead
1175          *    only consider the bound addresses. If the bound set
1176          *    is NOT assigned to the interface then we must use
1177          *    rotation amongst them.
1178          *
1179          * Notes: For v4, we can always punt and let ip_output
1180          * decide by sending back a source of 0.0.0.0
1181          */
1182
1183         if (ro->ro_rt == NULL) {
1184                 /*
1185                  * Need a route to cache.
1186                  *
1187                  */
1188 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1189                 rtalloc_ign(ro, 0UL);
1190 #else
1191                 rtalloc(ro);
1192 #endif
1193         }
1194         if (ro->ro_rt == NULL) {
1195                 /* No route to host .. punt */
1196                 memset(&ans, 0, sizeof(ans));
1197                 return (ans);
1198         }
1199         /* Setup our scopes */
1200         if (stcb) {
1201                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1202                 loopscope = stcb->asoc.loopback_scope;
1203         } else {
1204                 /* Scope based on outbound address */
1205                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1206                         ipv4_scope = 1;
1207                         loopscope = 0;
1208                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1209                         ipv4_scope = 1;
1210                         loopscope = 1;
1211                 } else {
1212                         ipv4_scope = 0;
1213                         loopscope = 0;
1214                 }
1215         }
1216 #ifdef SCTP_DEBUG
1217         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1218                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1219                        loopscope, ipv4_scope);
1220         }
1221 #endif
1222         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1223                 /*
1224                  * When bound to all if the address list is set
1225                  * it is a negative list. Addresses being added
1226                  * by asconf.
1227                  */
1228                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1229                     ipv4_scope, loopscope, non_asoc_addr_ok));
1230         }
1231         /*
1232          * Three possiblities here:
1233          *
1234          * a) stcb is NULL, which means we operate only from
1235          *    the list of addresses (ifa's) bound to the assoc and
1236          *    we care not about the list.
1237          * b) stcb is NOT-NULL, which means we have an assoc structure and
1238          *    auto-asconf is on. This means that the list of addresses is
1239          *    a NOT list. We use the list from the inp, but any listed address
1240          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1241          *    set we CAN use an address NOT available (i.e. being added). Its
1242          *    a negative list.
1243          * c) stcb is NOT-NULL, which means we have an assoc structure and
1244          *    auto-asconf is off. This means that the list of addresses is
1245          *    the ONLY addresses I can use.. its positive.
1246          *
1247          *    Note we collapse b & c into the same function just like in
1248          *    the v6 address selection.
1249          */
1250         if (stcb) {
1251                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1252                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1253         } else {
1254                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1255                     ipv4_scope, loopscope));
1256         }
1257         /* this should not be reached */
1258         memset(&ans, 0, sizeof(ans));
1259         return (ans);
1260 }
1261
1262
1263
1264 static struct sockaddr_in6 *
1265 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1266 {
1267         struct in6_ifaddr *ifa6;
1268         struct sockaddr_in6 *sin6;
1269
1270         if (ifa->ifa_addr->sa_family != AF_INET6) {
1271                 /* forget non-v6 */
1272                 return (NULL);
1273         }
1274         ifa6 = (struct in6_ifaddr *)ifa;
1275         /* ok to use deprecated addresses? */
1276         if (!ip6_use_deprecated) {
1277                 if (IFA6_IS_DEPRECATED(ifa6)) {
1278                         /* can't use this type */
1279                         return (NULL);
1280                 }
1281         }
1282         /* are we ok, with the current state of this address? */
1283         if (ifa6->ia6_flags &
1284             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1285                 /* Can't use these types */
1286                 return (NULL);
1287         }
1288         /* Ok the address may be ok */
1289         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1290         *sin_local = *sin_loop = 0;
1291         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1292             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1293                 *sin_loop = 1;
1294         }
1295         if (!loopscope && *sin_loop) {
1296                 /* Its a loopback address and we don't have loop scope */
1297                 return (NULL);
1298         }
1299         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1300                 /* we skip unspecifed addresses */
1301                 return (NULL);
1302         }
1303
1304         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1305                 *sin_local = 1;
1306         }
1307         if (!loc_scope && *sin_local) {
1308                 /* Its a link local address, and we don't have link local scope */
1309                 return (NULL);
1310         }
1311         return (sin6);
1312 }
1313
1314
1315 static struct sockaddr_in6 *
1316 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1317                                   struct sctp_tcb *stcb,
1318                                   struct sctp_nets *net,
1319                                   struct rtentry *rt,
1320                                   uint8_t loc_scope,
1321                                   uint8_t loopscope,
1322                                   int non_asoc_addr_ok)
1323 {
1324         /*
1325          *   Each endpoint has a list of local addresses associated
1326          *   with it. The address list is either a "negative list" i.e.
1327          *   those addresses that are NOT allowed to be used as a source OR
1328          *   a "postive list" i.e. those addresses that CAN be used.
1329          *
1330          *   Its a negative list if asconf is allowed. What we do
1331          *   in this case is use the ep address list BUT we have
1332          *   to cross check it against the negative list.
1333          *
1334          *   In the case where NO asconf is allowed, we have just
1335          *   a straight association level list that we must use to
1336          *   find a source address.
1337          */
1338         struct sctp_laddr *laddr, *starting_point;
1339         struct sockaddr_in6 *sin6;
1340         int sin_loop, sin_local;
1341         int start_at_beginning=0;
1342         struct ifnet *ifn;
1343
1344         ifn = rt->rt_ifp;
1345         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1346 #ifdef SCTP_DEBUG
1347                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1348                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1349                 }
1350 #endif
1351                 /* first question, is the ifn we will emit on
1352                  * in our list, if so, we want that one.
1353                  */
1354                 if (ifn) {
1355                         struct ifaddr_container *ifac;
1356
1357                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1358                                 struct ifaddr *ifa = ifac->ifa;
1359
1360                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1361                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1362                                         if (sin6 == NULL)
1363                                                 continue;
1364                                         if ((non_asoc_addr_ok == 0) &&
1365                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1366                                                 /* on the no-no list */
1367                                                 continue;
1368                                         }
1369                                         return (sin6);
1370                                 }
1371                         }
1372                 }
1373                 starting_point = stcb->asoc.last_used_address;
1374                 /* First try for matching scope */
1375         sctp_from_the_top:
1376                 if (stcb->asoc.last_used_address == NULL) {
1377                         start_at_beginning=1;
1378                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1379                 }
1380                 /* search beginning with the last used address */
1381                 for (laddr = stcb->asoc.last_used_address; laddr;
1382                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1383                         if (laddr->ifa == NULL) {
1384                                 /* address has been removed */
1385                                 continue;
1386                         }
1387                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1388                         if (sin6 == NULL)
1389                                 continue;
1390                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1391                                 /* on the no-no list */
1392                                 continue;
1393                         }
1394                         /* is it of matching scope ? */
1395                         if ((loopscope == 0) &&
1396                             (loc_scope == 0) &&
1397                             (sin_loop == 0) &&
1398                             (sin_local == 0)) {
1399                                 /* all of global scope we are ok with it */
1400                                 return (sin6);
1401                         }
1402                         if (loopscope && sin_loop)
1403                                 /* both on the loopback, thats ok */
1404                                 return (sin6);
1405                         if (loc_scope && sin_local)
1406                                 /* both local scope */
1407                                 return (sin6);
1408
1409                 }
1410                 if (start_at_beginning == 0) {
1411                         stcb->asoc.last_used_address = NULL;
1412                         goto sctp_from_the_top;
1413                 }
1414                 /* now try for any higher scope than the destination */
1415                 stcb->asoc.last_used_address = starting_point;
1416                 start_at_beginning = 0;
1417         sctp_from_the_top2:
1418                 if (stcb->asoc.last_used_address == NULL) {
1419                         start_at_beginning=1;
1420                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1421                 }
1422                 /* search beginning with the last used address */
1423                 for (laddr = stcb->asoc.last_used_address; laddr;
1424                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1425                         if (laddr->ifa == NULL) {
1426                                 /* address has been removed */
1427                                 continue;
1428                         }
1429                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1430                         if (sin6 == NULL)
1431                                 continue;
1432                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1433                                 /* on the no-no list */
1434                                 continue;
1435                         }
1436                         return (sin6);
1437                 }
1438                 if (start_at_beginning == 0) {
1439                         stcb->asoc.last_used_address = NULL;
1440                         goto sctp_from_the_top2;
1441                 }
1442         } else {
1443 #ifdef SCTP_DEBUG
1444                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1445                         kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
1446                 }
1447 #endif
1448                 /* First try for interface output match */
1449                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1450                              sctp_nxt_addr) {
1451                         if (laddr->ifa == NULL) {
1452                                 /* address has been removed */
1453                                 continue;
1454                         }
1455                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1456                         if (sin6 == NULL)
1457                                 continue;
1458                         /* first question, is laddr->ifa an address associated with the emit interface */
1459                         if (ifn) {
1460                                 struct ifaddr_container *ifac;
1461
1462                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1463                                         struct ifaddr *ifa = ifac->ifa;
1464
1465                                         if (laddr->ifa == ifa) {
1466                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1467                                                 return (sin6);
1468                                         }
1469                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1470                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1471                                                 return (sin6);
1472                                         }
1473                                 }
1474                         }
1475                 }
1476                 /* Next try for matching scope */
1477                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1478                              sctp_nxt_addr) {
1479                         if (laddr->ifa == NULL) {
1480                                 /* address has been removed */
1481                                 continue;
1482                         }
1483                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1484                         if (sin6 == NULL)
1485                                 continue;
1486
1487                         if ((loopscope == 0) &&
1488                             (loc_scope == 0) &&
1489                             (sin_loop == 0) &&
1490                             (sin_local == 0)) {
1491                                 /* all of global scope we are ok with it */
1492                                 return (sin6);
1493                         }
1494                         if (loopscope && sin_loop)
1495                                 /* both on the loopback, thats ok */
1496                                 return (sin6);
1497                         if (loc_scope && sin_local)
1498                                 /* both local scope */
1499                                 return (sin6);
1500                 }
1501                 /* ok, now try for a higher scope in the source address */
1502                 /* First try for matching scope */
1503                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1504                              sctp_nxt_addr) {
1505                         if (laddr->ifa == NULL) {
1506                                 /* address has been removed */
1507                                 continue;
1508                         }
1509                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1510                         if (sin6 == NULL)
1511                                 continue;
1512                         return (sin6);
1513                 }
1514         }
1515         return (NULL);
1516 }
1517
1518 static struct sockaddr_in6 *
1519 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1520                                  struct rtentry *rt,
1521                                  uint8_t loc_scope,
1522                                  uint8_t loopscope)
1523 {
1524         /*
1525          * Here we are bound specific and have only
1526          * an inp. We must find an address that is bound
1527          * that we can give out as a src address. We
1528          * prefer two addresses of same scope if we can
1529          * find them that way.
1530          */
1531         struct sctp_laddr *laddr;
1532         struct sockaddr_in6 *sin6;
1533         struct ifnet *ifn;
1534         int sin_loop, sin_local;
1535
1536         /* first question, is the ifn we will emit on
1537          * in our list, if so, we want that one.
1538          */
1539
1540         ifn = rt->rt_ifp;
1541         if (ifn) {
1542                 struct ifaddr_container *ifac;
1543
1544                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1545                         struct ifaddr *ifa = ifac->ifa;
1546
1547                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1548                         if (sin6 == NULL)
1549                                 continue;
1550                         if (sctp_is_addr_in_ep(inp, ifa)) {
1551                                 return (sin6);
1552                         }
1553                 }
1554         }
1555         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1556              laddr && (laddr != inp->next_addr_touse);
1557              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1558                 if (laddr->ifa == NULL) {
1559                         /* address has been removed */
1560                         continue;
1561                 }
1562                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1563                 if (sin6 == NULL)
1564                         continue;
1565
1566                 if ((loopscope == 0) &&
1567                     (loc_scope == 0) &&
1568                     (sin_loop == 0) &&
1569                     (sin_local == 0)) {
1570                         /* all of global scope we are ok with it */
1571                         return (sin6);
1572                 }
1573                 if (loopscope && sin_loop)
1574                         /* both on the loopback, thats ok */
1575                         return (sin6);
1576                 if (loc_scope && sin_local)
1577                         /* both local scope */
1578                         return (sin6);
1579
1580         }
1581         /* if we reach here, we could not find two addresses
1582          * of the same scope to give out. Lets look for any higher level
1583          * scope for a source address.
1584          */
1585         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1586              laddr && (laddr != inp->next_addr_touse);
1587              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1588                 if (laddr->ifa == NULL) {
1589                         /* address has been removed */
1590                         continue;
1591                 }
1592                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1593                 if (sin6 == NULL)
1594                         continue;
1595                 return (sin6);
1596         }
1597         /* no address bound can be a source for the destination */
1598 #ifdef SCTP_DEBUG
1599         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1600                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1601         }
1602 #endif
1603         return (NULL);
1604 }
1605
1606
1607 static struct sockaddr_in6 *
1608 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1609                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1610 {
1611         struct ifaddr_container *ifac;
1612         struct sockaddr_in6 *sin6;
1613         int sin_loop, sin_local;
1614         int num_eligible_addr = 0;
1615
1616         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1617                 struct ifaddr *ifa = ifac->ifa;
1618
1619                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1620                 if (sin6 == NULL)
1621                         continue;
1622                 if (stcb) {
1623                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1624                                 /* It is restricted for some reason.. probably
1625                                  * not yet added.
1626                                  */
1627                                 continue;
1628                         }
1629                 }
1630                 if (match_scope) {
1631                         /* Here we are asked to match scope if possible */
1632                         if (loopscope && sin_loop)
1633                                 /* src and destination are loopback scope */
1634                                 return (sin6);
1635                         if (loc_scope && sin_local)
1636                                 /* src and destination are local scope */
1637                                 return (sin6);
1638                         if ((loopscope == 0) &&
1639                             (loc_scope == 0)  &&
1640                             (sin_loop == 0) &&
1641                             (sin_local == 0)) {
1642                                 /* src and destination are global scope */
1643                                 return (sin6);
1644                         }
1645                         continue;
1646                 }
1647                 if (num_eligible_addr == cur_addr_num) {
1648                         /* this is it */
1649                         return (sin6);
1650                 }
1651                 num_eligible_addr++;
1652         }
1653         return (NULL);
1654 }
1655
1656
1657 static int
1658 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1659                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1660 {
1661         struct ifaddr_container *ifac;
1662         struct sockaddr_in6 *sin6;
1663         int num_eligible_addr = 0;
1664         int sin_loop, sin_local;
1665
1666         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1667                 struct ifaddr *ifa = ifac->ifa;
1668
1669                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1670                 if (sin6 == NULL)
1671                         continue;
1672                 if (stcb) {
1673                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1674                                 /* It is restricted for some reason.. probably
1675                                  * not yet added.
1676                                  */
1677                                 continue;
1678                         }
1679                 }
1680                 num_eligible_addr++;
1681         }
1682         return (num_eligible_addr);
1683 }
1684
1685
1686 static struct sockaddr_in6 *
1687 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1688                         struct sctp_tcb *stcb,
1689                         struct sctp_nets *net,
1690                         struct rtentry *rt,
1691                         uint8_t loc_scope,
1692                         uint8_t loopscope,
1693                         int non_asoc_addr_ok)
1694 {
1695         /* Ok, we are bound all SO any address
1696          * is ok to use as long as it is NOT in the negative
1697          * list.
1698          */
1699         int num_eligible_addr;
1700         int cur_addr_num=0;
1701         int started_at_beginning=0;
1702         int match_scope_prefered;
1703         /* first question is, how many eligible addresses are
1704          * there for the destination ifn that we are using that
1705          * are within the proper scope?
1706          */
1707         struct ifnet *ifn;
1708         struct sockaddr_in6 *sin6;
1709
1710         ifn = rt->rt_ifp;
1711         if (net) {
1712                 cur_addr_num = net->indx_of_eligible_next_to_use;
1713         }
1714         if (cur_addr_num == 0) {
1715                 match_scope_prefered = 1;
1716         } else {
1717                 match_scope_prefered = 0;
1718         }
1719         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1720 #ifdef SCTP_DEBUG
1721         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1722                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1723         }
1724 #endif
1725         if (num_eligible_addr == 0) {
1726                 /* no eligible addresses, we must use some other
1727                  * interface address if we can find one.
1728                  */
1729                 goto bound_all_v6_plan_b;
1730         }
1731         /* Ok we have num_eligible_addr set with how many we can use,
1732          * this may vary from call to call due to addresses being deprecated etc..
1733          */
1734         if (cur_addr_num >= num_eligible_addr) {
1735                 cur_addr_num = 0;
1736         }
1737         /* select the nth address from the list (where cur_addr_num is the nth) and
1738          * 0 is the first one, 1 is the second one etc...
1739          */
1740 #ifdef SCTP_DEBUG
1741         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1742                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1743                        cur_addr_num, match_scope_prefered);
1744         }
1745 #endif
1746         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1747                                                           loc_scope, cur_addr_num, match_scope_prefered);
1748         if (match_scope_prefered && (sin6 == NULL)) {
1749                 /* retry without the preference for matching scope */
1750 #ifdef SCTP_DEBUG
1751         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1752                 kprintf("retry with no match_scope_prefered\n");
1753         }
1754 #endif
1755                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1756                                                                   loc_scope, cur_addr_num, 0);
1757         }
1758         if (sin6) {
1759 #ifdef SCTP_DEBUG
1760                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1761                         kprintf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1762                 }
1763 #endif
1764                 if (net) {
1765                         /* store so we get the next one */
1766                         if (cur_addr_num < 255)
1767                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1768                         else
1769                                 net->indx_of_eligible_next_to_use = 0;
1770                 }
1771                 return (sin6);
1772         }
1773         num_eligible_addr = 0;
1774  bound_all_v6_plan_b:
1775         /* ok, if we reach here we either fell through
1776          * due to something changing during an interupt (unlikely)
1777          * or we have NO eligible source addresses for the ifn
1778          * of the route (most likely). We must look at all the other
1779          * interfaces EXCEPT rt->rt_ifp and do the same game.
1780          */
1781 #ifdef SCTP_DEBUG
1782         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1783                 kprintf("bound-all Plan B\n");
1784         }
1785 #endif
1786         if (inp->next_ifn_touse == NULL) {
1787                 started_at_beginning=1;
1788                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1789 #ifdef SCTP_DEBUG
1790                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1791                         kprintf("Start at first IFN:%p\n", inp->next_ifn_touse);
1792                 }
1793 #endif
1794         } else {
1795                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1796 #ifdef SCTP_DEBUG
1797                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1798                         kprintf("Resume at IFN:%p\n", inp->next_ifn_touse);
1799                 }
1800 #endif
1801                 if (inp->next_ifn_touse == NULL) {
1802 #ifdef SCTP_DEBUG
1803                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1804                                 kprintf("IFN Resets\n");
1805                         }
1806 #endif
1807                         started_at_beginning=1;
1808                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1809                 }
1810         }
1811         for (ifn = inp->next_ifn_touse; ifn;
1812              ifn = TAILQ_NEXT(ifn, if_list)) {
1813                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1814                         /* wrong base scope */
1815                         continue;
1816                 }
1817                 if (loc_scope && (ifn->if_index != loc_scope)) {
1818                         /* by definition the scope (from to->sin6_scopeid)
1819                          * must match that of the interface. If not then
1820                          * we could pick a wrong scope for the address.
1821                          * Ususally we don't hit plan-b since the route
1822                          * handles this. However we can hit plan-b when
1823                          * we send to local-host so the route is the
1824                          * loopback interface, but the destination is a
1825                          * link local.
1826                          */
1827                         continue;
1828                 }
1829                 if (ifn == rt->rt_ifp) {
1830                         /* already looked at this guy */
1831                         continue;
1832                 }
1833                 /* Address rotation will only work when we are not
1834                  * rotating sourced interfaces and are using the interface
1835                  * of the route. We would need to have a per interface index
1836                  * in order to do proper rotation.
1837                  */
1838                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1839 #ifdef SCTP_DEBUG
1840                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1841                         kprintf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1842                 }
1843 #endif
1844                 if (num_eligible_addr == 0) {
1845                         /* none we can use */
1846                         continue;
1847                 }
1848                 /* Ok we have num_eligible_addr set with how many we can use,
1849                  * this may vary from call to call due to addresses being deprecated etc..
1850                  */
1851                 inp->next_ifn_touse = ifn;
1852
1853                 /* select the first one we can find with perference for matching scope.
1854                  */
1855                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1856                 if (sin6 == NULL) {
1857                         /* can't find one with matching scope how about a source with higher
1858                          * scope
1859                          */
1860                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1861                         if (sin6 == NULL)
1862                                 /* Hmm, can't find one in the interface now */
1863                                 continue;
1864                 }
1865 #ifdef SCTP_DEBUG
1866                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1867                         kprintf("Selected the %d'th address of ifn:%p\n",
1868                                cur_addr_num,
1869                                ifn);
1870                 }
1871 #endif
1872                 return (sin6);
1873         }
1874         if (started_at_beginning == 0) {
1875                 /* we have not been through all of them yet, force
1876                  * us to go through them all.
1877                  */
1878 #ifdef SCTP_DEBUG
1879                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1880                         kprintf("Force a recycle\n");
1881                 }
1882 #endif
1883                 inp->next_ifn_touse = NULL;
1884                 goto bound_all_v6_plan_b;
1885         }
1886         return (NULL);
1887
1888 }
1889
1890 /* stcb and net may be NULL */
1891 struct in6_addr
1892 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1893     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1894     int non_asoc_addr_ok)
1895 {
1896         struct in6_addr ans;
1897         struct sockaddr_in6 *rt_addr;
1898         uint8_t loc_scope, loopscope;
1899         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1900
1901         /*
1902          * This routine is tricky standard v6 src address
1903          * selection cannot take into account what we have
1904          * bound etc, so we can't use it.
1905          *
1906          * Instead here is what we must do:
1907          * 1) Make sure we have a route, if we
1908          *    don't have a route we can never reach the peer.
1909          * 2) Once we have a route, determine the scope of the
1910          *     route. Link local, loopback or global.
1911          * 3) Next we divide into three types. Either we
1912          *    are bound all.. which means we want to use
1913          *    one of the addresses of the interface we are
1914          *    going out. <or>
1915          * 4a) We have not stcb, which means we are using the
1916          *    specific addresses bound on an inp, in this
1917          *    case we are similar to the stcb case (4b below)
1918          *    accept the list is always a positive list.<or>
1919          * 4b) We are bound specific with a stcb, which means we have a
1920          *    list of bound addresses and we must see if the
1921          *    ifn of the route is actually one of the bound addresses.
1922          *    If not, then we must rotate addresses amongst properly
1923          *    scoped bound addresses, if so we use the address
1924          *    of the interface.
1925          * 5) Always, no matter which path we take through the above
1926          *    we must be sure the source address we use is allowed to
1927          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1928          *    addresses cannot be used.
1929          * 6) Addresses that are deprecated MAY be used
1930          *              if (!ip6_use_deprecated) {
1931          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1932          *                        skip the address
1933          *                    }
1934          *              }
1935          */
1936
1937         /*** 1> determine route, if not already done */
1938         if (ro->ro_rt == NULL) {
1939                 /*
1940                  * Need a route to cache.
1941                  */
1942 #ifndef SCOPEDROUTING
1943                 int scope_save;
1944                 scope_save = to->sin6_scope_id;
1945                 to->sin6_scope_id = 0;
1946 #endif
1947
1948 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1949                 rtalloc_ign(ro, 0UL);
1950 #else
1951                 rtalloc(ro);
1952 #endif
1953 #ifndef SCOPEDROUTING
1954                 to->sin6_scope_id = scope_save;
1955 #endif
1956         }
1957         if (ro->ro_rt == NULL) {
1958                 /*
1959                  * no route to host. this packet is going no-where.
1960                  * We probably should make sure we arrange to send back
1961                  * an error.
1962                  */
1963 #ifdef SCTP_DEBUG
1964                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1965                         kprintf("No route to host, this packet cannot be sent!\n");
1966                 }
1967 #endif
1968                 memset(&ans, 0, sizeof(ans));
1969                 return (ans);
1970         }
1971
1972         /*** 2a> determine scope for outbound address/route */
1973         loc_scope = loopscope = 0;
1974         /*
1975          * We base our scope on the outbound packet scope and route,
1976          * NOT the TCB (if there is one). This way in local scope we will only
1977          * use a local scope src address when we send to a local address.
1978          */
1979
1980         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1981                 /* If the route goes to the loopback address OR
1982                  * the address is a loopback address, we are loopback
1983                  * scope.
1984                  */
1985 #ifdef SCTP_DEBUG
1986                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1987                         kprintf("Loopback scope is set\n");
1988                 }
1989 #endif
1990                 loc_scope = 0;
1991                 loopscope = 1;
1992                 if (net != NULL) {
1993                         /* mark it as local */
1994                         net->addr_is_local = 1;
1995                 }
1996
1997         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
1998 #ifdef SCTP_DEBUG
1999                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2000                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2001                 }
2002 #endif
2003                 if (to->sin6_scope_id)
2004                         loc_scope = to->sin6_scope_id;
2005                 else {
2006                         loc_scope = 1;
2007                 }
2008                 loopscope = 0;
2009         } else {
2010 #ifdef SCTP_DEBUG
2011                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2012                         kprintf("Global scope is set\n");
2013                 }
2014 #endif
2015         }
2016
2017         /* now, depending on which way we are bound we call the appropriate
2018          * routine to do steps 3-6
2019          */
2020 #ifdef SCTP_DEBUG
2021         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2022                 kprintf("Destination address:");
2023                 sctp_print_address((struct sockaddr *)to);
2024         }
2025 #endif
2026
2027         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2028 #ifdef SCTP_DEBUG
2029                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2030                         kprintf("Calling bound-all src addr selection for v6\n");
2031                 }
2032 #endif
2033                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2034         } else {
2035 #ifdef SCTP_DEBUG
2036                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2037                         kprintf("Calling bound-specific src addr selection for v6\n");
2038                 }
2039 #endif
2040                 if (stcb)
2041                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2042                 else
2043                         /* we can't have a non-asoc address since we have no association */
2044                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2045         }
2046         if (rt_addr == NULL) {
2047                 /* no suitable address? */
2048                 struct in6_addr in6;
2049 #ifdef SCTP_DEBUG
2050                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2051                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2052                 }
2053 #endif
2054                 memset(&in6, 0, sizeof(in6));
2055                 return (in6);
2056         }
2057 #ifdef SCTP_DEBUG
2058         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2059                 kprintf("Source address selected is:");
2060                 sctp_print_address((struct sockaddr *)rt_addr);
2061         }
2062 #endif
2063         return (rt_addr->sin6_addr);
2064 }
2065
2066 static uint8_t
2067 sctp_get_ect(struct sctp_tcb *stcb,
2068              struct sctp_tmit_chunk *chk)
2069 {
2070         uint8_t this_random;
2071
2072         /* Huh? */
2073         if (sctp_ecn == 0)
2074                 return (0);
2075
2076         if (sctp_ecn_nonce == 0)
2077                 /* no nonce, always return ECT0 */
2078                 return (SCTP_ECT0_BIT);
2079
2080         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2081                 /* Peer does NOT support it, so we send a ECT0 only */
2082                 return (SCTP_ECT0_BIT);
2083         }
2084
2085         if (chk == NULL)
2086            return (SCTP_ECT0_BIT);
2087
2088         if (((stcb->asoc.hb_random_idx == 3) &&
2089              (stcb->asoc.hb_ect_randombit > 7)) ||
2090              (stcb->asoc.hb_random_idx > 3)) {
2091                 uint32_t rndval;
2092                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2093                 memcpy(stcb->asoc.hb_random_values, &rndval,
2094                        sizeof(stcb->asoc.hb_random_values));
2095                 this_random = stcb->asoc.hb_random_values[0];
2096                 stcb->asoc.hb_random_idx = 0;
2097                 stcb->asoc.hb_ect_randombit = 0;
2098         } else {
2099                 if (stcb->asoc.hb_ect_randombit > 7) {
2100                   stcb->asoc.hb_ect_randombit = 0;
2101                   stcb->asoc.hb_random_idx++;
2102                 }
2103                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2104         }
2105         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2106                 if (chk != NULL)
2107                         /* ECN Nonce stuff */
2108                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2109                 stcb->asoc.hb_ect_randombit++;
2110                 return (SCTP_ECT1_BIT);
2111         } else {
2112                 stcb->asoc.hb_ect_randombit++;
2113                 return (SCTP_ECT0_BIT);
2114         }
2115 }
2116
2117 extern int sctp_no_csum_on_loopback;
2118
2119 static int
2120 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2121                            struct sctp_tcb *stcb,    /* may be NULL */
2122                            struct sctp_nets *net,
2123                            struct sockaddr *to,
2124                            struct mbuf *m,
2125                            int nofragment_flag,
2126                            int ecn_ok,
2127                            struct sctp_tmit_chunk *chk,
2128                            int out_of_asoc_ok)
2129         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2130 {
2131         /*
2132          * Given a mbuf chain (via m_next) that holds a packet header
2133          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2134          * - calculate SCTP checksum and fill in
2135          * - prepend a IP address header
2136          * - if boundall use INADDR_ANY
2137          * - if boundspecific do source address selection
2138          * - set fragmentation option for ipV4
2139          * - On return from IP output, check/adjust mtu size
2140          * - of output interface and smallest_mtu size as well.
2141          */
2142         struct sctphdr *sctphdr;
2143         int o_flgs;
2144         uint32_t csum;
2145         int ret;
2146         unsigned int have_mtu;
2147         struct route *ro;
2148
2149         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2150                 sctp_m_freem(m);
2151                 return (EFAULT);
2152         }
2153         if ((m->m_flags & M_PKTHDR) == 0) {
2154 #ifdef SCTP_DEBUG
2155                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2156                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2157                 }
2158 #endif
2159                 sctp_m_freem(m);
2160                 return (EFAULT);
2161         }
2162         /* Calculate the csum and fill in the length of the packet */
2163         sctphdr = mtod(m, struct sctphdr *);
2164         have_mtu = 0;
2165         if (sctp_no_csum_on_loopback &&
2166              (stcb) &&
2167              (stcb->asoc.loopback_scope)) {
2168                 sctphdr->checksum = 0;
2169                 m->m_pkthdr.len = sctp_calculate_len(m);
2170         } else {
2171                 sctphdr->checksum = 0;
2172                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2173                 sctphdr->checksum = csum;
2174         }
2175         if (to->sa_family == AF_INET) {
2176                 struct ip *ip;
2177                 struct route iproute;
2178                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2179                 if (m == NULL) {
2180                         /* failed to prepend data, give up */
2181                         return (ENOMEM);
2182                 }
2183                 ip = mtod(m, struct ip *);
2184                 ip->ip_v = IPVERSION;
2185                 ip->ip_hl = (sizeof(struct ip) >> 2);
2186                 if (nofragment_flag) {
2187 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2188 #if defined( __OpenBSD__) || defined(__NetBSD__)
2189                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2190                         ip->ip_off = htons(IP_DF);
2191 #else
2192                         ip->ip_off = IP_DF;
2193 #endif
2194 #else
2195                         ip->ip_off = htons(IP_DF);
2196 #endif
2197                 } else
2198                         ip->ip_off = 0;
2199
2200 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2201 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2202                 ip->ip_id = htons(ip_randomid());
2203 #else
2204                 ip->ip_id = htons(ip_id++);
2205 #endif
2206
2207 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2208                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2209 #else
2210                 ip->ip_ttl = inp->inp_ip_ttl;
2211 #endif
2212 #if defined(__OpenBSD__) || defined(__NetBSD__)
2213                 ip->ip_len = htons(m->m_pkthdr.len);
2214 #else
2215                 ip->ip_len = m->m_pkthdr.len;
2216 #endif
2217                 if (stcb) {
2218                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2219                                 /* Enable ECN */
2220 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2221                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2222                                                       sctp_get_ect(stcb, chk));
2223 #elif defined(__NetBSD__)
2224                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2225                                                       sctp_get_ect(stcb, chk));
2226 #else
2227                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2228                                                       sctp_get_ect(stcb, chk));
2229 #endif
2230                         } else {
2231                                 /* No ECN */
2232 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2233                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2234 #elif defined(__NetBSD__)
2235                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2236 #else
2237                                 ip->ip_tos = inp->inp_ip_tos;
2238 #endif
2239                         }
2240                 } else {
2241                         /* no association at all */
2242 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2243                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2244 #else
2245                         ip->ip_tos = inp->inp_ip_tos;
2246 #endif
2247                 }
2248                 ip->ip_p = IPPROTO_SCTP;
2249                 ip->ip_sum = 0;
2250                 if (net == NULL) {
2251                         ro = &iproute;
2252                         memset(&iproute, 0, sizeof(iproute));
2253                         memcpy(&ro->ro_dst, to, to->sa_len);
2254                 } else {
2255                         ro = (struct route *)&net->ro;
2256                 }
2257                 /* Now the address selection part */
2258                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2259
2260                 /* call the routine to select the src address */
2261                 if (net) {
2262                         if (net->src_addr_selected == 0) {
2263                                 /* Cache the source address */
2264                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2265                                     stcb,
2266                                     ro, net, out_of_asoc_ok);
2267                                 if (ro->ro_rt)
2268                                         net->src_addr_selected = 1;
2269                         }
2270                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2271                 } else {
2272                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2273                             stcb, ro, net, out_of_asoc_ok);
2274                 }
2275                 /*
2276                  * If source address selection fails and we find no route then
2277                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2278                  * type error. We probably should catch that somewhere and
2279                  * abort the association right away (assuming this is an INIT
2280                  * being sent).
2281                  */
2282                 if ((ro->ro_rt == NULL)) {
2283                         /*
2284                          * src addr selection failed to find a route (or valid
2285                          * source addr), so we can't get there from here!
2286                          */
2287 #ifdef SCTP_DEBUG
2288                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2289                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2290                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2291                         }
2292 #endif /* SCTP_DEBUG */
2293                         if (net) {
2294                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2295                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2296                                                         stcb,
2297                                                         SCTP_FAILED_THRESHOLD,
2298                                                         (void *)net);
2299                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2300                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2301                                 if (stcb) {
2302                                         if (net == stcb->asoc.primary_destination) {
2303                                                 /* need a new primary */
2304                                                 struct sctp_nets *alt;
2305                                                 alt = sctp_find_alternate_net(stcb, net);
2306                                                 if (alt != net) {
2307                                                         if (sctp_set_primary_addr(stcb,
2308                                                                               NULL,
2309                                                                                  alt) == 0) {
2310                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2311                                                                 net->src_addr_selected = 0;
2312                                                         }
2313                                                 }
2314                                         }
2315                                 }
2316                         }
2317                         sctp_m_freem(m);
2318                         return (EHOSTUNREACH);
2319                 } else {
2320                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2321                 }
2322
2323                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2324 #ifdef SCTP_DEBUG
2325                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2326                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2327                                (u_int)(ntohl(ip->ip_src.s_addr)));
2328                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2329                         kprintf("RTP route is %p through\n", ro->ro_rt);
2330                 }
2331 #endif
2332                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2333                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2334                 }
2335                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2336                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2337 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2338     || defined(__DragonFly__)
2339                                 , NULL
2340 #endif
2341 #if defined(__NetBSD__)
2342                                 ,(struct socket *)inp->sctp_socket
2343 #endif
2344
2345 );
2346                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2347                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2348                 }
2349                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2350 #ifdef SCTP_DEBUG
2351                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2352                         kprintf("Ip output returns %d\n", ret);
2353                 }
2354 #endif
2355                 if (net == NULL) {
2356                         /* free tempy routes */
2357                         if (ro->ro_rt)
2358                                 RTFREE(ro->ro_rt);
2359                 } else {
2360                         /* PMTU check versus smallest asoc MTU goes here */
2361                         if (ro->ro_rt != NULL) {
2362                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2363                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2364                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2365                                             ro->ro_rt->rt_rmx.rmx_mtu);
2366                                 }
2367                         } else {
2368                                 /* route was freed */
2369                                 net->src_addr_selected = 0;
2370                         }
2371                 }
2372                 return (ret);
2373         }
2374 #ifdef INET6
2375         else if (to->sa_family == AF_INET6) {
2376                 struct ip6_hdr *ip6h;
2377 #ifdef NEW_STRUCT_ROUTE
2378                 struct route ip6route;
2379 #else
2380                 struct route_in6 ip6route;
2381 #endif
2382                 struct ifnet *ifp;
2383                 u_char flowTop;
2384                 uint16_t flowBottom;
2385                 u_char tosBottom, tosTop;
2386                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2387                 struct sockaddr_in6 lsa6_storage;
2388                 int prev_scope=0;
2389                 int error;
2390                 u_short prev_port=0;
2391
2392                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2393                 if (m == NULL) {
2394                         /* failed to prepend data, give up */
2395                         return (ENOMEM);
2396                 }
2397                 ip6h = mtod(m, struct ip6_hdr *);
2398
2399                 /*
2400                  * We assume here that inp_flow is in host byte order within
2401                  * the TCB!
2402                  */
2403                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2404                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2405
2406                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2407
2408                 /* protect *sin6 from overwrite */
2409                 sin6 = (struct sockaddr_in6 *)to;
2410                 tmp = *sin6;
2411                 sin6 = &tmp;
2412
2413                 /* KAME hack: embed scopeid */
2414 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2415                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2416 #else
2417                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2418 #endif
2419                         return (EINVAL);
2420                 if (net == NULL) {
2421                         memset(&ip6route, 0, sizeof(ip6route));
2422                         ro = (struct route *)&ip6route;
2423                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2424                 } else {
2425                         ro = (struct route *)&net->ro;
2426                 }
2427                 if (stcb != NULL) {
2428                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2429                                 /* Enable ECN */
2430                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2431                         } else {
2432                                 /* No ECN */
2433                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2434                         }
2435                 } else {
2436                         /* we could get no asoc if it is a O-O-T-B packet */
2437                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2438                 }
2439                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2440                 ip6h->ip6_nxt = IPPROTO_SCTP;
2441                 ip6h->ip6_plen = m->m_pkthdr.len;
2442                 ip6h->ip6_dst = sin6->sin6_addr;
2443
2444                 /*
2445                  * Add SRC address selection here:
2446                  * we can only reuse to a limited degree the kame src-addr-sel,
2447                  * since we can try their selection but it may not be bound.
2448                  */
2449                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2450                 lsa6_tmp.sin6_family = AF_INET6;
2451                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2452                 lsa6 = &lsa6_tmp;
2453                 if (net) {
2454                         if (net->src_addr_selected == 0) {
2455                                 /* Cache the source address */
2456                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2457                                     stcb, ro, net, out_of_asoc_ok);
2458
2459                                 if (ro->ro_rt)
2460                                         net->src_addr_selected = 1;
2461                         }
2462                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2463                 } else {
2464                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2465                             inp, stcb, ro, net, out_of_asoc_ok);
2466                 }
2467                 lsa6->sin6_port = inp->sctp_lport;
2468
2469                 if ((ro->ro_rt ==  NULL)) {
2470                         /*
2471                          * src addr selection failed to find a route (or valid
2472                          * source addr), so we can't get there from here!
2473                          */
2474 #ifdef SCTP_DEBUG
2475                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2476                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2477                         }
2478 #endif
2479                         sctp_m_freem(m);
2480                         if (net) {
2481                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2482                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2483                                                         stcb,
2484                                                         SCTP_FAILED_THRESHOLD,
2485                                                         (void *)net);
2486                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2487                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2488                                 if (stcb) {
2489                                         if (net == stcb->asoc.primary_destination) {
2490                                                 /* need a new primary */
2491                                                 struct sctp_nets *alt;
2492                                                 alt = sctp_find_alternate_net(stcb, net);
2493                                                 if (alt != net) {
2494                                                         if (sctp_set_primary_addr(stcb,
2495                                                                               NULL,
2496                                                                                  alt) == 0) {
2497                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2498                                                                 net->src_addr_selected = 0;
2499                                                         }
2500                                                 }
2501                                         }
2502                                 }
2503                         }
2504                         return (EHOSTUNREACH);
2505                 }
2506
2507 #ifndef SCOPEDROUTING
2508                 /*
2509                  * XXX: sa6 may not have a valid sin6_scope_id in
2510                  * the non-SCOPEDROUTING case.
2511                  */
2512                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2513                 lsa6_storage.sin6_family = AF_INET6;
2514                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2515                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2516                                               NULL)) != 0) {
2517                         sctp_m_freem(m);
2518                         return (error);
2519                 }
2520                 /* XXX */
2521                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2522                 lsa6_storage.sin6_port = inp->sctp_lport;
2523                 lsa6 = &lsa6_storage;
2524 #endif /* SCOPEDROUTING */
2525                 ip6h->ip6_src = lsa6->sin6_addr;
2526
2527                 /*
2528                  * We set the hop limit now since there is a good chance that
2529                  * our ro pointer is now filled
2530                  */
2531                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2532                                                 (ro ?
2533                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2534                                                  (NULL)));
2535                 o_flgs = 0;
2536                 ifp = ro->ro_rt->rt_ifp;
2537 #ifdef SCTP_DEBUG
2538                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2539                         /* Copy to be sure something bad is not happening */
2540                         sin6->sin6_addr = ip6h->ip6_dst;
2541                         lsa6->sin6_addr = ip6h->ip6_src;
2542
2543                         kprintf("Calling ipv6 output routine from low level\n");
2544                         kprintf("src: ");
2545                         sctp_print_address((struct sockaddr *)lsa6);
2546                         kprintf("dst: ");
2547                         sctp_print_address((struct sockaddr *)sin6);
2548                 }
2549 #endif /* SCTP_DEBUG */
2550                 if (net) {
2551                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2552                         /* preserve the port and scope for link local send */
2553                         prev_scope = sin6->sin6_scope_id;
2554                         prev_port = sin6->sin6_port;
2555                 }
2556                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2557 #ifdef NEW_STRUCT_ROUTE
2558                                  ro,
2559 #else
2560                                  (struct route_in6 *)ro,
2561 #endif
2562                                  o_flgs,
2563                                  ((struct in6pcb *)inp)->in6p_moptions,
2564 #if defined(__NetBSD__)
2565                                  (struct socket *)inp->sctp_socket,
2566 #endif
2567                                  &ifp
2568 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2569                     , NULL
2570 #endif
2571                         );
2572                 if (net) {
2573                         /* for link local this must be done */
2574                         sin6->sin6_scope_id = prev_scope;
2575                         sin6->sin6_port = prev_port;
2576                 }
2577 #ifdef SCTP_DEBUG
2578                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2579                         kprintf("return from send is %d\n", ret);
2580                 }
2581 #endif /* SCTP_DEBUG_OUTPUT */
2582                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2583                 if (net == NULL) {
2584                         /* Now if we had a temp route free it */
2585                         if (ro->ro_rt) {
2586                                 RTFREE(ro->ro_rt);
2587                         }
2588                 } else {
2589                         /* PMTU check versus smallest asoc MTU goes here */
2590                         if (ro->ro_rt == NULL) {
2591                                 /* Route was freed */
2592                                 net->src_addr_selected = 0;
2593                         }
2594                         if (ro->ro_rt != NULL) {
2595                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2596                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2597                                         sctp_mtu_size_reset(inp,
2598                                                             &stcb->asoc,
2599                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2600                                 }
2601                         } else if (ifp) {
2602 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2603 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2604 #endif /* SCTP_BASE_FREEBSD */
2605                                 if (ND_IFINFO(ifp)->linkmtu &&
2606                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2607                                         sctp_mtu_size_reset(inp,
2608                                                             &stcb->asoc,
2609                                                             ND_IFINFO(ifp)->linkmtu);
2610                                 }
2611                         }
2612                 }
2613                 return (ret);
2614         }
2615 #endif
2616         else {
2617 #ifdef SCTP_DEBUG
2618                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2619                         kprintf("Unknown protocol (TSNH) type %d\n",
2620                             to->sa_family);
2621                 }
2622 #endif
2623                 sctp_m_freem(m);
2624                 return (EFAULT);
2625         }
2626 }
2627
2628 static int
2629 sctp_is_address_in_scope(struct ifaddr *ifa,
2630                          int ipv4_addr_legal,
2631                          int ipv6_addr_legal,
2632                          int loopback_scope,
2633                          int ipv4_local_scope,
2634                          int local_scope,
2635                          int site_scope)
2636 {
2637         if ((loopback_scope == 0) &&
2638             (ifa->ifa_ifp) &&
2639             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2640                 /* skip loopback if not in scope *
2641                  */
2642                 return (0);
2643         }
2644         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2645                 struct sockaddr_in *sin;
2646                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2647                 if (sin->sin_addr.s_addr == 0) {
2648                         /* not in scope , unspecified */
2649                         return (0);
2650                 }
2651                 if ((ipv4_local_scope == 0) &&
2652                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2653                         /* private address not in scope */
2654                         return (0);
2655                 }
2656         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2657                 struct sockaddr_in6 *sin6;
2658                 struct in6_ifaddr *ifa6;
2659
2660                 ifa6 = (struct in6_ifaddr *)ifa;
2661                 /* ok to use deprecated addresses? */
2662                 if (!ip6_use_deprecated) {
2663                         if (ifa6->ia6_flags &
2664                             IN6_IFF_DEPRECATED) {
2665                                 return (0);
2666                         }
2667                 }
2668                 if (ifa6->ia6_flags &
2669                     (IN6_IFF_DETACHED |
2670                      IN6_IFF_ANYCAST |
2671                      IN6_IFF_NOTREADY)) {
2672                         return (0);
2673                 }
2674                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2675                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2676                         /* skip unspecifed addresses */
2677                         return (0);
2678                 }
2679                 if (/*(local_scope == 0) && */
2680                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2681                         return (0);
2682                 }
2683                 if ((site_scope == 0) &&
2684                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2685                         return (0);
2686                 }
2687         } else {
2688                 return (0);
2689         }
2690         return (1);
2691 }
2692
2693
2694 void
2695 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2696 {
2697         struct mbuf *m, *m_at, *m_last;
2698         struct sctp_nets *net;
2699         struct sctp_init_msg *initm;
2700         struct sctp_supported_addr_param *sup_addr;
2701         struct sctp_ecn_supported_param *ecn;
2702         struct sctp_prsctp_supported_param *prsctp;
2703         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2704         struct sctp_supported_chunk_types_param *pr_supported;
2705         int cnt_inits_to=0;
2706         int padval, ret;
2707
2708         /* INIT's always go to the primary (and usually ONLY address) */
2709         m_last = NULL;
2710         net = stcb->asoc.primary_destination;
2711         if (net == NULL) {
2712                 net = TAILQ_FIRST(&stcb->asoc.nets);
2713                 if (net == NULL) {
2714                         /* TSNH */
2715                         return;
2716                 }
2717                 /* we confirm any address we send an INIT to */
2718                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2719                 sctp_set_primary_addr(stcb, NULL, net);
2720         } else {
2721                 /* we confirm any address we send an INIT to */
2722                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2723         }
2724 #ifdef SCTP_DEBUG
2725         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2726                 kprintf("Sending INIT to ");
2727                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2728         }
2729 #endif
2730         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2731                 /* special hook, if we are sending to link local
2732                  * it will not show up in our private address count.
2733                  */
2734                 struct sockaddr_in6 *sin6l;
2735                 sin6l = &net->ro._l_addr.sin6;
2736                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2737                         cnt_inits_to = 1;
2738         }
2739         if (callout_pending(&net->rxt_timer.timer)) {
2740                 /* This case should not happen */
2741                 return;
2742         }
2743         /* start the INIT timer */
2744         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2745                 /* we are hosed since I can't start the INIT timer? */
2746                 return;
2747         }
2748         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2749         if (m == NULL) {
2750                 /* No memory, INIT timer will re-attempt. */
2751                 return;
2752         }
2753         /* make it into a M_EXT */
2754         MCLGET(m, MB_DONTWAIT);
2755         if ((m->m_flags & M_EXT) != M_EXT) {
2756                 /* Failed to get cluster buffer */
2757                 sctp_m_freem(m);
2758                 return;
2759         }
2760         m->m_data += SCTP_MIN_OVERHEAD;
2761         m->m_len = sizeof(struct sctp_init_msg);
2762         /* Now lets put the SCTP header in place */
2763         initm = mtod(m, struct sctp_init_msg *);
2764         initm->sh.src_port = inp->sctp_lport;
2765         initm->sh.dest_port = stcb->rport;
2766         initm->sh.v_tag = 0;
2767         initm->sh.checksum = 0; /* calculate later */
2768         /* now the chunk header */
2769         initm->msg.ch.chunk_type = SCTP_INITIATION;
2770         initm->msg.ch.chunk_flags = 0;
2771         /* fill in later from mbuf we build */
2772         initm->msg.ch.chunk_length = 0;
2773         /* place in my tag */
2774         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2775         /* set up some of the credits. */
2776         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2777             SCTP_MINIMAL_RWND));
2778
2779         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2780         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2781         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2782         /* now the address restriction */
2783         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2784             sizeof(*initm));
2785         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2786         /* we support 2 types IPv6/IPv4 */
2787         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2788                                           sizeof(uint16_t));
2789         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2790         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2791         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2792
2793 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2794         if (inp->sctp_ep.adaption_layer_indicator) {
2795                 struct sctp_adaption_layer_indication *ali;
2796                 ali = (struct sctp_adaption_layer_indication *)(
2797                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2798                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2799                 ali->ph.param_length = htons(sizeof(*ali));
2800                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2801                 m->m_len += sizeof(*ali);
2802                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2803                     sizeof(*ali));
2804         } else {
2805                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2806                     sizeof(*sup_addr) + sizeof(uint16_t));
2807         }
2808
2809         /* now any cookie time extensions */
2810         if (stcb->asoc.cookie_preserve_req) {
2811                 struct sctp_cookie_perserve_param *cookie_preserve;
2812                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2813                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2814                 cookie_preserve->ph.param_length = htons(
2815                     sizeof(*cookie_preserve));
2816                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2817                 m->m_len += sizeof(*cookie_preserve);
2818                 ecn = (struct sctp_ecn_supported_param *)(
2819                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2820                 stcb->asoc.cookie_preserve_req = 0;
2821         }
2822
2823         /* ECN parameter */
2824         if (sctp_ecn == 1) {
2825                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2826                 ecn->ph.param_length = htons(sizeof(*ecn));
2827                 m->m_len += sizeof(*ecn);
2828                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2829                     sizeof(*ecn));
2830         } else {
2831                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2832         }
2833         /* And now tell the peer we do pr-sctp */
2834         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2835         prsctp->ph.param_length = htons(sizeof(*prsctp));
2836         m->m_len += sizeof(*prsctp);
2837
2838
2839         /* And now tell the peer we do all the extensions */
2840         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2841            sizeof(*prsctp));
2842
2843         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2844         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2845         pr_supported->chunk_types[0] = SCTP_ASCONF;
2846         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2847         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2848         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2849         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2850         pr_supported->chunk_types[5] = 0; /* pad */
2851         pr_supported->chunk_types[6] = 0; /* pad */
2852         pr_supported->chunk_types[7] = 0; /* pad */
2853
2854         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2855         /* ECN nonce: And now tell the peer we support ECN nonce */
2856
2857         if (sctp_ecn_nonce) {
2858                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2859                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2860                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2861                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2862                 m->m_len += sizeof(*ecn_nonce);
2863         }
2864
2865         m_at = m;
2866         /* now the addresses */
2867         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2868                 struct ifnet *ifn;
2869                 int cnt;
2870
2871                 cnt = cnt_inits_to;
2872                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2873                         struct ifaddr_container *ifac;
2874
2875                         if ((stcb->asoc.loopback_scope == 0) &&
2876                             (ifn->if_type == IFT_LOOP)) {
2877                                 /*
2878                                  * Skip loopback devices if loopback_scope
2879                                  * not set
2880                                  */
2881                                 continue;
2882                         }
2883                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2884                                 struct ifaddr *ifa = ifac->ifa;
2885
2886                                 if (sctp_is_address_in_scope(ifa,
2887                                     stcb->asoc.ipv4_addr_legal,
2888                                     stcb->asoc.ipv6_addr_legal,
2889                                     stcb->asoc.loopback_scope,
2890                                     stcb->asoc.ipv4_local_scope,
2891                                     stcb->asoc.local_scope,
2892                                     stcb->asoc.site_scope) == 0) {
2893                                         continue;
2894                                 }
2895                                 cnt++;
2896                         }
2897                 }
2898                 if (cnt > 1) {
2899                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2900                                 struct ifaddr_container *ifac;
2901
2902                                 if ((stcb->asoc.loopback_scope == 0) &&
2903                                     (ifn->if_type == IFT_LOOP)) {
2904                                         /*
2905                                          * Skip loopback devices if loopback_scope
2906                                          * not set
2907                                          */
2908                                         continue;
2909                                 }
2910                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2911                                         struct ifaddr *ifa = ifac->ifa;
2912
2913                                         if (sctp_is_address_in_scope(ifa,
2914                                             stcb->asoc.ipv4_addr_legal,
2915                                             stcb->asoc.ipv6_addr_legal,
2916                                             stcb->asoc.loopback_scope,
2917                                             stcb->asoc.ipv4_local_scope,
2918                                             stcb->asoc.local_scope,
2919                                             stcb->asoc.site_scope) == 0) {
2920                                                 continue;
2921                                         }
2922                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2923                                 }
2924                         }
2925                 }
2926         } else {
2927                 struct sctp_laddr *laddr;
2928                 int cnt;
2929                 cnt = cnt_inits_to;
2930                 /* First, how many ? */
2931                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2932                         if (laddr->ifa == NULL) {
2933                                 continue;
2934                         }
2935                         if (laddr->ifa->ifa_addr == NULL)
2936                                 continue;
2937                         if (sctp_is_address_in_scope(laddr->ifa,
2938                             stcb->asoc.ipv4_addr_legal,
2939                             stcb->asoc.ipv6_addr_legal,
2940                             stcb->asoc.loopback_scope,
2941                             stcb->asoc.ipv4_local_scope,
2942                             stcb->asoc.local_scope,
2943                             stcb->asoc.site_scope) == 0) {
2944                                 continue;
2945                         }
2946                         cnt++;
2947                 }
2948                 /* To get through a NAT we only list addresses if
2949                  * we have more than one. That way if you just
2950                  * bind a single address we let the source of the init
2951                  * dictate our address.
2952                  */
2953                 if (cnt > 1) {
2954                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2955                                 if (laddr->ifa == NULL) {
2956                                         continue;
2957                                 }
2958                                 if (laddr->ifa->ifa_addr == NULL) {
2959                                         continue;
2960                                 }
2961
2962                                 if (sctp_is_address_in_scope(laddr->ifa,
2963                                     stcb->asoc.ipv4_addr_legal,
2964                                     stcb->asoc.ipv6_addr_legal,
2965                                     stcb->asoc.loopback_scope,
2966                                     stcb->asoc.ipv4_local_scope,
2967                                     stcb->asoc.local_scope,
2968                                     stcb->asoc.site_scope) == 0) {
2969                                         continue;
2970                                 }
2971                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2972                         }
2973                 }
2974         }
2975         /* calulate the size and update pkt header and chunk header */
2976         m->m_pkthdr.len = 0;
2977         for (m_at = m; m_at; m_at = m_at->m_next) {
2978                 if (m_at->m_next == NULL)
2979                         m_last = m_at;
2980                 m->m_pkthdr.len += m_at->m_len;
2981         }
2982         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2983             sizeof(struct sctphdr)));
2984         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2985          * ignore the return here since the timer will drive
2986          * a retranmission.
2987          */
2988
2989         /* I don't expect this to execute but we will be safe here */
2990         padval = m->m_pkthdr.len % 4;
2991         if ((padval) && (m_last)) {
2992                 /* The compiler worries that m_last may not be
2993                  * set even though I think it is impossible :->
2994                  * however we add m_last here just in case.
2995                  */
2996                 int ret;
2997                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2998                 if (ret) {
2999                         /* Houston we have a problem, no space */
3000                         sctp_m_freem(m);
3001                         return;
3002                 }
3003                 m->m_pkthdr.len += padval;
3004         }
3005 #ifdef SCTP_DEBUG
3006         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3007                 kprintf("Calling lowlevel output stcb:%p net:%p\n", stcb, net);
3008         }
3009 #endif
3010         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3011                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3012 #ifdef SCTP_DEBUG
3013         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3014                 kprintf("Low level output returns %d\n", ret);
3015         }
3016 #endif
3017         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3018         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3019 }
3020
3021 struct mbuf *
3022 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3023     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3024 {
3025         /* Given a mbuf containing an INIT or INIT-ACK
3026          * with the param_offset being equal to the
3027          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3028          * parse through the parameters to the end of the mbuf verifying
3029          * that all parameters are known.
3030          *
3031          * For unknown parameters build and return a mbuf with
3032          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3033          * to stop processing this chunk stop, and set *abort_processing
3034          * to 1.
3035          *
3036          * By having param_offset be pre-set to where parameters begin
3037          * it is hoped that this routine may be reused in the future
3038          * by new features.
3039          */
3040         struct sctp_paramhdr *phdr, params;
3041
3042         struct mbuf *mat, *op_err;
3043         char tempbuf[2048];
3044         int at, limit, pad_needed;
3045         uint16_t ptype, plen;
3046         int err_at;
3047
3048         *abort_processing = 0;
3049         mat = in_initpkt;
3050         err_at = 0;
3051         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3052 #ifdef SCTP_DEBUG
3053         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3054                 kprintf("Limit is %d bytes\n", limit);
3055         }
3056 #endif
3057         at = param_offset;
3058         op_err = NULL;
3059
3060         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3061         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3062                 ptype = ntohs(phdr->param_type);
3063                 plen = ntohs(phdr->param_length);
3064                 limit -= SCTP_SIZE32(plen);
3065                 if (plen < sizeof(struct sctp_paramhdr)) {
3066 #ifdef SCTP_DEBUG
3067         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3068                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3069         }
3070 #endif
3071                         *abort_processing = 1;
3072                         break;
3073                 }
3074                 /* All parameters for all chunks that we
3075                  * know/understand are listed here. We process
3076                  * them other places and make appropriate
3077                  * stop actions per the upper bits. However
3078                  * this is the generic routine processor's can
3079                  * call to get back an operr.. to either incorporate (init-ack)
3080                  * or send.
3081                  */
3082                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3083                     (ptype == SCTP_IPV4_ADDRESS) ||
3084                     (ptype == SCTP_IPV6_ADDRESS) ||
3085                     (ptype == SCTP_STATE_COOKIE) ||
3086                     (ptype == SCTP_UNRECOG_PARAM) ||
3087                     (ptype == SCTP_COOKIE_PRESERVE) ||
3088                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3089                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3090                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3091                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3092                     (ptype == SCTP_ECN_CAPABLE) ||
3093                     (ptype == SCTP_ULP_ADAPTION) ||
3094                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3095                     (ptype == SCTP_SET_PRIM_ADDR) ||
3096                     (ptype == SCTP_SUCCESS_REPORT) ||
3097                     (ptype == SCTP_ULP_ADAPTION) ||
3098                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3099                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3100                         ) {
3101                         /* no skip it */
3102                         at += SCTP_SIZE32(plen);
3103                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3104                         /* We can NOT handle HOST NAME addresses!! */
3105 #ifdef SCTP_DEBUG
3106         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3107                 kprintf("Can't handle hostname addresses.. abort processing\n");
3108         }
3109 #endif
3110                         *abort_processing = 1;
3111                         if (op_err == NULL) {
3112                                 /* Ok need to try to get a mbuf */
3113                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3114                                 if (op_err) {
3115                                         op_err->m_len = 0;
3116                                         op_err->m_pkthdr.len = 0;
3117                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3118                                         op_err->m_data += sizeof(struct ip6_hdr);
3119                                         op_err->m_data += sizeof(struct sctphdr);
3120                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3121                                 }
3122                         }
3123                         if (op_err) {
3124                                 /* If we have space */
3125                                 struct sctp_paramhdr s;
3126                                 if (err_at % 4) {
3127                                         u_int32_t cpthis=0;
3128                                         pad_needed = 4 - (err_at % 4);
3129                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3130                                         err_at += pad_needed;
3131                                 }
3132                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3133                                 s.param_length = htons(sizeof(s) + plen);
3134                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3135                                 err_at += sizeof(s);
3136                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3137                                 if (phdr == NULL) {
3138                                         sctp_m_freem(op_err);
3139                                         /* we are out of memory but we
3140                                          * still need to have a look at what to
3141                                          * do (the system is in trouble though).
3142                                          */
3143                                         return (NULL);
3144                                 }
3145                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3146                                 err_at += plen;
3147                         }
3148                         return (op_err);
3149                 } else {
3150                         /* we do not recognize the parameter
3151                          * figure out what we do.
3152                          */
3153 #ifdef SCTP_DEBUG
3154                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3155                                 kprintf("Got parameter type %x - unknown\n",
3156                                        (u_int)ptype);
3157                         }
3158 #endif
3159                         if ((ptype & 0x4000) == 0x4000) {
3160                                 /* Report bit is set?? */
3161 #ifdef SCTP_DEBUG
3162                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3163                                         kprintf("Report bit is set\n");
3164                                 }
3165 #endif
3166                                 if (op_err == NULL) {
3167                                         /* Ok need to try to get an mbuf */
3168                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3169                                         if (op_err) {
3170                                                 op_err->m_len = 0;
3171                                                 op_err->m_pkthdr.len = 0;
3172                                                 op_err->m_data += sizeof(struct ip6_hdr);
3173                                                 op_err->m_data += sizeof(struct sctphdr);
3174                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3175                                         }
3176                                 }
3177                                 if (op_err) {
3178                                         /* If we have space */
3179                                         struct sctp_paramhdr s;
3180                                         if (err_at % 4) {
3181                                                 u_int32_t cpthis=0;
3182                                                 pad_needed = 4 - (err_at % 4);
3183                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3184                                                 err_at += pad_needed;
3185                                         }
3186                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3187                                         s.param_length = htons(sizeof(s) + plen);
3188                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3189                                         err_at += sizeof(s);
3190                                         if (plen > sizeof(tempbuf)) {
3191                                                 plen = sizeof(tempbuf);
3192                                         }
3193                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3194                                         if (phdr == NULL) {
3195                                                 sctp_m_freem(op_err);
3196                                                 /* we are out of memory but we
3197                                                  * still need to have a look at what to
3198                                                  * do (the system is in trouble though).
3199                                                  */
3200                                                 goto more_processing;
3201                                         }
3202                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3203                                         err_at += plen;
3204                                 }
3205                         }
3206                 more_processing:
3207                         if ((ptype & 0x8000) == 0x0000) {
3208 #ifdef SCTP_DEBUG
3209                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3210                                         kprintf("Abort bit is now setting1\n");
3211                                 }
3212 #endif
3213                                 return (op_err);
3214                         } else {
3215                                 /* skip this chunk and continue processing */
3216                                 at += SCTP_SIZE32(plen);
3217                         }
3218
3219                 }
3220                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3221         }
3222         return (op_err);
3223 }
3224
3225 static int
3226 sctp_are_there_new_addresses(struct sctp_association *asoc,
3227     struct mbuf *in_initpkt, int iphlen, int offset)
3228 {
3229         /*
3230          * Given a INIT packet, look through the packet to verify that
3231          * there are NO new addresses. As we go through the parameters
3232          * add reports of any un-understood parameters that require an
3233          * error.  Also we must return (1) to drop the packet if we see
3234          * a un-understood parameter that tells us to drop the chunk.
3235          */
3236         struct sockaddr_in sin4, *sa4;
3237         struct sockaddr_in6 sin6, *sa6;
3238         struct sockaddr *sa_touse;
3239         struct sockaddr *sa;
3240         struct sctp_paramhdr *phdr, params;
3241         struct ip *iph;
3242         struct mbuf *mat;
3243         uint16_t ptype, plen;
3244         uint8_t fnd;
3245         struct sctp_nets *net;
3246
3247         memset(&sin4, 0, sizeof(sin4));
3248         memset(&sin6, 0, sizeof(sin6));
3249         sin4.sin_family = AF_INET;
3250         sin4.sin_len = sizeof(sin4);
3251         sin6.sin6_family = AF_INET6;
3252         sin6.sin6_len = sizeof(sin6);
3253
3254         sa_touse = NULL;
3255         /* First what about the src address of the pkt ? */
3256         iph = mtod(in_initpkt, struct ip *);
3257         if (iph->ip_v == IPVERSION) {
3258                 /* source addr is IPv4 */
3259                 sin4.sin_addr = iph->ip_src;
3260                 sa_touse = (struct sockaddr *)&sin4;
3261         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3262                 /* source addr is IPv6 */
3263                 struct ip6_hdr *ip6h;
3264                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3265                 sin6.sin6_addr = ip6h->ip6_src;
3266                 sa_touse = (struct sockaddr *)&sin6;
3267         } else {
3268                 return (1);
3269         }
3270
3271         fnd = 0;
3272         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3273                 sa = (struct sockaddr *)&net->ro._l_addr;
3274                 if (sa->sa_family == sa_touse->sa_family) {
3275                         if (sa->sa_family == AF_INET) {
3276                             sa4 = (struct sockaddr_in *)sa;
3277                                 if (sa4->sin_addr.s_addr ==
3278                                     sin4.sin_addr.s_addr) {
3279                                         fnd = 1;
3280                                         break;
3281                                 }
3282                         } else if (sa->sa_family == AF_INET6) {
3283                                 sa6 = (struct sockaddr_in6 *)sa;
3284                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3285                                     &sin6.sin6_addr)) {
3286                                         fnd = 1;
3287                                         break;
3288                                 }
3289                         }
3290                 }
3291         }
3292         if (fnd == 0) {
3293                 /* New address added! no need to look futher. */
3294                 return (1);
3295         }
3296         /* Ok so far lets munge through the rest of the packet */
3297         mat = in_initpkt;
3298         sa_touse = NULL;
3299         offset += sizeof(struct sctp_init_chunk);
3300         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3301         while (phdr) {
3302                 ptype = ntohs(phdr->param_type);
3303                 plen = ntohs(phdr->param_length);
3304                 if (ptype == SCTP_IPV4_ADDRESS) {
3305                         struct sctp_ipv4addr_param *p4, p4_buf;
3306
3307                         phdr = sctp_get_next_param(mat, offset,
3308                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3309                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3310                             phdr == NULL) {
3311                                 return (1);
3312                         }
3313                         p4 = (struct sctp_ipv4addr_param *)phdr;
3314                         sin4.sin_addr.s_addr = p4->addr;
3315                         sa_touse = (struct sockaddr *)&sin4;
3316                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3317                         struct sctp_ipv6addr_param *p6, p6_buf;
3318
3319                         phdr = sctp_get_next_param(mat, offset,
3320                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3321                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3322                             phdr == NULL) {
3323                                 return (1);
3324                         }
3325                         p6 = (struct sctp_ipv6addr_param *)phdr;
3326                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3327                             sizeof(p6->addr));
3328                         sa_touse = (struct sockaddr *)&sin4;
3329                 }
3330
3331                 if (sa_touse) {
3332                         /* ok, sa_touse points to one to check */
3333                         fnd = 0;
3334                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3335                                 sa = (struct sockaddr *)&net->ro._l_addr;
3336                                 if (sa->sa_family != sa_touse->sa_family) {
3337                                         continue;
3338                                 }
3339                                 if (sa->sa_family == AF_INET) {
3340                                         sa4 = (struct sockaddr_in *)sa;
3341                                         if (sa4->sin_addr.s_addr ==
3342                                             sin4.sin_addr.s_addr) {
3343                                                 fnd = 1;
3344                                                 break;
3345                                         }
3346                                 } else if (sa->sa_family == AF_INET6) {
3347                                         sa6 = (struct sockaddr_in6 *)sa;
3348                                         if (SCTP6_ARE_ADDR_EQUAL(
3349                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3350                                                 fnd = 1;
3351                                                 break;
3352                                         }
3353                                 }
3354                         }
3355                         if (!fnd) {
3356                                 /* New addr added! no need to look further */
3357                                 return (1);
3358                         }
3359                 }
3360                 offset += SCTP_SIZE32(plen);
3361                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3362         }
3363         return (0);
3364 }
3365
3366 /*
3367  * Given a MBUF chain that was sent into us containing an
3368  * INIT. Build a INIT-ACK with COOKIE and send back.
3369  * We assume that the in_initpkt has done a pullup to
3370  * include IPv6/4header, SCTP header and initial part of
3371  * INIT message (i.e. the struct sctp_init_msg).
3372  */
3373 void
3374 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3375     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3376     struct sctp_init_chunk *init_chk)
3377 {
3378         struct sctp_association *asoc;
3379         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3380         struct sctp_init_msg *initackm_out;
3381         struct sctp_ecn_supported_param *ecn;
3382         struct sctp_prsctp_supported_param *prsctp;
3383         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3384         struct sctp_supported_chunk_types_param *pr_supported;
3385         struct sockaddr_storage store;
3386         struct sockaddr_in *sin;
3387         struct sockaddr_in6 *sin6;
3388         struct route *ro;
3389         struct ip *iph;
3390         struct ip6_hdr *ip6;
3391         struct sockaddr *to;
3392         struct sctp_state_cookie stc;
3393         struct sctp_nets *net=NULL;
3394         int cnt_inits_to=0;
3395         uint16_t his_limit, i_want;
3396         int abort_flag, padval, sz_of;
3397
3398         if (stcb) {
3399                 asoc = &stcb->asoc;
3400         } else {
3401                 asoc = NULL;
3402         }
3403         m_last = NULL;
3404         if ((asoc != NULL) &&
3405             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3406             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3407                 /* new addresses, out of here in non-cookie-wait states */
3408                 /*
3409                  * Send a ABORT, we don't add the new address error clause though
3410                  * we even set the T bit and copy in the 0 tag.. this looks no
3411                  * different than if no listner was present.
3412                  */
3413                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3414                 return;
3415         }
3416         abort_flag = 0;
3417         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3418             (offset+sizeof(struct sctp_init_chunk)),
3419             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3420         if (abort_flag) {
3421                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3422                 return;
3423         }
3424         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3425         if (m == NULL) {
3426                 /* No memory, INIT timer will re-attempt. */
3427                 if (op_err)
3428                         sctp_m_freem(op_err);
3429                 return;
3430         }
3431         MCLGET(m, MB_DONTWAIT);
3432         if ((m->m_flags & M_EXT) != M_EXT) {
3433                 /* Failed to get cluster buffer */
3434                 if (op_err)
3435                         sctp_m_freem(op_err);
3436                 sctp_m_freem(m);
3437                 return;
3438         }
3439         m->m_data += SCTP_MIN_OVERHEAD;
3440         m->m_pkthdr.rcvif = 0;
3441         m->m_len = sizeof(struct sctp_init_msg);
3442
3443         /* the time I built cookie */
3444         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3445
3446         /* populate any tie tags */
3447         if (asoc != NULL) {
3448                 /* unlock before tag selections */
3449                 SCTP_TCB_UNLOCK(stcb);
3450                 if (asoc->my_vtag_nonce == 0)
3451                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3452                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3453
3454                 if (asoc->peer_vtag_nonce == 0)
3455                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3456                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3457
3458                 stc.cookie_life = asoc->cookie_life;
3459                 net = asoc->primary_destination;
3460                 /* now we must relock */
3461                 SCTP_INP_RLOCK(inp);
3462                 /* we may be in trouble here if the inp got freed
3463                  * most likely this set of tests will protect
3464                  * us but there is a chance not.
3465                  */
3466                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3467                         if (op_err)
3468                                 sctp_m_freem(op_err);
3469                         sctp_m_freem(m);
3470                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3471                         return;
3472                 }
3473                 SCTP_TCB_LOCK(stcb);
3474                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3475         } else {
3476                 stc.tie_tag_my_vtag = 0;
3477                 stc.tie_tag_peer_vtag = 0;
3478                 /* life I will award this cookie */
3479                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3480         }
3481
3482         /* copy in the ports for later check */
3483         stc.myport = sh->dest_port;
3484         stc.peerport = sh->src_port;
3485
3486         /*
3487          * If we wanted to honor cookie life extentions, we would add
3488          * to stc.cookie_life. For now we should NOT honor any extension
3489          */
3490         stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3491         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3492                 struct inpcb *in_inp;
3493                 /* Its a V6 socket */
3494                 in_inp = (struct inpcb *)inp;
3495                 stc.ipv6_addr_legal = 1;
3496                 /* Now look at the binding flag to see if V4 will be legal */
3497                 if (
3498 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
3499                     (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3500 #elif defined(__OpenBSD__)
3501                     (0) /* For openbsd we do dual bind only */
3502 #else
3503                     (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3504 #endif
3505                     == 0) {
3506                         stc.ipv4_addr_legal = 1;
3507                 } else {
3508                         /* V4 addresses are NOT legal on the association */
3509                         stc.ipv4_addr_legal = 0;
3510                 }
3511         } else {
3512                 /* Its a V4 socket, no - V6 */
3513                 stc.ipv4_addr_legal = 1;
3514                 stc.ipv6_addr_legal = 0;
3515         }
3516
3517 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3518         stc.ipv4_scope = 1;
3519 #else
3520         stc.ipv4_scope = 0;
3521 #endif
3522         /* now for scope setup */
3523         memset((caddr_t)&store, 0, sizeof(store));
3524         sin = (struct sockaddr_in *)&store;
3525         sin6 = (struct sockaddr_in6 *)&store;
3526         if (net == NULL) {
3527                 to = (struct sockaddr *)&store;
3528                 iph = mtod(init_pkt, struct ip *);
3529                 if (iph->ip_v == IPVERSION) {
3530                         struct in_addr addr;
3531                         struct route iproute;
3532
3533                         sin->sin_family = AF_INET;
3534                         sin->sin_len = sizeof(struct sockaddr_in);
3535                         sin->sin_port = sh->src_port;
3536                         sin->sin_addr = iph->ip_src;
3537                         /* lookup address */
3538                         stc.address[0] = sin->sin_addr.s_addr;
3539                         stc.address[1] = 0;
3540                         stc.address[2] = 0;
3541                         stc.address[3] = 0;
3542                         stc.addr_type = SCTP_IPV4_ADDRESS;
3543                         /* local from address */
3544                         memset(&iproute, 0, sizeof(iproute));
3545                         ro = &iproute;
3546                         memcpy(&ro->ro_dst, sin, sizeof(*sin));
3547                         addr = sctp_ipv4_source_address_selection(inp, NULL,
3548                             ro, NULL, 0);
3549                         if (ro->ro_rt) {
3550                                 RTFREE(ro->ro_rt);
3551                         }
3552                         stc.laddress[0] = addr.s_addr;
3553                         stc.laddress[1] = 0;
3554                         stc.laddress[2] = 0;
3555                         stc.laddress[3] = 0;
3556                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3557                         /* scope_id is only for v6 */
3558                         stc.scope_id = 0;
3559 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3560                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3561                                 stc.ipv4_scope = 1;
3562                         }
3563 #else
3564                         stc.ipv4_scope = 1;
3565 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3566                         /* Must use the address in this case */
3567                         if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3568                                 stc.loopback_scope = 1;
3569                                 stc.ipv4_scope = 1;
3570                                 stc.site_scope = 1;
3571                                 stc.local_scope = 1;
3572                         }
3573                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3574                         struct in6_addr addr;
3575 #ifdef NEW_STRUCT_ROUTE
3576                         struct route iproute6;
3577 #else
3578                         struct route_in6 iproute6;
3579 #endif
3580                         ip6 = mtod(init_pkt, struct ip6_hdr *);
3581                         sin6->sin6_family = AF_INET6;
3582                         sin6->sin6_len = sizeof(struct sockaddr_in6);
3583                         sin6->sin6_port = sh->src_port;
3584                         sin6->sin6_addr = ip6->ip6_src;
3585                         /* lookup address */
3586                         memcpy(&stc.address, &sin6->sin6_addr,
3587                             sizeof(struct in6_addr));
3588                         sin6->sin6_scope_id = 0;
3589                         stc.addr_type = SCTP_IPV6_ADDRESS;
3590                         stc.scope_id = 0;
3591                         if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3592                                 stc.loopback_scope = 1;
3593                                 stc.local_scope = 1;
3594                                 stc.site_scope = 1;
3595                                 stc.ipv4_scope = 1;
3596                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3597                                 /*
3598                                  * If the new destination is a LINK_LOCAL
3599                                  * we must have common both site and local
3600                                  * scope. Don't set local scope though since
3601                                  * we must depend on the source to be added
3602                                  * implicitly. We cannot assure just because
3603                                  * we share one link that all links are common.
3604                                  */
3605                                 stc.local_scope = 0;
3606                                 stc.site_scope = 1;
3607                                 stc.ipv4_scope = 1;
3608                                 /* we start counting for the private
3609                                  * address stuff at 1. since the link
3610                                  * local we source from won't show
3611                                  * up in our scoped cou8nt.
3612                                  */
3613                                 cnt_inits_to=1;
3614                                 /* pull out the scope_id from incoming pkt */
3615                                 in6_recoverscope(sin6, &ip6->ip6_src,
3616                                     init_pkt->m_pkthdr.rcvif);
3617 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
3618                                 in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3619                                     NULL);
3620 #else
3621                                 in6_embedscope(&sin6->sin6_addr, sin6);
3622 #endif
3623                                 stc.scope_id = sin6->sin6_scope_id;
3624                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3625                                 /*
3626                                  * If the new destination is SITE_LOCAL
3627                                  * then we must have site scope in common.
3628                                  */
3629                                 stc.site_scope = 1;
3630                         }
3631                         /* local from address */
3632                         memset(&iproute6, 0, sizeof(iproute6));
3633                         ro = (struct route *)&iproute6;
3634                         memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
3635                         addr = sctp_ipv6_source_address_selection(inp, NULL,
3636                             ro, NULL, 0);
3637                         if (ro->ro_rt) {
3638                                 RTFREE(ro->ro_rt);
3639                         }
3640                         memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3641                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3642                 }
3643         } else {
3644                 /* set the scope per the existing tcb */
3645                 struct sctp_nets *lnet;
3646
3647                 stc.loopback_scope = asoc->loopback_scope;
3648                 stc.ipv4_scope = asoc->ipv4_local_scope;
3649                 stc.site_scope = asoc->site_scope;
3650                 stc.local_scope = asoc->local_scope;
3651                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3652                         if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
3653                                 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
3654                                         /* if we have a LL address, start counting
3655                                          * at 1.
3656                                          */
3657                                         cnt_inits_to = 1;
3658                                 }
3659                         }
3660                 }
3661
3662                 /* use the net pointer */
3663                 to = (struct sockaddr *)&net->ro._l_addr;
3664                 if (to->sa_family == AF_INET) {
3665                         sin = (struct sockaddr_in *)to;
3666                         stc.address[0] = sin->sin_addr.s_addr;
3667                         stc.address[1] = 0;
3668                         stc.address[2] = 0;
3669                         stc.address[3] = 0;
3670                         stc.addr_type = SCTP_IPV4_ADDRESS;
3671                         if (net->src_addr_selected == 0) {
3672                                 /* strange case here, the INIT
3673                                  * should have did the selection.
3674                                  */
3675                                 net->ro._s_addr.sin.sin_addr =
3676                                     sctp_ipv4_source_address_selection(inp,
3677                                     stcb, (struct route *)&net->ro, net, 0);
3678                                 net->src_addr_selected = 1;
3679
3680                         }
3681
3682                         stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr;
3683                         stc.laddress[1] = 0;
3684                         stc.laddress[2] = 0;
3685                         stc.laddress[3] = 0;
3686                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3687                 } else if (to->sa_family == AF_INET6) {
3688                         sin6 = (struct sockaddr_in6 *)to;
3689                         memcpy(&stc.address, &sin6->sin6_addr,
3690                             sizeof(struct in6_addr));
3691                         stc.addr_type = SCTP_IPV6_ADDRESS;
3692                         if (net->src_addr_selected == 0) {
3693                                 /* strange case here, the INIT
3694                                  * should have did the selection.
3695                                  */
3696                                 net->ro._s_addr.sin6.sin6_addr =
3697                                     sctp_ipv6_source_address_selection(inp,
3698                                     stcb, (struct route *)&net->ro, net, 0);
3699                                 net->src_addr_selected = 1;
3700                         }
3701                         memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr,
3702                             sizeof(struct in6_addr));
3703                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3704                 }
3705         }
3706         /* Now lets put the SCTP header in place */
3707         initackm_out = mtod(m, struct sctp_init_msg *);
3708         initackm_out->sh.src_port = inp->sctp_lport;
3709         initackm_out->sh.dest_port = sh->src_port;
3710         initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3711         /* Save it off for quick ref */
3712         stc.peers_vtag = init_chk->init.initiate_tag;
3713         initackm_out->sh.checksum = 0;  /* calculate later */
3714         /* who are we */
3715         strncpy(stc.identification, SCTP_VERSION_STRING,
3716            min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3717         /* now the chunk header */
3718         initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3719         initackm_out->msg.ch.chunk_flags = 0;
3720         /* fill in later from mbuf we build */
3721         initackm_out->msg.ch.chunk_length = 0;
3722         /* place in my tag */
3723         if ((asoc != NULL) &&
3724             ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3725              (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3726                 /* re-use the v-tags and init-seq here */
3727                 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3728                 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3729         } else {
3730                 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3731                 /* get a TSN to use too */
3732                 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3733         }
3734         /* save away my tag to */
3735         stc.my_vtag = initackm_out->msg.init.initiate_tag;
3736
3737         /* set up some of the credits. */
3738         initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND));
3739         /* set what I want */
3740         his_limit = ntohs(init_chk->init.num_inbound_streams);
3741         /* choose what I want */
3742         if (asoc != NULL) {
3743                 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3744                         i_want = asoc->streamoutcnt;
3745                 } else {
3746                         i_want = inp->sctp_ep.pre_open_stream_count;
3747                 }
3748         } else {
3749                 i_want = inp->sctp_ep.pre_open_stream_count;
3750         }
3751         if (his_limit < i_want) {
3752                 /* I Want more :< */
3753                 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3754         } else {
3755                 /* I can have what I want :> */
3756                 initackm_out->msg.init.num_outbound_streams = htons(i_want);
3757         }
3758         /* tell him his limt. */
3759         initackm_out->msg.init.num_inbound_streams =
3760             htons(inp->sctp_ep.max_open_streams_intome);
3761         /* setup the ECN pointer */
3762
3763 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3764         if (inp->sctp_ep.adaption_layer_indicator) {
3765                 struct sctp_adaption_layer_indication *ali;
3766                 ali = (struct sctp_adaption_layer_indication *)(
3767                     (caddr_t)initackm_out + sizeof(*initackm_out));
3768                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3769                 ali->ph.param_length = htons(sizeof(*ali));
3770                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3771                 m->m_len += sizeof(*ali);
3772                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3773                     sizeof(*ali));
3774         } else {
3775                 ecn = (struct sctp_ecn_supported_param*)(
3776                     (caddr_t)initackm_out + sizeof(*initackm_out));
3777         }
3778
3779         /* ECN parameter */
3780         if (sctp_ecn == 1) {
3781                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3782                 ecn->ph.param_length = htons(sizeof(*ecn));
3783                 m->m_len += sizeof(*ecn);
3784
3785                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
3786                     sizeof(*ecn));
3787         } else {
3788                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
3789         }
3790         /* And now tell the peer we do  pr-sctp */
3791         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3792         prsctp->ph.param_length = htons(sizeof(*prsctp));
3793         m->m_len += sizeof(*prsctp);
3794
3795
3796         /* And now tell the peer we do all the extensions */
3797         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
3798            sizeof(*prsctp));
3799
3800         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3801         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3802         pr_supported->chunk_types[0] = SCTP_ASCONF;
3803         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3804         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3805         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3806         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3807         pr_supported->chunk_types[5] = 0; /* pad */
3808         pr_supported->chunk_types[6] = 0; /* pad */
3809         pr_supported->chunk_types[7] = 0; /* pad */
3810
3811         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3812         if (sctp_ecn_nonce) {
3813                 /* ECN nonce: And now tell the peer we support ECN nonce */
3814                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
3815                      sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3816                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3817                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3818                 m->m_len += sizeof(*ecn_nonce);
3819         }
3820
3821         m_at = m;
3822         /* now the addresses */
3823         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3824                 struct ifnet *ifn;
3825                 int cnt = cnt_inits_to;
3826
3827                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3828                         struct ifaddr_container *ifac;
3829
3830                         if ((stc.loopback_scope == 0) &&
3831                             (ifn->if_type == IFT_LOOP)) {
3832                                 /*
3833                                  * Skip loopback devices if loopback_scope
3834                                  * not set
3835                                  */
3836                                 continue;
3837                         }
3838                         TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3839                                 struct ifaddr *ifa = ifac->ifa;
3840
3841                                 if (sctp_is_address_in_scope(ifa,
3842                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3843                                     stc.loopback_scope, stc.ipv4_scope,
3844                                     stc.local_scope, stc.site_scope) == 0) {
3845                                         continue;
3846                                 }
3847                                 cnt++;
3848                         }
3849                 }
3850                 if (cnt > 1) {
3851                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
3852                                 struct ifaddr_container *ifac;
3853
3854                                 if ((stc.loopback_scope == 0) &&
3855                                     (ifn->if_type == IFT_LOOP)) {
3856                                         /*
3857                                          * Skip loopback devices if
3858                                          * loopback_scope not set
3859                                          */
3860                                         continue;
3861                                 }
3862                                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3863                                         struct ifaddr *ifa = ifac->ifa;
3864
3865                                         if (sctp_is_address_in_scope(ifa,
3866                                             stc.ipv4_addr_legal,
3867                                             stc.ipv6_addr_legal,
3868                                             stc.loopback_scope, stc.ipv4_scope,
3869                                             stc.local_scope, stc.site_scope) == 0) {
3870                                                 continue;
3871                                         }
3872                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3873                                 }
3874                         }
3875                 }
3876         } else {
3877                 struct sctp_laddr *laddr;
3878                 int cnt;
3879                 cnt = cnt_inits_to;
3880                 /* First, how many ? */
3881                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3882                         if (laddr->ifa == NULL) {
3883                                 continue;
3884                         }
3885                         if (laddr->ifa->ifa_addr == NULL)
3886                                 continue;
3887                         if (sctp_is_address_in_scope(laddr->ifa,
3888                             stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3889                             stc.loopback_scope, stc.ipv4_scope,
3890                             stc.local_scope, stc.site_scope) == 0) {
3891                                 continue;
3892                         }
3893                         cnt++;
3894                 }
3895                 /* If we bind a single address only we won't list
3896                  * any. This way you can get through a NAT
3897                  */
3898                 if (cnt > 1) {
3899                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3900                                 if (laddr->ifa == NULL) {
3901 #ifdef SCTP_DEBUG
3902                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3903                                                 kprintf("Help I have fallen and I can't get up!\n");
3904                                         }
3905 #endif
3906                                         continue;
3907                                 }
3908                                 if (laddr->ifa->ifa_addr == NULL)
3909                                         continue;
3910                                 if (sctp_is_address_in_scope(laddr->ifa,
3911                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3912                                     stc.loopback_scope, stc.ipv4_scope,
3913                                     stc.local_scope, stc.site_scope) == 0) {
3914                                         continue;
3915                                 }
3916                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3917                         }
3918                 }
3919         }
3920
3921         /* tack on the operational error if present */
3922         if (op_err) {
3923                 if (op_err->m_pkthdr.len % 4) {
3924                         /* must add a pad to the param */
3925                         u_int32_t cpthis=0;
3926                         int padlen;
3927                         padlen = 4 - (op_err->m_pkthdr.len % 4);
3928                         m_copyback(op_err, op_err->m_pkthdr.len, padlen, (caddr_t)&cpthis);
3929                 }
3930                 while (m_at->m_next != NULL) {
3931                         m_at = m_at->m_next;
3932                 }
3933                 m_at->m_next = op_err;
3934                 while (m_at->m_next != NULL) {
3935                         m_at = m_at->m_next;
3936                 }
3937         }
3938         /* Get total size of init packet */
3939         sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3940         /* pre-calulate the size and update pkt header and chunk header */
3941         m->m_pkthdr.len = 0;
3942         for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3943                 m->m_pkthdr.len += m_tmp->m_len;
3944                 if (m_tmp->m_next == NULL) {
3945                         /* m_tmp should now point to last one */
3946                         break;
3947                 }
3948         }
3949         /*
3950          * Figure now the size of the cookie. We know the size of the
3951          * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3952          * COOKIE-STRUCTURE and SIGNATURE.
3953          */
3954
3955         /*
3956          * take our earlier INIT calc and add in the sz we just calculated
3957          * minus the size of the sctphdr (its not included in chunk size
3958          */
3959
3960         /* add once for the INIT-ACK */
3961         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3962
3963         /* add a second time for the INIT-ACK in the cookie */
3964         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3965
3966         /* Now add the cookie header and cookie message struct */
3967         sz_of += sizeof(struct sctp_state_cookie_param);
3968         /* ...and add the size of our signature */
3969         sz_of += SCTP_SIGNATURE_SIZE;
3970         initackm_out->msg.ch.chunk_length = htons(sz_of);
3971
3972         /* Now we must build a cookie */
3973         m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3974             sizeof(struct sctphdr), &stc);
3975         if (m_cookie == NULL) {
3976                 /* memory problem */
3977                 sctp_m_freem(m);
3978                 return;
3979         }
3980         /* Now append the cookie to the end and update the space/size */
3981         m_tmp->m_next = m_cookie;
3982
3983         /*
3984          * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3985          * return here since the timer will drive a retranmission.
3986          */
3987         padval = m->m_pkthdr.len % 4;
3988         if ((padval) && (m_last)) {
3989                 /* see my previous comments on m_last */
3990                 int ret;
3991                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
3992                 if (ret) {
3993                         /* Houston we have a problem, no space */
3994                         sctp_m_freem(m);
3995                         return;
3996                 }
3997                 m->m_pkthdr.len += padval;
3998         }
3999         sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
4000 }
4001
4002
4003 static void
4004 sctp_insert_on_wheel(struct sctp_association *asoc,
4005                      struct sctp_stream_out *strq)
4006 {
4007         struct sctp_stream_out *stre, *strn;
4008         stre = TAILQ_FIRST(&asoc->out_wheel);
4009         if (stre == NULL) {
4010                 /* only one on wheel */
4011                 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
4012                 return;
4013         }
4014         for (; stre; stre = strn) {
4015                 strn = TAILQ_NEXT(stre, next_spoke);
4016                 if (stre->stream_no > strq->stream_no) {
4017                         TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
4018                         return;
4019                 } else if (stre->stream_no == strq->stream_no) {
4020                         /* huh, should not happen */
4021                         return;
4022                 } else if (strn == NULL) {
4023                         /* next one is null */
4024                         TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
4025                                            next_spoke);
4026                 }
4027         }
4028 }
4029
4030 static void
4031 sctp_remove_from_wheel(struct sctp_association *asoc,
4032                        struct sctp_stream_out *strq)
4033 {
4034         /* take off and then setup so we know it is not on the wheel */
4035         TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
4036         strq->next_spoke.tqe_next = NULL;
4037         strq->next_spoke.tqe_prev = NULL;
4038 }
4039
4040
4041 static void
4042 sctp_prune_prsctp(struct sctp_tcb *stcb,
4043                   struct sctp_association *asoc,
4044                   struct sctp_sndrcvinfo *srcv,
4045                   int dataout
4046         )
4047 {
4048         int freed_spc=0;
4049         struct sctp_tmit_chunk *chk, *nchk;
4050         if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
4051                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4052                         /*
4053                          * Look for chunks marked with the PR_SCTP
4054                          * flag AND the buffer space flag. If the one
4055                          * being sent is equal or greater priority then
4056                          * purge the old one and free some space.
4057                          */
4058                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4059                                            SCTP_PR_SCTP_BUFFER)) ==
4060                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4061                                 /*
4062                                  * This one is PR-SCTP AND buffer space
4063                                  * limited type
4064                                  */
4065                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4066                                         /* Lower numbers equates to
4067                                          * higher priority so if the
4068                                          * one we are looking at has a
4069                                          * larger or equal priority we
4070                                          * want to drop the data and
4071                                          * NOT retransmit it.
4072                                          */
4073                                         if (chk->data) {
4074                                                 /* We release the
4075                                                  * book_size if the
4076                                                  * mbuf is here
4077                                                  */
4078                                                 int ret_spc;
4079                                                 int cause;
4080                                                 if (chk->sent > SCTP_DATAGRAM_UNSENT)
4081                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
4082                                                 else
4083                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
4084                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4085                                                                                       cause,
4086                                                                                       &asoc->sent_queue);
4087                                                 freed_spc += ret_spc;
4088                                                 if (freed_spc >= dataout) {
4089                                                         return;
4090                                                 }
4091                                         } /* if chunk was present */
4092                                 } /* if of sufficent priority */
4093                         } /* if chunk has enabled */
4094                 } /* tailqforeach */
4095
4096                 chk = TAILQ_FIRST(&asoc->send_queue);
4097                 while (chk) {
4098                         nchk = TAILQ_NEXT(chk, sctp_next);
4099                         /* Here we must move to the sent queue and mark */
4100                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4101                                            SCTP_PR_SCTP_BUFFER)) ==
4102                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4103                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4104                                         if (chk->data) {
4105                                                 /* We release the
4106                                                  * book_size if the
4107                                                  * mbuf is here
4108                                                  */
4109                                                 int ret_spc;
4110                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4111                                                     SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
4112                                                     &asoc->send_queue);
4113
4114                                                 freed_spc += ret_spc;
4115                                                 if (freed_spc >= dataout) {
4116                                                         return;
4117                                                 }
4118                                         } /* end if chk->data */
4119                                 } /* end if right class */
4120                         } /* end if chk pr-sctp */
4121                         chk = nchk;
4122                 } /* end while (chk) */
4123         } /* if enabled in asoc */
4124 }
4125
4126 static void
4127 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4128                    struct sctp_tcb *stcb,
4129                    struct sctp_sndrcvinfo *srcv,
4130                    struct sctp_stream_out *strq,
4131                    struct sctp_nets *net)
4132 {
4133         bzero(template, sizeof(struct sctp_tmit_chunk));
4134         template->sent = SCTP_DATAGRAM_UNSENT;
4135         if ((stcb->asoc.peer_supports_prsctp) &&
4136             (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4137             (srcv->sinfo_timetolive > 0)
4138                 ) {
4139                 /* If:
4140                  *  Peer supports PR-SCTP
4141                  *  The flags is set against this send for PR-SCTP
4142                  *  And timetolive is a postive value, zero is reserved
4143                  *     to mean a reliable send for both buffer/time
4144                  *     related one.
4145                  */
4146                 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4147                         /*
4148                          * Time to live is a priority stored in tv_sec
4149                          * when doing the buffer drop thing.
4150                          */
4151                         template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4152                 } else {
4153                         struct timeval tv;
4154
4155                         SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4156                         tv.tv_sec = srcv->sinfo_timetolive / 1000;
4157                         tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4158 #ifndef __FreeBSD__
4159                         timeradd(&template->rec.data.timetodrop, &tv,
4160                             &template->rec.data.timetodrop);
4161 #else
4162                         timevaladd(&template->rec.data.timetodrop, &tv);
4163 #endif
4164                 }
4165         }
4166         if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4167                 template->rec.data.stream_seq = strq->next_sequence_sent;
4168         } else {
4169                 template->rec.data.stream_seq = 0;
4170         }
4171         template->rec.data.TSN_seq = 0; /* not yet assigned */
4172
4173         template->rec.data.stream_number = srcv->sinfo_stream;
4174         template->rec.data.payloadtype = srcv->sinfo_ppid;
4175         template->rec.data.context = srcv->sinfo_context;
4176         template->rec.data.doing_fast_retransmit = 0;
4177         template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4178
4179         if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4180                 template->whoTo = net;
4181         } else {
4182                 if (stcb->asoc.primary_destination)
4183                         template->whoTo = stcb->asoc.primary_destination;
4184                 else {
4185                         /* TSNH */
4186                         template->whoTo = net;
4187                 }
4188         }
4189         /* the actual chunk flags */
4190         if (srcv->sinfo_flags & MSG_UNORDERED) {
4191                 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4192         } else {
4193                 template->rec.data.rcv_flags = 0;
4194         }
4195         /* no flags yet, FRAGMENT_OK goes here */
4196         template->flags = 0;
4197         /* PR sctp flags */
4198         if (stcb->asoc.peer_supports_prsctp) {
4199                 if (srcv->sinfo_timetolive > 0) {
4200                         /*
4201                          * We only set the flag if timetolive (or
4202                          * priority) was set to a positive number.
4203                          * Zero is reserved specifically to be
4204                          * EXCLUDED and sent reliable.
4205                          */
4206                         if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4207                                 template->flags |= SCTP_PR_SCTP_ENABLED;
4208                         }
4209                         if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4210                                 template->flags |= SCTP_PR_SCTP_BUFFER;
4211                         }
4212                 }
4213         }
4214         template->asoc = &stcb->asoc;
4215 }
4216
4217
4218 int
4219 sctp_get_frag_point(struct sctp_tcb *stcb,
4220                     struct sctp_association *asoc)
4221 {
4222         int siz, ovh;
4223
4224         /* For endpoints that have both 6 and 4 addresses
4225          * we must reserver room for the 6 ip header, for
4226          * those that are only dealing with V4 we use
4227          * a larger frag point.
4228          */
4229         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4230                 ovh = SCTP_MED_OVERHEAD;
4231         } else {
4232                 ovh = SCTP_MED_V4_OVERHEAD;
4233         }
4234
4235         if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4236                 siz = asoc->smallest_mtu - ovh;
4237         else
4238                 siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4239 /*
4240   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4241                 /* A data chunk MUST fit in a cluster */
4242 /*              siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4243 /*      }*/
4244
4245         if (siz % 4) {
4246                 /* make it an even word boundary please */
4247                 siz -= (siz % 4);
4248         }
4249         return (siz);
4250 }
4251 extern unsigned int sctp_max_chunks_on_queue;
4252
4253 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4254
4255 static int
4256 sctp_msg_append(struct sctp_tcb *stcb,
4257                 struct sctp_nets *net,
4258                 struct mbuf *m,
4259                 struct sctp_sndrcvinfo *srcv,
4260                 int flags)
4261 {
4262         struct socket *so;
4263         struct sctp_association *asoc;
4264         struct sctp_stream_out *strq;
4265         struct sctp_tmit_chunk *chk;
4266         struct sctpchunk_listhead tmp;
4267         struct sctp_tmit_chunk template;
4268         struct mbuf *n, *mnext;
4269         struct mbuf *mm;
4270         unsigned int dataout, siz;
4271         int mbcnt = 0;
4272         int mbcnt_e = 0;
4273         int error = 0;
4274
4275         if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4276                 /* Software fault, you blew it on the call */
4277 #ifdef SCTP_DEBUG
4278                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4279                         kprintf("software error in sctp_msg_append:1\n");
4280                         kprintf("stcb:%p net:%p m:%p srcv:%p\n",
4281                                stcb, net, m, srcv);
4282                 }
4283 #endif
4284                 if (m)
4285                         sctp_m_freem(m);
4286                 return (EFAULT);
4287         }
4288         so = stcb->sctp_socket;
4289         asoc = &stcb->asoc;
4290         if (srcv->sinfo_flags & MSG_ABORT) {
4291                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4292                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4293                         /* It has to be up before we abort */
4294                         /* how big is the user initiated abort? */
4295                         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4296                                 dataout = m->m_pkthdr.len;
4297                         } else {
4298                                 /* we must count */
4299                                 dataout = 0;
4300                                 for (n = m; n; n = n->m_next) {
4301                                         dataout += n->m_len;
4302                                 }
4303                         }
4304                         M_PREPEND(m, sizeof(struct sctp_paramhdr), MB_DONTWAIT);
4305                         if (m) {
4306                                 struct sctp_paramhdr *ph;
4307                                 m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4308                                 ph = mtod(m, struct sctp_paramhdr *);
4309                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4310                                 ph->param_length = htons(m->m_len);
4311                         }
4312                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4313                         m = NULL;
4314                 } else {
4315                         /* Only free if we don't send an abort */
4316                         ;
4317                 }
4318                 goto out;
4319         }
4320         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4321             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4322             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4323             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4324                 /* got data while shutting down */
4325                 error = ECONNRESET;
4326                 goto out;
4327         }
4328
4329         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4330                 /* Invalid stream number */
4331                 error = EINVAL;
4332                 goto out;
4333         }
4334         if (asoc->strmout == NULL) {
4335                 /* huh? software error */
4336 #ifdef SCTP_DEBUG
4337                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4338                         kprintf("software error in sctp_msg_append:2\n");
4339                 }
4340 #endif
4341                 error = EFAULT;
4342                 goto out;
4343         }
4344         strq = &asoc->strmout[srcv->sinfo_stream];
4345         /* how big is it ? */
4346         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4347                 dataout = m->m_pkthdr.len;
4348         } else {
4349                 /* we must count */
4350                 dataout = 0;
4351                 for (n = m; n; n = n->m_next) {
4352                         dataout += n->m_len;
4353                 }
4354         }
4355 #ifdef SCTP_DEBUG
4356         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4357                 kprintf("Attempt to send out %d bytes\n",
4358                        dataout);
4359         }
4360 #endif
4361
4362         /* lock the socket buf */
4363         SOCKBUF_LOCK(&so->so_snd);
4364         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
4365         if (error)
4366                 goto out_locked;
4367
4368         if (dataout > so->so_snd.ssb_hiwat) {
4369                 /* It will NEVER fit */
4370                 error = EMSGSIZE;
4371                 goto release;
4372         }
4373         if ((srcv->sinfo_flags & MSG_EOF) &&
4374             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4375             (dataout == 0)
4376                 ) {
4377                 goto zap_by_it_all;
4378         }
4379         if ((so->so_snd.ssb_hiwat <
4380              (dataout + asoc->total_output_queue_size)) ||
4381             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4382             (asoc->total_output_mbuf_queue_size >
4383              so->so_snd.ssb_mbmax)
4384                 ) {
4385                 /* XXX Buffer space hunt for data to skip */
4386                 if (asoc->peer_supports_prsctp) {
4387                         sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4388                 }
4389                 while ((so->so_snd.ssb_hiwat <
4390                     (dataout + asoc->total_output_queue_size)) ||
4391                     (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4392                     (asoc->total_output_mbuf_queue_size >
4393                     so->so_snd.ssb_mbmax)) {
4394                         struct sctp_inpcb *inp;
4395                         /* Now did we free up enough room? */
4396                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
4397                                 /* Non-blocking io in place */
4398                                 error = EWOULDBLOCK;
4399                                 goto release;
4400                         }
4401                         /*
4402                          * We store off a pointer to the endpoint.
4403                          * Since on return from this we must check to
4404                          * see if an so_error is set. If so we may have
4405                          * been reset and our stcb destroyed. Returning
4406                          * an error will cause the correct error return
4407                          * through and fix this all.
4408                          */
4409                         inp = stcb->sctp_ep;
4410                         /*
4411                          * Not sure how else to do this since
4412                          * the level we suspended at is not
4413                          * known deep down where we are. I will
4414                          * drop to spl0() so that others can
4415                          * get in.
4416                          */
4417
4418                         inp->sctp_tcb_at_block = (void *)stcb;
4419                         inp->error_on_block = 0;
4420                         ssb_unlock(&so->so_snd);
4421                         error = ssb_wait(&so->so_snd);
4422                         /*
4423                          * XXX: This is ugly but I have
4424                          * recreated most of what goes on to
4425                          * block in the sb. UGHH
4426                          * May want to add the bit about being
4427                          * no longer connected.. but this then
4428                          * further dooms the UDP model NOT to
4429                          * allow this.
4430                          */
4431                         inp->sctp_tcb_at_block = 0;
4432                         if (inp->error_on_block)
4433                                 error = inp->error_on_block;
4434                         if (so->so_error)
4435                                 error = so->so_error;
4436                         if (error) {
4437                                 goto out_locked;
4438                         }
4439                         error = ssb_lock(&so->so_snd, M_WAITOK);
4440                         if (error)
4441                                 goto out_locked;
4442                         /* Otherwise we cycle back and recheck
4443                          * the space
4444                          */
4445 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4446                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4447 #else
4448                         if (so->so_state & SS_CANTSENDMORE) {
4449 #endif
4450                                 error = EPIPE;
4451                                 goto release;
4452                         }
4453                         if (so->so_error) {
4454                                 error = so->so_error;
4455                                 goto release;
4456                         }
4457                 }
4458         }
4459         /* If we have a packet header fix it if it was broke */
4460         if (m->m_flags & M_PKTHDR) {
4461                 m->m_pkthdr.len = dataout;
4462         }
4463         /* use the smallest one, user set value or
4464          * smallest mtu of the asoc
4465          */
4466         siz = sctp_get_frag_point(stcb, asoc);
4467         SOCKBUF_UNLOCK(&so->so_snd);
4468         if ((dataout) && (dataout <= siz)) {
4469                 /* Fast path */
4470                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4471                 if (chk == NULL) {
4472                         error = ENOMEM;
4473                         SOCKBUF_LOCK(&so->so_snd);
4474                         goto release;
4475                 }
4476                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4477                 chk->whoTo->ref_count++;
4478                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4479
4480                 /* no flags yet, FRAGMENT_OK goes here */
4481                 sctppcbinfo.ipi_count_chunk++;
4482                 sctppcbinfo.ipi_gencnt_chunk++;
4483                 asoc->chunks_on_out_queue++;
4484                 chk->data = m;
4485                 m = NULL;
4486                 /* Total in the MSIZE */
4487                 for (mm = chk->data; mm; mm = mm->m_next) {
4488                         mbcnt += MSIZE;
4489                         if (mm->m_flags & M_EXT) {
4490                                 mbcnt += chk->data->m_ext.ext_size;
4491                         }
4492                 }
4493                 /* fix up the send_size if it is not present */
4494                 chk->send_size = dataout;
4495                 chk->book_size = chk->send_size;
4496                 chk->mbcnt = mbcnt;
4497                 /* ok, we are commited */
4498                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4499                         /* bump the ssn if we are unordered. */
4500                         strq->next_sequence_sent++;
4501                 }
4502                 chk->data->m_nextpkt = 0;
4503                 asoc->stream_queue_cnt++;
4504                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4505                 /* now check if this stream is on the wheel */
4506                 if ((strq->next_spoke.tqe_next == NULL) &&
4507                     (strq->next_spoke.tqe_prev == NULL)) {
4508                         /* Insert it on the wheel since it is not
4509                          * on it currently
4510                          */
4511                         sctp_insert_on_wheel(asoc, strq);
4512                 }
4513         } else if ((dataout) && (dataout > siz)) {
4514                 /* Slow path */
4515                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4516                     (dataout > siz)) {
4517                         error = EMSGSIZE;
4518                         SOCKBUF_LOCK(&so->so_snd);
4519                         goto release;
4520                 }
4521                 /* setup the template */
4522                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4523
4524                 n = m;
4525                 while (dataout > siz) {
4526                         /*
4527                          * We can wait since this is called from the user
4528                          * send side
4529                          */
4530                         n->m_nextpkt = m_split(n, siz, MB_WAIT);
4531                         if (n->m_nextpkt == NULL) {
4532                                 error = EFAULT;
4533                                 SOCKBUF_LOCK(&so->so_snd);
4534                                 goto release;
4535                         }
4536                         dataout -= siz;
4537                         n = n->m_nextpkt;
4538                 }
4539                 /*
4540                  * ok, now we have a chain on m where m->m_nextpkt points to
4541                  * the next chunk and m/m->m_next chain is the piece to send.
4542                  * We must go through the chains and thread them on to
4543                  * sctp_tmit_chunk chains and place them all on the stream
4544                  * queue, breaking the m->m_nextpkt pointers as we go.
4545                  */
4546                 n = m;
4547                 TAILQ_INIT(&tmp);
4548                 while (n) {
4549                         /*
4550                          * first go through and allocate a sctp_tmit chunk
4551                          * for each chunk piece
4552                          */
4553                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4554                         if (chk == NULL) {
4555                                 /*
4556                                  * ok we must spin through and dump anything
4557                                  * we have allocated and then jump to the
4558                                  * no_membad
4559                                  */
4560                                 chk = TAILQ_FIRST(&tmp);
4561                                 while (chk) {
4562                                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4563                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4564                                         sctppcbinfo.ipi_count_chunk--;
4565                                         asoc->chunks_on_out_queue--;
4566                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4567                                                 panic("Chunk count is negative");
4568                                         }
4569                                         sctppcbinfo.ipi_gencnt_chunk++;
4570                                         chk = TAILQ_FIRST(&tmp);
4571                                 }
4572                                 error = ENOMEM;
4573                                 SOCKBUF_LOCK(&so->so_snd);
4574                                 goto release;
4575                         }
4576                         sctppcbinfo.ipi_count_chunk++;
4577                         asoc->chunks_on_out_queue++;
4578
4579                         sctppcbinfo.ipi_gencnt_chunk++;
4580                         *chk = template;
4581                         chk->whoTo->ref_count++;
4582                         chk->data = n;
4583                         /* Total in the MSIZE */
4584                         mbcnt_e = 0;
4585                         for (mm = chk->data; mm; mm = mm->m_next) {
4586                                 mbcnt_e += MSIZE;
4587                                 if (mm->m_flags & M_EXT) {
4588                                         mbcnt_e += chk->data->m_ext.ext_size;
4589                                 }
4590                         }
4591                         /* now fix the chk->send_size */
4592                         if (chk->data->m_flags & M_PKTHDR) {
4593                                 chk->send_size = chk->data->m_pkthdr.len;
4594                         } else {
4595                                 struct mbuf *nn;
4596                                 chk->send_size = 0;
4597                                 for (nn = chk->data; nn; nn = nn->m_next) {
4598                                         chk->send_size += nn->m_len;
4599                                 }
4600                         }
4601                         chk->book_size = chk->send_size;
4602                         chk->mbcnt = mbcnt_e;
4603                         mbcnt += mbcnt_e;
4604                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4605                                 asoc->sent_queue_cnt_removeable++;
4606                         }
4607                         n = n->m_nextpkt;
4608                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4609                 }
4610                 m = NULL;
4611                 /* now that we have enough space for all de-couple the
4612                  * chain of mbufs by going through our temp array
4613                  * and breaking the pointers.
4614                  */
4615                 /* ok, we are commited */
4616                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4617                         /* bump the ssn if we are unordered. */
4618                         strq->next_sequence_sent++;
4619                 }
4620                 /* Mark the first/last flags. This will
4621                  * result int a 3 for a single item on the list
4622                  */
4623                 chk = TAILQ_FIRST(&tmp);
4624                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4625                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4626                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4627                 /* now break any chains on the queue and
4628                  * move it to the streams actual queue.
4629                  */
4630                 chk = TAILQ_FIRST(&tmp);
4631                 while (chk) {
4632                         chk->data->m_nextpkt = 0;
4633                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4634                         asoc->stream_queue_cnt++;
4635                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4636                         chk = TAILQ_FIRST(&tmp);
4637                 }
4638                 /* now check if this stream is on the wheel */
4639                 if ((strq->next_spoke.tqe_next == NULL) &&
4640                     (strq->next_spoke.tqe_prev == NULL)) {
4641                         /* Insert it on the wheel since it is not
4642                          * on it currently
4643                          */
4644                         sctp_insert_on_wheel(asoc, strq);
4645                 }
4646         }
4647         SOCKBUF_LOCK(&so->so_snd);
4648         /* has a SHUTDOWN been (also) requested by the user on this asoc? */
4649 zap_by_it_all:
4650
4651         if ((srcv->sinfo_flags & MSG_EOF) &&
4652             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4653
4654                 int some_on_streamwheel = 0;
4655
4656                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4657                         /* Check to see if some data queued */
4658                         struct sctp_stream_out *outs;
4659                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4660                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
4661                                         some_on_streamwheel = 1;
4662                                         break;
4663                                 }
4664                         }
4665                 }
4666
4667                 if (TAILQ_EMPTY(&asoc->send_queue) &&
4668                     TAILQ_EMPTY(&asoc->sent_queue) &&
4669                     (some_on_streamwheel == 0)) {
4670                         /* there is nothing queued to send, so I'm done... */
4671                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4672                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4673                                 /* only send SHUTDOWN the first time through */
4674 #ifdef SCTP_DEBUG
4675                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4676                                         kprintf("%s:%d sends a shutdown\n",
4677                                                __FILE__,
4678                                                __LINE__
4679                                                 );
4680                                 }
4681 #endif
4682                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4683                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4684                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4685                                                  asoc->primary_destination);
4686                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4687                                                  asoc->primary_destination);
4688                         }
4689                 } else {
4690                         /*
4691                          * we still got (or just got) data to send, so set
4692                          * SHUTDOWN_PENDING
4693                          */
4694                         /*
4695                          * XXX sockets draft says that MSG_EOF should be sent
4696                          * with no data.  currently, we will allow user data
4697                          * to be sent first and move to SHUTDOWN-PENDING
4698                          */
4699                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4700                 }
4701         }
4702 #ifdef SCTP_MBCNT_LOGGING
4703         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4704                        asoc->total_output_queue_size,
4705                        dataout,
4706                        asoc->total_output_mbuf_queue_size,
4707                        mbcnt);
4708 #endif
4709         asoc->total_output_queue_size += dataout;
4710         asoc->total_output_mbuf_queue_size += mbcnt;
4711         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4712             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4713                 so->so_snd.ssb_cc += dataout;
4714                 so->so_snd.ssb_mbcnt += mbcnt;
4715         }
4716
4717 #ifdef SCTP_DEBUG
4718         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4719                 kprintf("++total out:%d total_mbuf_out:%d\n",
4720                        (int)asoc->total_output_queue_size,
4721                        (int)asoc->total_output_mbuf_queue_size);
4722         }
4723 #endif
4724
4725 release:
4726         ssb_unlock(&so->so_snd);
4727 out_locked:
4728         SOCKBUF_UNLOCK(&so->so_snd);
4729 out:
4730         if (m && m->m_nextpkt) {
4731                 n = m;
4732                 while (n) {
4733                         mnext = n->m_nextpkt;
4734                         n->m_nextpkt = NULL;
4735                         sctp_m_freem(n);
4736                         n = mnext;
4737                 }
4738         } else if (m)
4739                 sctp_m_freem(m);
4740
4741         return (error);
4742 }
4743
4744 static struct mbuf *
4745 sctp_copy_mbufchain(struct mbuf *clonechain,
4746                     struct mbuf *outchain)
4747 {
4748         struct mbuf *appendchain;
4749 #if defined(__FreeBSD__) || defined(__NetBSD__)
4750         /* Supposedly m_copypacket is an optimization, use it if we can */
4751         if (clonechain->m_flags & M_PKTHDR) {
4752                 appendchain = m_copypacket(clonechain, MB_DONTWAIT);
4753                 sctp_pegs[SCTP_CACHED_SRC]++;
4754         } else
4755                 appendchain = m_copy(clonechain, 0, M_COPYALL);
4756 #elif defined(__APPLE__)
4757         appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, MB_DONTWAIT);
4758 #else
4759         appendchain = m_copy(clonechain, 0, M_COPYALL);
4760 #endif
4761
4762         if (appendchain == NULL) {
4763                 /* error */
4764                 if (outchain)
4765                         sctp_m_freem(outchain);
4766                 return (NULL);
4767         }
4768         if (outchain) {
4769                 /* tack on to the end */
4770                 struct mbuf *m;
4771                 m = outchain;
4772                 while (m) {
4773                         if (m->m_next == NULL) {
4774                                 m->m_next = appendchain;
4775                                 break;
4776                         }
4777                         m = m->m_next;
4778                 }
4779                 if (outchain->m_flags & M_PKTHDR) {
4780                         int append_tot;
4781                         struct mbuf *t;
4782                         t = appendchain;
4783                         append_tot = 0;
4784                         while (t) {
4785                                 append_tot += t->m_len;
4786                                 t = t->m_next;
4787                         }
4788                         outchain->m_pkthdr.len += append_tot;
4789                 }
4790                 return (outchain);
4791         } else {
4792                 return (appendchain);
4793         }
4794 }
4795
4796 static void
4797 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4798 {
4799         struct sctp_copy_all *ca;
4800         struct mbuf *m;
4801         int ret;
4802
4803         ca = (struct sctp_copy_all *)ptr;
4804         if (ca->m == NULL) {
4805                 return;
4806         }
4807         if (ca->inp != inp) {
4808                 /* TSNH */
4809                 return;
4810         }
4811         m = sctp_copy_mbufchain(ca->m, NULL);
4812         if (m == NULL) {
4813                 /* can't copy so we are done */
4814                 ca->cnt_failed++;
4815                 return;
4816         }
4817         ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
4818                               &ca->sndrcv, MSG_FNONBLOCKING);
4819         if (ret) {
4820                 ca->cnt_failed++;
4821         } else {
4822                 ca->cnt_sent++;
4823         }
4824 }
4825
4826 static void
4827 sctp_sendall_completes(void *ptr, u_int32_t val)
4828 {
4829         struct sctp_copy_all *ca;
4830         ca = (struct sctp_copy_all *)ptr;
4831         /* Do a notify here?
4832          * Kacheong suggests that the notify
4833          * be done at the send time.. so you would
4834          * push up a notification if any send failed.
4835          * Don't know if this is feasable since the
4836          * only failures we have is "memory" related and
4837          * if you cannot get an mbuf to send the data
4838          * you surely can't get an mbuf to send up
4839          * to notify the user you can't send the data :->
4840          */
4841
4842         /* now free everything */
4843         m_freem(ca->m);
4844         kfree(ca, M_PCB);
4845 }
4846
4847
4848 #define MC_ALIGN(m, len) do {                                           \
4849         (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);                \
4850 } while (0)
4851
4852
4853
4854 static struct mbuf *
4855 sctp_copy_out_all(struct uio *uio, int len)
4856 {
4857         struct mbuf *ret, *at;
4858         int left, willcpy, cancpy, error;
4859
4860         MGETHDR(ret, MB_WAIT, MT_HEADER);
4861         if (ret == NULL) {
4862                 /* TSNH */
4863                 return (NULL);
4864         }
4865         left = len;
4866         ret->m_len = 0;
4867         ret->m_pkthdr.len = len;
4868         MCLGET(ret, MB_WAIT);
4869         if (ret == NULL) {
4870                 return (NULL);
4871         }
4872         if ((ret->m_flags & M_EXT) == 0) {
4873                 m_freem (ret);
4874                 return (NULL);
4875         }
4876         cancpy = M_TRAILINGSPACE(ret);
4877         willcpy = min(cancpy, left);
4878         at = ret;
4879         while (left > 0) {
4880                 /* Align data to the end */
4881                 MC_ALIGN(at, willcpy);
4882                 error = uiomove(mtod(at, caddr_t), willcpy, uio);
4883                 if (error) {
4884                 err_out_now:
4885                         m_freem(ret);
4886                         return (NULL);
4887                 }
4888                 at->m_len = willcpy;
4889                 at->m_nextpkt = at->m_next = 0;
4890                 left -= willcpy;
4891                 if (left > 0) {
4892                         MGET(at->m_next, MB_WAIT, MT_DATA);
4893                         if (at->m_next == NULL) {
4894                                 goto err_out_now;
4895                         }
4896                         at = at->m_next;
4897                         at->m_len = 0;
4898                         MCLGET(at, MB_WAIT);
4899                         if (at == NULL) {
4900                                 goto err_out_now;
4901                         }
4902                         if ((at->m_flags & M_EXT) == 0) {
4903                                 goto err_out_now;
4904                         }
4905                         cancpy = M_TRAILINGSPACE(at);
4906                         willcpy = min(cancpy, left);
4907                 }
4908         }
4909         return (ret);
4910 }
4911
4912 static int
4913 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4914 {
4915         int ret;
4916         struct sctp_copy_all *ca;
4917         ca = kmalloc(sizeof(struct sctp_copy_all), M_PCB, M_NOWAIT);
4918         if (ca == NULL) {
4919                 m_freem(m);
4920                 return (ENOMEM);
4921         }
4922         memset (ca, 0, sizeof(struct sctp_copy_all));
4923
4924         ca->inp = inp;
4925         ca->sndrcv = *srcv;
4926         /* take off the sendall flag, it would
4927          * be bad if we failed to do this  :-0
4928          */
4929         ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4930
4931         /* get length and mbuf chain */
4932         if (uio) {
4933                 ca->sndlen = uio->uio_resid;
4934                 ca->m = sctp_copy_out_all(uio, ca->sndlen);
4935                 if (ca->m == NULL) {
4936                         kfree(ca, M_PCB);
4937                         return (ENOMEM);
4938                 }
4939         } else {
4940                 if ((m->m_flags & M_PKTHDR) == 0) {
4941                         ca->sndlen = 0;
4942                         while(m) {
4943                                 ca->sndlen += m->m_len;
4944                                 m = m->m_next;
4945                         }
4946                 } else {
4947                         ca->sndlen = m->m_pkthdr.len;
4948                 }
4949                 ca->m = m;
4950         }
4951
4952         ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4953                                      (void *)ca, 0, sctp_sendall_completes, inp);
4954         if (ret) {
4955 #ifdef SCTP_DEBUG
4956                 kprintf("Failed to initate iterator to takeover associations\n");
4957 #endif
4958                 kfree(ca, M_PCB);
4959                 return (EFAULT);
4960
4961         }
4962         return (0);
4963 }
4964
4965
4966 void
4967 sctp_toss_old_cookies(struct sctp_association *asoc)
4968 {
4969         struct sctp_tmit_chunk *chk, *nchk;
4970         chk = TAILQ_FIRST(&asoc->control_send_queue);
4971         while (chk) {
4972                 nchk = TAILQ_NEXT(chk, sctp_next);
4973                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4974                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4975                         if (chk->data) {
4976                                 sctp_m_freem(chk->data);
4977                                 chk->data = NULL;
4978                         }
4979                         asoc->ctrl_queue_cnt--;
4980                         if (chk->whoTo)
4981                                 sctp_free_remote_addr(chk->whoTo);
4982                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4983                         sctppcbinfo.ipi_count_chunk--;
4984                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4985                                 panic("Chunk count is negative");
4986                         }
4987                         sctppcbinfo.ipi_gencnt_chunk++;
4988                 }
4989                 chk = nchk;
4990         }
4991 }
4992
4993 void
4994 sctp_toss_old_asconf(struct sctp_tcb *stcb)
4995 {
4996         struct sctp_association *asoc;
4997         struct sctp_tmit_chunk *chk, *chk_tmp;
4998
4999         asoc = &stcb->asoc;
5000         for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
5001              chk = chk_tmp) {
5002                 /* get next chk */
5003                 chk_tmp = TAILQ_NEXT(chk, sctp_next);
5004                 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */
5005                 if (chk->rec.chunk_id == SCTP_ASCONF) {
5006                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5007                         if (chk->data) {
5008                                 sctp_m_freem(chk->data);
5009                                 chk->data = NULL;
5010                         }
5011                         asoc->ctrl_queue_cnt--;
5012                         if (chk->whoTo)
5013                                 sctp_free_remote_addr(chk->whoTo);
5014                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5015                         sctppcbinfo.ipi_count_chunk--;
5016                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5017                                 panic("Chunk count is negative");
5018                         }
5019                         sctppcbinfo.ipi_gencnt_chunk++;
5020                 }
5021         }
5022 }
5023
5024
5025 static void
5026 sctp_clean_up_datalist(struct sctp_tcb *stcb,
5027                        struct sctp_association *asoc,
5028                        struct sctp_tmit_chunk **data_list,
5029                        int bundle_at,
5030                        struct sctp_nets *net)
5031 {
5032         int i;
5033         for (i = 0; i < bundle_at; i++) {
5034                 /* off of the send queue */
5035                 if (i) {
5036                         /* Any chunk NOT 0 you zap the time
5037                          * chunk 0 gets zapped or set based on
5038                          * if a RTO measurment is needed.
5039                          */
5040                         data_list[i]->do_rtt = 0;
5041                 }
5042                 /* record time */
5043                 data_list[i]->sent_rcv_time = net->last_sent_time;
5044                 TAILQ_REMOVE(&asoc->send_queue,
5045                              data_list[i],
5046                              sctp_next);
5047                 /* on to the sent queue */
5048                 TAILQ_INSERT_TAIL(&asoc->sent_queue,
5049                                   data_list[i],
5050                                   sctp_next);
5051                 /* This does not lower until the cum-ack passes it */
5052                 asoc->sent_queue_cnt++;
5053                 asoc->send_queue_cnt--;
5054                 if ((asoc->peers_rwnd <= 0) &&
5055                     (asoc->total_flight == 0) &&
5056                     (bundle_at == 1)) {
5057                         /* Mark the chunk as being a window probe */
5058 #ifdef SCTP_DEBUG
5059                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
5060                                 kprintf("WINDOW PROBE SET\n");
5061                         }
5062 #endif
5063                         sctp_pegs[SCTP_WINDOW_PROBES]++;
5064                         data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
5065                 } else {
5066                         data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
5067                 }
5068 #ifdef SCTP_AUDITING_ENABLED
5069                 sctp_audit_log(0xC2, 3);
5070 #endif
5071                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
5072                 data_list[i]->snd_count = 1;
5073                 net->flight_size += data_list[i]->book_size;
5074                 asoc->total_flight += data_list[i]->book_size;
5075                 asoc->total_flight_count++;
5076 #ifdef SCTP_LOG_RWND
5077                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
5078                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
5079 #endif
5080                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
5081                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
5082                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5083                         /* SWS sender side engages */
5084                         asoc->peers_rwnd = 0;
5085                 }
5086         }
5087 }
5088
5089 static void
5090 sctp_clean_up_ctl(struct sctp_association *asoc)
5091 {
5092         struct sctp_tmit_chunk *chk, *nchk;
5093         for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5094             chk; chk = nchk) {
5095                 nchk = TAILQ_NEXT(chk, sctp_next);
5096                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5097                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5098                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5099                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5100                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5101                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5102                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5103                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5104                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5105                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5106                         /* Stray chunks must be cleaned up */
5107                 clean_up_anyway:
5108                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5109                         if (chk->data) {
5110                                 sctp_m_freem(chk->data);
5111                                 chk->data = NULL;
5112                         }
5113                         asoc->ctrl_queue_cnt--;
5114                         sctp_free_remote_addr(chk->whoTo);
5115                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5116                         sctppcbinfo.ipi_count_chunk--;
5117                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5118                                 panic("Chunk count is negative");
5119                         }
5120                         sctppcbinfo.ipi_gencnt_chunk++;
5121                 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
5122                         struct sctp_stream_reset_req *strreq;
5123                         /* special handling, we must look into the param */
5124                         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
5125                         if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5126                                 goto clean_up_anyway;
5127                         }
5128                 }
5129         }
5130 }
5131
5132 static int
5133 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5134                       struct sctp_stream_out *strq)
5135 {
5136         /* Move from the stream to the send_queue keeping track of the total */
5137         struct sctp_association *asoc;
5138         int tot_moved = 0;
5139         int failed = 0;
5140         int padval;
5141         struct sctp_tmit_chunk *chk, *nchk;
5142         struct sctp_data_chunk *dchkh;
5143         struct sctpchunk_listhead tmp;
5144         struct mbuf *orig;
5145
5146         asoc = &stcb->asoc;
5147         TAILQ_INIT(&tmp);
5148         chk = TAILQ_FIRST(&strq->outqueue);
5149         while (chk) {
5150                 nchk = TAILQ_NEXT(chk, sctp_next);
5151                 /* now put in the chunk header */
5152                 orig = chk->data;
5153                 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), MB_DONTWAIT);
5154                 if (chk->data == NULL) {
5155                         /* HELP */
5156                         failed++;
5157                         break;
5158                 }
5159                 if (orig != chk->data) {
5160                         /* A new mbuf was added, account for it */
5161                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5162                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5163                                 stcb->sctp_socket->so_snd.ssb_mbcnt += MSIZE;
5164                         }
5165 #ifdef SCTP_MBCNT_LOGGING
5166                         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5167                                        asoc->total_output_queue_size,
5168                                        0,
5169                                        asoc->total_output_mbuf_queue_size,
5170                                        MSIZE);
5171 #endif
5172                         stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5173                         chk->mbcnt += MSIZE;
5174                 }
5175                 chk->send_size += sizeof(struct sctp_data_chunk);
5176                 /* This should NOT have to do anything, but
5177                  * I would rather be cautious
5178                  */
5179                 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5180                         m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5181                         if (chk->data == NULL) {
5182                                 failed++;
5183                                 break;
5184                         }
5185                 }
5186                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5187                 dchkh->ch.chunk_length = htons(chk->send_size);
5188                 /* Chunks must be padded to even word boundary */
5189                 padval = chk->send_size % 4;
5190                 if (padval) {
5191                         /* For fragmented messages this should not
5192                          * run except possibly on the last chunk
5193                          */
5194                         if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5195                                 /* we are in big big trouble no mbufs :< */
5196                                 failed++;
5197                                 break;
5198                         }
5199                         chk->send_size += (4 - padval);
5200                 }
5201                 /* pull from stream queue */
5202                 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5203                 asoc->stream_queue_cnt--;
5204                 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5205                 /* add it in to the size of moved chunks */
5206                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5207                         /* we pull only one message */
5208                         break;
5209                 }
5210                 chk = nchk;
5211         }
5212         if (failed) {
5213                 /* Gak, we just lost the user message */
5214                 chk = TAILQ_FIRST(&tmp);
5215                 while (chk) {
5216                         nchk = TAILQ_NEXT(chk, sctp_next);
5217                         TAILQ_REMOVE(&tmp, chk, sctp_next);
5218
5219                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5220                                         (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5221                                         chk);
5222
5223                         if (chk->data) {
5224                                 sctp_m_freem(chk->data);
5225                                 chk->data = NULL;
5226                         }
5227                         if (chk->whoTo) {
5228                                 sctp_free_remote_addr(chk->whoTo);
5229                                 chk->whoTo = NULL;
5230                         }
5231                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5232                         sctppcbinfo.ipi_count_chunk--;
5233                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5234                                 panic("Chunk count is negative");
5235                         }
5236                         sctppcbinfo.ipi_gencnt_chunk++;
5237                         chk = nchk;
5238                 }
5239                 return (0);
5240         }
5241         /* now pull them off of temp wheel */
5242         chk = TAILQ_FIRST(&tmp);
5243         while (chk) {
5244                 nchk = TAILQ_NEXT(chk, sctp_next);
5245                 /* insert on send_queue */
5246                 TAILQ_REMOVE(&tmp, chk, sctp_next);
5247                 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5248                 asoc->send_queue_cnt++;
5249                 /* assign TSN */
5250                 chk->rec.data.TSN_seq = asoc->sending_seq++;
5251
5252                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5253                 /* Put the rest of the things in place now. Size
5254                  * was done earlier in previous loop prior to
5255                  * padding.
5256                  */
5257                 dchkh->ch.chunk_type = SCTP_DATA;
5258                 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5259                 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5260                 dchkh->dp.stream_id = htons(strq->stream_no);
5261                 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5262                 dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5263                 /* total count moved */
5264                 tot_moved += chk->send_size;
5265                 chk = nchk;
5266         }
5267         return (tot_moved);
5268 }
5269
5270 static void
5271 sctp_fill_outqueue(struct sctp_tcb *stcb,
5272                    struct sctp_nets *net)
5273 {
5274         struct sctp_association *asoc;
5275         struct sctp_tmit_chunk *chk;
5276         struct sctp_stream_out *strq, *strqn;
5277         int mtu_fromwheel, goal_mtu;
5278         unsigned int moved, seenend, cnt_mvd=0;
5279
5280         asoc = &stcb->asoc;
5281         /* Attempt to move at least 1 MTU's worth
5282          * onto the wheel for each destination address
5283          */
5284         goal_mtu = net->cwnd - net->flight_size;
5285         if ((unsigned int)goal_mtu < net->mtu) {
5286                 goal_mtu = net->mtu;
5287         }
5288         if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5289                 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5290         }
5291         seenend = moved = mtu_fromwheel = 0;
5292         if (asoc->last_out_stream == NULL) {
5293                 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5294                 if (asoc->last_out_stream == NULL) {
5295                         /* huh nothing on the wheel, TSNH */
5296                         return;
5297                 }
5298                 goto done_it;
5299         }
5300         strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5301  done_it:
5302         if (strq == NULL) {
5303                 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5304         }
5305         while (mtu_fromwheel < goal_mtu) {
5306                 if (strq == NULL) {
5307                         if (seenend == 0) {
5308                                 seenend = 1;
5309                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5310                         } else if ((moved == 0) && (seenend)) {
5311                                 /* none left on the wheel */
5312                                 sctp_pegs[SCTP_MOVED_NLEF]++;
5313                                 return;
5314                         } else if (moved) {
5315                                 /*
5316                                  * clear the flags and rotate back through
5317                                  * again
5318                                  */
5319                                 moved = 0;
5320                                 seenend = 0;
5321                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5322                         }
5323                         if (strq == NULL)
5324                                 break;
5325                         continue;
5326                 }
5327                 strqn = TAILQ_NEXT(strq, next_spoke);
5328                 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5329                         /* none left on this queue, prune a spoke?  */
5330                         sctp_remove_from_wheel(asoc, strq);
5331                         if (strq == asoc->last_out_stream) {
5332                             /* the last one we used went off the wheel */
5333                             asoc->last_out_stream = NULL;
5334                         }
5335                         strq = strqn;
5336                         continue;
5337                 }
5338                 if (chk->whoTo != net) {
5339                         /* Skip this stream, first one on stream
5340                          * does not head to our current destination.
5341                          */
5342                         strq = strqn;
5343                         continue;
5344                 }
5345                 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5346                 cnt_mvd++;
5347                 moved++;
5348                 asoc->last_out_stream = strq;
5349                 strq = strqn;
5350         }
5351         sctp_pegs[SCTP_MOVED_MAX]++;
5352 #ifdef SCTP_DEBUG
5353         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5354                 kprintf("Ok we moved %d chunks to send queue\n",
5355                        moved);
5356         }
5357 #endif
5358         if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5359                 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5360         }
5361 }
5362
5363 void
5364 sctp_fix_ecn_echo(struct sctp_association *asoc)
5365 {
5366         struct sctp_tmit_chunk *chk;
5367         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5368                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5369                         chk->sent = SCTP_DATAGRAM_UNSENT;
5370                 }
5371         }
5372 }
5373
5374 static void
5375 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5376                     struct sctp_association *asoc,
5377                     struct sctp_nets *net)
5378 {
5379         struct sctp_tmit_chunk *chk;
5380         struct sctp_nets *a_net;
5381         a_net = sctp_find_alternate_net(stcb, net);
5382         if ((a_net != net) &&
5383             ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5384                 /*
5385                  * We only proceed if a valid alternate is found that is
5386                  * not this one and is reachable. Here we must move all
5387                  * chunks queued in the send queue off of the destination
5388                  * address to our alternate.
5389                  */
5390                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5391                         if (chk->whoTo == net) {
5392                                 /* Move the chunk to our alternate */
5393                                 sctp_free_remote_addr(chk->whoTo);
5394                                 chk->whoTo = a_net;
5395                                 a_net->ref_count++;
5396                         }
5397                 }
5398         }
5399 }
5400
5401 static int sctp_from_user_send=0;
5402
5403 static int
5404 sctp_med_chunk_output(struct sctp_inpcb *inp,
5405                       struct sctp_tcb *stcb,
5406                       struct sctp_association *asoc,
5407                       int *num_out,
5408                       int *reason_code,
5409                       int control_only, int *cwnd_full, int from_where,
5410                       struct timeval *now, int *now_filled)
5411 {
5412         /*
5413          * Ok this is the generic chunk service queue.
5414          * we must do the following:
5415          *  - Service the stream queue that is next, moving any message
5416          *    (note I must get a complete message i.e. FIRST/MIDDLE and
5417          *    LAST to the out queue in one pass) and assigning TSN's
5418          *  - Check to see if the cwnd/rwnd allows any output, if so we
5419          *    go ahead and fomulate and send the low level chunks. Making
5420          *    sure to combine any control in the control chunk queue also.
5421          */
5422         struct sctp_nets *net;
5423         struct mbuf *outchain;
5424         struct sctp_tmit_chunk *chk, *nchk;
5425         struct sctphdr *shdr;
5426         /* temp arrays for unlinking */
5427         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5428         int no_fragmentflg, error;
5429         int one_chunk, hbflag;
5430         int asconf, cookie, no_out_cnt;
5431         int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5432         unsigned int mtu, r_mtu, omtu;
5433         *num_out = 0;
5434         cwnd_full_ind = 0;
5435         ctl_cnt = no_out_cnt = asconf = cookie = 0;
5436         /*
5437          * First lets prime the pump. For each destination, if there
5438          * is room in the flight size, attempt to pull an MTU's worth
5439          * out of the stream queues into the general send_queue
5440          */
5441 #ifdef SCTP_AUDITING_ENABLED
5442         sctp_audit_log(0xC2, 2);
5443 #endif
5444 #ifdef SCTP_DEBUG
5445         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5446                 kprintf("***********************\n");
5447         }
5448 #endif
5449         hbflag = 0;
5450         if (control_only)
5451                 no_data_chunks = 1;
5452         else
5453                 no_data_chunks = 0;
5454
5455         /* Nothing to possible to send? */
5456         if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5457             TAILQ_EMPTY(&asoc->send_queue) &&
5458             TAILQ_EMPTY(&asoc->out_wheel)) {
5459 #ifdef SCTP_DEBUG
5460                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5461                         kprintf("All wheels empty\n");
5462                 }
5463 #endif
5464                 return (0);
5465         }
5466         if (asoc->peers_rwnd <= 0) {
5467                 /* No room in peers rwnd */
5468                 *cwnd_full = 1;
5469                 *reason_code = 1;
5470                 if (asoc->total_flight > 0) {
5471                         /* we are allowed one chunk in flight */
5472                         no_data_chunks = 1;
5473                         sctp_pegs[SCTP_RWND_BLOCKED]++;
5474                 }
5475         }
5476 #ifdef SCTP_DEBUG
5477         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5478                 kprintf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5479                        no_data_chunks,
5480                        (int)asoc->total_flight, (int)asoc->peers_rwnd);
5481         }
5482 #endif
5483         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5484 #ifdef SCTP_DEBUG
5485                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5486                         kprintf("net:%p fs:%d  cwnd:%d\n",
5487                                net, net->flight_size, net->cwnd);
5488                 }
5489 #endif
5490                 if (net->flight_size >= net->cwnd) {
5491                         /* skip this network, no room */
5492                         cwnd_full_ind++;
5493 #ifdef SCTP_DEBUG
5494                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5495                                 kprintf("Ok skip fillup->fs:%d > cwnd:%d\n",
5496                                        net->flight_size,
5497                                        net->cwnd);
5498                         }
5499 #endif
5500                         sctp_pegs[SCTP_CWND_NOFILL]++;
5501                         continue;
5502                 }
5503                 /*
5504                  * spin through the stream queues moving one message and
5505                  * assign TSN's as appropriate.
5506                  */
5507                 sctp_fill_outqueue(stcb, net);
5508         }
5509         *cwnd_full = cwnd_full_ind;
5510         /* now service each destination and send out what we can for it */
5511 #ifdef SCTP_DEBUG
5512         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5513                 int chk_cnt = 0;
5514                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5515                         chk_cnt++;
5516                 }
5517                 kprintf("We have %d chunks on the send_queue\n", chk_cnt);
5518                 chk_cnt = 0;
5519                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5520                         chk_cnt++;
5521                 }
5522                 kprintf("We have %d chunks on the sent_queue\n", chk_cnt);
5523                 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5524                         chk_cnt++;
5525                 }
5526                 kprintf("We have %d chunks on the control_queue\n", chk_cnt);
5527         }
5528 #endif
5529         /* If we have data to send, and DSACK is running, stop it
5530          * and build a SACK to dump on to bundle with output. This
5531          * actually MAY make it so the bundling does not occur if
5532          * the SACK is big but I think this is ok because basic SACK
5533          * space is pre-reserved in our fragmentation size choice.
5534          */
5535         if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5536             (no_data_chunks == 0)) {
5537                 /* We will be sending something */
5538                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5539                         /* Yep a callout is pending */
5540                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5541                                         stcb->sctp_ep,
5542                                         stcb, NULL);
5543                         sctp_send_sack(stcb);
5544                 }
5545         }
5546         /* Nothing to send? */
5547         if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5548             (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5549                 return (0);
5550         }
5551         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5552                 /* how much can we send? */
5553                 if (net->ref_count < 2) {
5554                         /* Ref-count of 1 so we cannot have data or control
5555                          * queued to this address. Skip it.
5556                          */
5557                         continue;
5558                 }
5559                 ctl_cnt = bundle_at = 0;
5560                 outchain = NULL;
5561                 no_fragmentflg = 1;
5562                 one_chunk = 0;
5563
5564                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5565                         mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5566                 } else {
5567                         mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5568                 }
5569                 if (mtu > asoc->peers_rwnd) {
5570                         if (asoc->total_flight > 0) {
5571                                 /* We have a packet in flight somewhere */
5572                                 r_mtu = asoc->peers_rwnd;
5573                         } else {
5574                                 /* We are always allowed to send one MTU out */
5575                                 one_chunk = 1;
5576                                 r_mtu = mtu;
5577                         }
5578                 } else {
5579                         r_mtu = mtu;
5580                 }
5581 #ifdef SCTP_DEBUG
5582                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5583                         kprintf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5584                                r_mtu, mtu, net, one_chunk);
5585                 }
5586 #endif
5587                 /************************/
5588                 /* Control transmission */
5589                 /************************/
5590                 /* Now first lets go through the control queue */
5591                 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5592                      chk; chk = nchk) {
5593                         nchk = TAILQ_NEXT(chk, sctp_next);
5594                         if (chk->whoTo != net) {
5595                                 /*
5596                                  * No, not sent to the network we are
5597                                  * looking at
5598                                  */
5599                                 continue;
5600                         }
5601                         if (chk->data == NULL) {
5602                                 continue;
5603                         }
5604                         if ((chk->data->m_flags & M_PKTHDR) == 0) {
5605                                 /*
5606                                  * NOTE: the chk queue MUST have the PKTHDR
5607                                  * flag set on it with a total in the
5608                                  * m_pkthdr.len field!! else the chunk will
5609                                  * ALWAYS be skipped
5610                                  */
5611                                 continue;
5612                         }
5613                         if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5614                                 /*
5615                                  * It must be unsent. Cookies and ASCONF's
5616                                  * hang around but there timers will force
5617                                  * when marked for resend.
5618                                  */
5619                                 continue;
5620                         }
5621                         /* Here we do NOT factor the r_mtu */
5622                         if ((chk->data->m_pkthdr.len < (int)mtu) ||
5623                             (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5624                                 /*
5625                                  * We probably should glom the mbuf chain from
5626                                  * the chk->data for control but the problem
5627                                  * is it becomes yet one more level of
5628                                  * tracking to do if for some reason output
5629                                  * fails. Then I have got to reconstruct the
5630                                  * merged control chain.. el yucko.. for now
5631                                  * we take the easy way and do the copy
5632                                  */
5633                                 outchain = sctp_copy_mbufchain(chk->data,
5634                                                                outchain);
5635                                 if (outchain == NULL) {
5636                                         return (ENOMEM);
5637                                 }
5638                                 /* update our MTU size */
5639                                 mtu -= chk->data->m_pkthdr.len;
5640                                 if (mtu < 0) {
5641                                         mtu = 0;
5642                                 }
5643                                 /* Do clear IP_DF ? */
5644                                 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5645                                         no_fragmentflg = 0;
5646                                 }
5647                                 /* Mark things to be removed, if needed */
5648                                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5649                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5650                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5651                                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5652                                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5653                                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5654                                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5655                                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5656                                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5657                                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5658
5659                                         if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5660                                                 hbflag = 1;
5661                                         /* remove these chunks at the end */
5662                                         if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5663                                                 /* turn off the timer */
5664                                                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5665                                                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5666                                                                         inp, stcb, net);
5667                                                 }
5668                                         }
5669                                         ctl_cnt++;
5670                                 } else {
5671                                         /*
5672                                          * Other chunks, since they have
5673                                          * timers running (i.e. COOKIE or
5674                                          * ASCONF) we just "trust" that it
5675                                          * gets sent or retransmitted.
5676                                          */
5677                                         ctl_cnt++;
5678                                         if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5679                                                 cookie = 1;
5680                                                 no_out_cnt = 1;
5681                                         } else if (chk->rec.chunk_id == SCTP_ASCONF) {
5682                                                 /*
5683                                                  * set hb flag since we can use
5684                                                  * these for RTO
5685                                                  */
5686                                                 hbflag = 1;
5687                                                 asconf = 1;
5688                                         }
5689                                         chk->sent = SCTP_DATAGRAM_SENT;
5690                                         chk->snd_count++;
5691                                 }
5692                                 if (mtu == 0) {
5693                                         /*
5694                                          * Ok we are out of room but we can
5695                                          * output without effecting the flight
5696                                          * size since this little guy is a
5697                                          * control only packet.
5698                                          */
5699                                         if (asconf) {
5700                                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5701                                                 asconf = 0;
5702                                         }
5703                                         if (cookie) {
5704                                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5705                                                 cookie = 0;
5706                                         }
5707                                         if (outchain->m_len == 0) {
5708                                                 /*
5709                                                  * Special case for when you
5710                                                  * get a 0 len mbuf at the
5711                                                  * head due to the lack of a
5712                                                  * MHDR at the beginning.
5713                                                  */
5714                                                 outchain->m_len = sizeof(struct sctphdr);
5715                                         } else {
5716                                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5717                                                 if (outchain == NULL) {
5718                                                         /* no memory */
5719                                                         error = ENOBUFS;
5720                                                         goto error_out_again;
5721                                                 }
5722                                         }
5723                                         shdr = mtod(outchain, struct sctphdr *);
5724                                         shdr->src_port = inp->sctp_lport;
5725                                         shdr->dest_port = stcb->rport;
5726                                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5727                                         shdr->checksum = 0;
5728
5729                                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5730                                                                                 (struct sockaddr *)&net->ro._l_addr,
5731                                                                                 outchain,
5732                                                                                 no_fragmentflg, 0, NULL, asconf))) {
5733                                                 if (error == ENOBUFS) {
5734                                                         asoc->ifp_had_enobuf = 1;
5735                                                 }
5736                                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5737                                                 if (from_where == 0) {
5738                                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5739                                                 }
5740                                         error_out_again:
5741 #ifdef SCTP_DEBUG
5742                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5743                                                         kprintf("Gak got ctrl error %d\n", error);
5744                                                 }
5745 #endif
5746                                                 /* error, could not output */
5747                                                 if (hbflag) {
5748 #ifdef SCTP_DEBUG
5749                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5750                                                                 kprintf("Update HB anyway\n");
5751                                                         }
5752 #endif
5753                                                         if (*now_filled == 0) {
5754                                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5755                                                                 *now_filled = 1;
5756                                                                 *now = net->last_sent_time;
5757                                                         } else {
5758                                                                 net->last_sent_time = *now;
5759                                                         }
5760                                                         hbflag = 0;
5761                                                 }
5762                                                 if (error == EHOSTUNREACH) {
5763                                                         /*
5764                                                          * Destination went
5765                                                          * unreachable during
5766                                                          * this send
5767                                                          */
5768 #ifdef SCTP_DEBUG
5769                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5770                                                                 kprintf("Moving data to an alternate\n");
5771                                                         }
5772 #endif
5773                                                         sctp_move_to_an_alt(stcb, asoc, net);
5774                                                 }
5775                                                 sctp_clean_up_ctl (asoc);
5776                                                 return (error);
5777                                         } else
5778                                                 asoc->ifp_had_enobuf = 0;
5779                                         /* Only HB or ASCONF advances time */
5780                                         if (hbflag) {
5781                                                 if (*now_filled == 0) {
5782                                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5783                                                         *now_filled = 1;
5784                                                         *now = net->last_sent_time;
5785                                                 } else {
5786                                                         net->last_sent_time = *now;
5787                                                 }
5788                                                 hbflag = 0;
5789                                         }
5790                                         /*
5791                                          * increase the number we sent, if a
5792                                          * cookie is sent we don't tell them
5793                                          * any was sent out.
5794                                          */
5795                                         if (!no_out_cnt)
5796                                                 *num_out +=  ctl_cnt;
5797                                         /* recalc a clean slate and setup */
5798                                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5799                                                 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5800                                         } else {
5801                                                 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5802                                         }
5803                                         no_fragmentflg = 1;
5804                                 }
5805                         }
5806                 }
5807                 /*********************/
5808                 /* Data transmission */
5809                 /*********************/
5810                 /* now lets add any data within the MTU constraints */
5811                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5812                         omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5813                 } else {
5814                         omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5815                 }
5816
5817 #ifdef SCTP_DEBUG
5818                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5819                         kprintf("Now to data transmission\n");
5820                 }
5821 #endif
5822
5823                 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5824                     (cookie)) {
5825                         for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5826                                 if (no_data_chunks) {
5827                                         /* let only control go out */
5828 #ifdef SCTP_DEBUG
5829                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5830                                                 kprintf("Either nothing to send or we are full\n");
5831                                         }
5832 #endif
5833                                         break;
5834                                 }
5835                                 if (net->flight_size >= net->cwnd) {
5836                                         /* skip this net, no room for data */
5837 #ifdef SCTP_DEBUG
5838                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5839                                                 kprintf("fs:%d > cwnd:%d\n",
5840                                                        net->flight_size, net->cwnd);
5841                                         }
5842 #endif
5843                                         sctp_pegs[SCTP_CWND_BLOCKED]++;
5844                                         *reason_code = 2;
5845                                         break;
5846                                 }
5847                                 nchk = TAILQ_NEXT(chk, sctp_next);
5848                                 if (chk->whoTo != net) {
5849                                         /* No, not sent to this net */
5850 #ifdef SCTP_DEBUG
5851                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5852                                                 kprintf("chk->whoTo:%p not %p\n",
5853                                                        chk->whoTo, net);
5854
5855                                         }
5856 #endif
5857                                         continue;
5858                                 }
5859 #ifdef SCTP_DEBUG
5860                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5861                                         kprintf("Can we pick up a chunk?\n");
5862                                 }
5863 #endif
5864                                 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5865                                         /* strange, we have a chunk that is to bit
5866                                          * for its destination and yet no fragment ok flag.
5867                                          * Something went wrong when the PMTU changed...we did
5868                                          * not mark this chunk for some reason?? I will
5869                                          * fix it here by letting IP fragment it for now and
5870                                          * printing a warning. This really should not happen ...
5871                                          */
5872 /*#ifdef SCTP_DEBUG*/
5873                                         kprintf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5874                                                chk->send_size, mtu);
5875 /*#endif*/
5876                                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5877                                 }
5878
5879                                 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5880                                     ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5881                                         /* ok we will add this one */
5882 #ifdef SCTP_DEBUG
5883                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5884                                                 kprintf("Picking up the chunk\n");
5885                                         }
5886 #endif
5887                                         outchain = sctp_copy_mbufchain(chk->data, outchain);
5888                                         if (outchain == NULL) {
5889 #ifdef SCTP_DEBUG
5890                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5891                                                         kprintf("Gakk no memory\n");
5892                                                 }
5893 #endif
5894                                                 if (!callout_pending(&net->rxt_timer.timer)) {
5895                                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5896                                                 }
5897                                                 return (ENOMEM);
5898                                         }
5899                                         /* upate our MTU size */
5900                                         /* Do clear IP_DF ? */
5901                                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5902                                                 no_fragmentflg = 0;
5903                                         }
5904                                         mtu -= chk->send_size;
5905                                         r_mtu -= chk->send_size;
5906                                         data_list[bundle_at++] = chk;
5907                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5908                                                 mtu = 0;
5909                                                 break;
5910                                         }
5911                                         if (mtu <= 0) {
5912                                                 mtu = 0;
5913                                                 break;
5914                                         }
5915                                         if ((r_mtu <= 0) || one_chunk) {
5916                                                 r_mtu = 0;
5917                                                 break;
5918                                         }
5919                                 } else {
5920                                         /*
5921                                          * Must be sent in order of the TSN's
5922                                          * (on a network)
5923                                          */
5924 #ifdef SCTP_DEBUG
5925                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5926                                                 kprintf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5927                                                        chk->send_size, mtu, r_mtu);
5928                                         }
5929 #endif
5930
5931                                         break;
5932                                 }
5933                         }/* for () */
5934                 } /* if asoc.state OPEN */
5935                 /* Is there something to send for this destination? */
5936 #ifdef SCTP_DEBUG
5937                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5938                         kprintf("ok now is chain assembled? %p\n",
5939                                outchain);
5940                 }
5941 #endif
5942
5943                 if (outchain) {
5944                         /* We may need to start a control timer or two */
5945                         if (asconf) {
5946                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5947                                 asconf = 0;
5948                         }
5949                         if (cookie) {
5950                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5951                                 cookie = 0;
5952                         }
5953                         /* must start a send timer if data is being sent */
5954                         if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5955                                 /* no timer running on this destination
5956                                  * restart it.
5957                                  */
5958 #ifdef SCTP_DEBUG
5959                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5960                                         kprintf("ok lets start a send timer .. we will transmit %p\n",
5961                                                outchain);
5962                                 }
5963 #endif
5964                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5965                         }
5966                         /* Now send it, if there is anything to send :> */
5967                         if ((outchain->m_flags & M_PKTHDR) == 0) {
5968                                 struct mbuf *t;
5969
5970                                 MGETHDR(t, MB_DONTWAIT, MT_HEADER);
5971                                 if (t == NULL) {
5972                                         sctp_m_freem(outchain);
5973                                         return (ENOMEM);
5974                                 }
5975                                 t->m_next = outchain;
5976                                 t->m_pkthdr.len = 0;
5977                                 t->m_pkthdr.rcvif = 0;
5978                                 t->m_len = 0;
5979
5980                                 outchain = t;
5981                                 while (t) {
5982                                         outchain->m_pkthdr.len += t->m_len;
5983                                         t = t->m_next;
5984                                 }
5985                         }
5986                         if (outchain->m_len == 0) {
5987                                 /* Special case for when you get a 0 len
5988                                  * mbuf at the head due to the lack
5989                                  * of a MHDR at the beginning.
5990                                  */
5991                                 MH_ALIGN(outchain, sizeof(struct sctphdr));
5992                                 outchain->m_len = sizeof(struct sctphdr);
5993                         } else {
5994                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5995                                 if (outchain == NULL) {
5996                                         /* out of mbufs */
5997                                         error = ENOBUFS;
5998                                         goto errored_send;
5999                                 }
6000                         }
6001                         shdr = mtod(outchain, struct sctphdr *);
6002                         shdr->src_port = inp->sctp_lport;
6003                         shdr->dest_port = stcb->rport;
6004                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6005                         shdr->checksum = 0;
6006                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6007                                                                 (struct sockaddr *)&net->ro._l_addr,
6008                                                                 outchain,
6009                                                                 no_fragmentflg, bundle_at, data_list[0], asconf))) {
6010                                 /* error, we could not output */
6011                                 if (error == ENOBUFS) {
6012                                         asoc->ifp_had_enobuf = 1;
6013                                 }
6014                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6015                                 if (from_where == 0) {
6016                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
6017                                 }
6018
6019                         errored_send:
6020 #ifdef SCTP_DEBUG
6021                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6022                                         kprintf("Gak send error %d\n", error);
6023                                 }
6024 #endif
6025                                 if (hbflag) {
6026 #ifdef SCTP_DEBUG
6027                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6028                                                 kprintf("Update HB time anyway\n");
6029                                         }
6030 #endif
6031                                         if (*now_filled == 0) {
6032                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6033                                                 *now_filled = 1;
6034                                                 *now = net->last_sent_time;
6035                                         } else {
6036                                                 net->last_sent_time = *now;
6037                                         }
6038                                         hbflag = 0;
6039                                 }
6040                                 if (error == EHOSTUNREACH) {
6041                                         /*
6042                                          * Destination went unreachable during
6043                                          * this send
6044                                          */
6045 #ifdef SCTP_DEBUG
6046                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6047                                                 kprintf("Calling the movement routine\n");
6048                                         }
6049 #endif
6050                                         sctp_move_to_an_alt(stcb, asoc, net);
6051                                 }
6052                                 sctp_clean_up_ctl (asoc);
6053                                 return (error);
6054                         } else {
6055                                 asoc->ifp_had_enobuf = 0;
6056                         }
6057                         if (bundle_at || hbflag) {
6058                                 /* For data/asconf and hb set time */
6059                                 if (*now_filled == 0) {
6060                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6061                                         *now_filled = 1;
6062                                         *now = net->last_sent_time;
6063                                 } else {
6064                                         net->last_sent_time = *now;
6065                                 }
6066                         }
6067
6068                         if (!no_out_cnt) {
6069                                 *num_out += (ctl_cnt + bundle_at);
6070                         }
6071                         if (bundle_at) {
6072                                 if (!net->rto_pending) {
6073                                         /* setup for a RTO measurement */
6074                                         net->rto_pending = 1;
6075                                         data_list[0]->do_rtt = 1;
6076                                 } else {
6077                                         data_list[0]->do_rtt = 0;
6078                                 }
6079                                 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
6080                                 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
6081                         }
6082                         if (one_chunk) {
6083                                 break;
6084                         }
6085                 }
6086         }
6087         /* At the end there should be no NON timed
6088          * chunks hanging on this queue.
6089          */
6090         if ((*num_out == 0) && (*reason_code == 0)) {
6091                 *reason_code = 3;
6092         }
6093         sctp_clean_up_ctl (asoc);
6094         return (0);
6095 }
6096
6097 void
6098 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
6099 {
6100         /* Prepend a OPERATIONAL_ERROR chunk header
6101          * and put on the end of the control chunk queue.
6102          */
6103         /* Sender had better have gotten a MGETHDR or else
6104          * the control chunk will be forever skipped
6105          */
6106         struct sctp_chunkhdr *hdr;
6107         struct sctp_tmit_chunk *chk;
6108         struct mbuf *mat;
6109
6110         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6111         if (chk == NULL) {
6112                 /* no memory */
6113                 sctp_m_freem(op_err);
6114                 return;
6115         }
6116         sctppcbinfo.ipi_count_chunk++;
6117         sctppcbinfo.ipi_gencnt_chunk++;
6118         M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), MB_DONTWAIT);
6119         if (op_err == NULL) {
6120                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6121                 sctppcbinfo.ipi_count_chunk--;
6122                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6123                         panic("Chunk count is negative");
6124                 }
6125                 sctppcbinfo.ipi_gencnt_chunk++;
6126                 return;
6127         }
6128         chk->send_size = 0;
6129         mat = op_err;
6130         while (mat != NULL) {
6131                 chk->send_size += mat->m_len;
6132                 mat = mat->m_next;
6133         }
6134         chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6135         chk->sent = SCTP_DATAGRAM_UNSENT;
6136         chk->snd_count = 0;
6137         chk->flags = 0;
6138         chk->asoc = &stcb->asoc;
6139         chk->data = op_err;
6140         chk->whoTo = chk->asoc->primary_destination;
6141         chk->whoTo->ref_count++;
6142         hdr = mtod(op_err, struct sctp_chunkhdr *);
6143         hdr->chunk_type = SCTP_OPERATION_ERROR;
6144         hdr->chunk_flags = 0;
6145         hdr->chunk_length = htons(chk->send_size);
6146         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6147                           chk,
6148                           sctp_next);
6149         chk->asoc->ctrl_queue_cnt++;
6150 }
6151
6152 int
6153 sctp_send_cookie_echo(struct mbuf *m,
6154                       int offset,
6155                       struct sctp_tcb *stcb,
6156                       struct sctp_nets *net)
6157 {
6158         /*
6159          * pull out the cookie and put it at the front of the control
6160          * chunk queue.
6161          */
6162         int at;
6163         struct mbuf *cookie, *mat;
6164         struct sctp_paramhdr parm, *phdr;
6165         struct sctp_chunkhdr *hdr;
6166         struct sctp_tmit_chunk *chk;
6167         uint16_t ptype, plen;
6168         /* First find the cookie in the param area */
6169         cookie = NULL;
6170         at = offset + sizeof(struct sctp_init_chunk);
6171
6172         do {
6173                 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6174                 if (phdr == NULL) {
6175                         return (-3);
6176                 }
6177                 ptype = ntohs(phdr->param_type);
6178                 plen = ntohs(phdr->param_length);
6179                 if (ptype == SCTP_STATE_COOKIE) {
6180                         int pad;
6181                         /* found the cookie */
6182                         if ((pad = (plen % 4))) {
6183                                 plen += 4 - pad;
6184                         }
6185                         cookie = sctp_m_copym(m, at, plen, MB_DONTWAIT);
6186                         if (cookie == NULL) {
6187                                 /* No memory */
6188                                 return (-2);
6189                         }
6190                         break;
6191                 }
6192                 at += SCTP_SIZE32(plen);
6193         } while (phdr);
6194         if (cookie == NULL) {
6195                 /* Did not find the cookie */
6196                 return (-3);
6197         }
6198         /* ok, we got the cookie lets change it into a cookie echo chunk */
6199
6200         /* first the change from param to cookie */
6201         hdr = mtod(cookie, struct sctp_chunkhdr *);
6202         hdr->chunk_type = SCTP_COOKIE_ECHO;
6203         hdr->chunk_flags = 0;
6204         /* now we MUST have a PKTHDR on it */
6205         if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6206                 /* we hope this happens rarely */
6207                 MGETHDR(mat, MB_DONTWAIT, MT_HEADER);
6208                 if (mat == NULL) {
6209                         sctp_m_freem(cookie);
6210                         return (-4);
6211                 }
6212                 mat->m_len = 0;
6213                 mat->m_pkthdr.rcvif = 0;
6214                 mat->m_next = cookie;
6215                 cookie = mat;
6216         }
6217         cookie->m_pkthdr.len = plen;
6218         /* get the chunk stuff now and place it in the FRONT of the queue */
6219         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6220         if (chk == NULL) {
6221                 /* no memory */
6222                 sctp_m_freem(cookie);
6223                 return (-5);
6224         }
6225         sctppcbinfo.ipi_count_chunk++;
6226         sctppcbinfo.ipi_gencnt_chunk++;
6227         chk->send_size = cookie->m_pkthdr.len;
6228         chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6229         chk->sent = SCTP_DATAGRAM_UNSENT;
6230         chk->snd_count = 0;
6231         chk->flags = 0;
6232         chk->asoc = &stcb->asoc;
6233         chk->data = cookie;
6234         chk->whoTo = chk->asoc->primary_destination;
6235         chk->whoTo->ref_count++;
6236         TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6237         chk->asoc->ctrl_queue_cnt++;
6238         return (0);
6239 }
6240
6241 void
6242 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6243                         struct mbuf *m,
6244                         int offset,
6245                         int chk_length,
6246                         struct sctp_nets *net)
6247 {
6248         /* take a HB request and make it into a
6249          * HB ack and send it.
6250          */
6251         struct mbuf *outchain;
6252         struct sctp_chunkhdr *chdr;
6253         struct sctp_tmit_chunk *chk;
6254
6255
6256         if (net == NULL)
6257                 /* must have a net pointer */
6258                 return;
6259
6260         outchain = sctp_m_copym(m, offset, chk_length, MB_DONTWAIT);
6261         if (outchain == NULL) {
6262                 /* gak out of memory */
6263                 return;
6264         }
6265         chdr = mtod(outchain, struct sctp_chunkhdr *);
6266         chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6267         chdr->chunk_flags = 0;
6268         if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6269                 /* should not happen but we are cautious. */
6270                 struct mbuf *tmp;
6271                 MGETHDR(tmp, MB_DONTWAIT, MT_HEADER);
6272                 if (tmp == NULL) {
6273                         return;
6274                 }
6275                 tmp->m_len = 0;
6276                 tmp->m_pkthdr.rcvif = 0;
6277                 tmp->m_next = outchain;
6278                 outchain = tmp;
6279         }
6280         outchain->m_pkthdr.len = chk_length;
6281         if (chk_length % 4) {
6282                 /* need pad */
6283                 u_int32_t cpthis=0;
6284                 int padlen;
6285                 padlen = 4 - (outchain->m_pkthdr.len % 4);
6286                 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (caddr_t)&cpthis);
6287         }
6288         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6289         if (chk == NULL) {
6290                 /* no memory */
6291                 sctp_m_freem(outchain);
6292                 return ;
6293         }
6294         sctppcbinfo.ipi_count_chunk++;
6295         sctppcbinfo.ipi_gencnt_chunk++;
6296
6297         chk->send_size = chk_length;
6298         chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6299         chk->sent = SCTP_DATAGRAM_UNSENT;
6300         chk->snd_count = 0;
6301         chk->flags = 0;
6302         chk->asoc = &stcb->asoc;
6303         chk->data = outchain;
6304         chk->whoTo = net;
6305         chk->whoTo->ref_count++;
6306         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6307         chk->asoc->ctrl_queue_cnt++;
6308 }
6309
6310 int
6311 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6312         /* formulate and queue a cookie-ack back to sender */
6313         struct mbuf *cookie_ack;
6314         struct sctp_chunkhdr *hdr;
6315         struct sctp_tmit_chunk *chk;
6316
6317         cookie_ack = NULL;
6318         MGETHDR(cookie_ack, MB_DONTWAIT, MT_HEADER);
6319         if (cookie_ack == NULL) {
6320                 /* no mbuf's */
6321                 return (-1);
6322         }
6323         cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6324         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6325         if (chk == NULL) {
6326                 /* no memory */
6327                 sctp_m_freem(cookie_ack);
6328                 return (-1);
6329         }
6330         sctppcbinfo.ipi_count_chunk++;
6331         sctppcbinfo.ipi_gencnt_chunk++;
6332
6333         chk->send_size = sizeof(struct sctp_chunkhdr);
6334         chk->rec.chunk_id = SCTP_COOKIE_ACK;
6335         chk->sent = SCTP_DATAGRAM_UNSENT;
6336         chk->snd_count = 0;
6337         chk->flags = 0;
6338         chk->asoc = &stcb->asoc;
6339         chk->data = cookie_ack;
6340         if (chk->asoc->last_control_chunk_from != NULL) {
6341                 chk->whoTo = chk->asoc->last_control_chunk_from;
6342         } else {
6343                 chk->whoTo = chk->asoc->primary_destination;
6344         }
6345         chk->whoTo->ref_count++;
6346         hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6347         hdr->chunk_type = SCTP_COOKIE_ACK;
6348         hdr->chunk_flags = 0;
6349         hdr->chunk_length = htons(chk->send_size);
6350         cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6351         cookie_ack->m_pkthdr.rcvif = 0;
6352         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6353         chk->asoc->ctrl_queue_cnt++;
6354         return (0);
6355 }
6356
6357
6358 int
6359 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6360 {
6361         /* formulate and queue a SHUTDOWN-ACK back to the sender */
6362         struct mbuf *m_shutdown_ack;
6363         struct sctp_shutdown_ack_chunk *ack_cp;
6364         struct sctp_tmit_chunk *chk;
6365
6366         m_shutdown_ack = NULL;
6367         MGETHDR(m_shutdown_ack, MB_DONTWAIT, MT_HEADER);
6368         if (m_shutdown_ack == NULL) {
6369                 /* no mbuf's */
6370                 return (-1);
6371         }
6372         m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6373         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6374         if (chk == NULL) {
6375                 /* no memory */
6376                 sctp_m_freem(m_shutdown_ack);
6377                 return (-1);
6378         }
6379         sctppcbinfo.ipi_count_chunk++;
6380         sctppcbinfo.ipi_gencnt_chunk++;
6381
6382         chk->send_size = sizeof(struct sctp_chunkhdr);
6383         chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6384         chk->sent = SCTP_DATAGRAM_UNSENT;
6385         chk->snd_count = 0;
6386         chk->flags = 0;
6387         chk->asoc = &stcb->asoc;
6388         chk->data = m_shutdown_ack;
6389         chk->whoTo = net;
6390         net->ref_count++;
6391
6392         ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6393         ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6394         ack_cp->ch.chunk_flags = 0;
6395         ack_cp->ch.chunk_length = htons(chk->send_size);
6396         m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6397         m_shutdown_ack->m_pkthdr.rcvif = 0;
6398         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6399         chk->asoc->ctrl_queue_cnt++;
6400         return (0);
6401 }
6402
6403 int
6404 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6405 {
6406         /* formulate and queue a SHUTDOWN to the sender */
6407         struct mbuf *m_shutdown;
6408         struct sctp_shutdown_chunk *shutdown_cp;
6409         struct sctp_tmit_chunk *chk;
6410
6411         m_shutdown = NULL;
6412         MGETHDR(m_shutdown, MB_DONTWAIT, MT_HEADER);
6413         if (m_shutdown == NULL) {
6414                 /* no mbuf's */
6415                 return (-1);
6416         }
6417         m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6418         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6419         if (chk == NULL) {
6420                 /* no memory */
6421                 sctp_m_freem(m_shutdown);
6422                 return (-1);
6423         }
6424         sctppcbinfo.ipi_count_chunk++;
6425         sctppcbinfo.ipi_gencnt_chunk++;
6426
6427         chk->send_size = sizeof(struct sctp_shutdown_chunk);
6428         chk->rec.chunk_id = SCTP_SHUTDOWN;
6429         chk->sent = SCTP_DATAGRAM_UNSENT;
6430         chk->snd_count = 0;
6431         chk->flags = 0;
6432         chk->asoc = &stcb->asoc;
6433         chk->data = m_shutdown;
6434         chk->whoTo = net;
6435         net->ref_count++;
6436
6437         shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6438         shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6439         shutdown_cp->ch.chunk_flags = 0;
6440         shutdown_cp->ch.chunk_length = htons(chk->send_size);
6441         shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6442         m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6443         m_shutdown->m_pkthdr.rcvif = 0;
6444         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6445         chk->asoc->ctrl_queue_cnt++;
6446
6447         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6448             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6449                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
6450                 soisdisconnecting(stcb->sctp_ep->sctp_socket);
6451         }
6452         return (0);
6453 }
6454
6455 int
6456 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6457 {
6458         /*
6459          * formulate and queue an ASCONF to the peer
6460          * ASCONF parameters should be queued on the assoc queue
6461          */
6462         struct sctp_tmit_chunk *chk;
6463         struct mbuf *m_asconf;
6464
6465         /* compose an ASCONF chunk, maximum length is PMTU */
6466         m_asconf = sctp_compose_asconf(stcb);
6467         if (m_asconf == NULL) {
6468                 return (-1);
6469         }
6470         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6471         if (chk == NULL) {
6472                 /* no memory */
6473                 sctp_m_freem(m_asconf);
6474                 return (-1);
6475         }
6476         sctppcbinfo.ipi_count_chunk++;
6477         sctppcbinfo.ipi_gencnt_chunk++;
6478
6479         chk->data = m_asconf;
6480         chk->send_size = m_asconf->m_pkthdr.len;
6481         chk->rec.chunk_id = SCTP_ASCONF;
6482         chk->sent = SCTP_DATAGRAM_UNSENT;
6483         chk->snd_count = 0;
6484         chk->flags = 0;
6485         chk->asoc = &stcb->asoc;
6486         chk->whoTo = chk->asoc->primary_destination;
6487         chk->whoTo->ref_count++;
6488         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6489         chk->asoc->ctrl_queue_cnt++;
6490         return (0);
6491 }
6492
6493 int
6494 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6495 {
6496         /*
6497          * formulate and queue a asconf-ack back to sender
6498          * the asconf-ack must be stored in the tcb
6499          */
6500         struct sctp_tmit_chunk *chk;
6501         struct mbuf *m_ack;
6502
6503         /* is there a asconf-ack mbuf chain to send? */
6504         if (stcb->asoc.last_asconf_ack_sent == NULL) {
6505                 return (-1);
6506         }
6507
6508         /* copy the asconf_ack */
6509 #if defined(__FreeBSD__) || defined(__NetBSD__)
6510         /* Supposedly the m_copypacket is a optimzation,
6511          * use it if we can.
6512          */
6513         if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6514                 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, MB_DONTWAIT);
6515                 sctp_pegs[SCTP_CACHED_SRC]++;
6516         } else
6517                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6518 #else
6519                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6520 #endif
6521         if (m_ack == NULL) {
6522                 /* couldn't copy it */
6523
6524                 return (-1);
6525         }
6526         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6527         if (chk == NULL) {
6528                 /* no memory */
6529                 if (m_ack)
6530                         sctp_m_freem(m_ack);
6531                 return (-1);
6532         }
6533         sctppcbinfo.ipi_count_chunk++;
6534         sctppcbinfo.ipi_gencnt_chunk++;
6535
6536         /* figure out where it goes to */
6537         if (retrans) {
6538                 /* we're doing a retransmission */
6539                 if (stcb->asoc.used_alt_asconfack > 2) {
6540                         /* tried alternate nets already, go back */
6541                         chk->whoTo = NULL;
6542                 } else {
6543                         /* need to try and alternate net */
6544                         chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6545                         stcb->asoc.used_alt_asconfack++;
6546                 }
6547                 if (chk->whoTo == NULL) {
6548                         /* no alternate */
6549                         if (stcb->asoc.last_control_chunk_from == NULL)
6550                                 chk->whoTo = stcb->asoc.primary_destination;
6551                         else
6552                                 chk->whoTo = stcb->asoc.last_control_chunk_from;
6553                         stcb->asoc.used_alt_asconfack = 0;
6554                 }
6555         } else {
6556                 /* normal case */
6557                 if (stcb->asoc.last_control_chunk_from == NULL)
6558                         chk->whoTo = stcb->asoc.primary_destination;
6559                 else
6560                         chk->whoTo = stcb->asoc.last_control_chunk_from;
6561                 stcb->asoc.used_alt_asconfack = 0;
6562         }
6563         chk->data = m_ack;
6564         chk->send_size = m_ack->m_pkthdr.len;
6565         chk->rec.chunk_id = SCTP_ASCONF_ACK;
6566         chk->sent = SCTP_DATAGRAM_UNSENT;
6567         chk->snd_count = 0;
6568         chk->flags = 0;
6569         chk->asoc = &stcb->asoc;
6570         chk->whoTo->ref_count++;
6571         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6572         chk->asoc->ctrl_queue_cnt++;
6573         return (0);
6574 }
6575
6576
6577 static int
6578 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6579                           struct sctp_tcb *stcb,
6580                           struct sctp_association *asoc,
6581                           int *cnt_out, struct timeval *now, int *now_filled)
6582 {
6583         /*
6584          * send out one MTU of retransmission.
6585          * If fast_retransmit is happening we ignore the cwnd.
6586          * Otherwise we obey the cwnd and rwnd.
6587          * For a Cookie or Asconf in the control chunk queue we retransmit
6588          * them by themselves.
6589          *
6590          * For data chunks we will pick out the lowest TSN's in the
6591          * sent_queue marked for resend and bundle them all together
6592          * (up to a MTU of destination). The address to send to should
6593          * have been selected/changed where the retransmission was
6594          * marked (i.e. in FR or t3-timeout routines).
6595          */
6596         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6597         struct sctp_tmit_chunk *chk, *fwd;
6598         struct mbuf *m;
6599         struct sctphdr *shdr;
6600         int asconf;
6601         struct sctp_nets *net;
6602         int no_fragmentflg, bundle_at, cnt_thru;
6603         unsigned int mtu;
6604         int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6605
6606         tmr_started = ctl_cnt = bundle_at =  error = 0;
6607         no_fragmentflg = 1;
6608         asconf = 0;
6609         fwd_tsn = 0;
6610         *cnt_out = 0;
6611         fwd = NULL;
6612         m = NULL;
6613 #ifdef SCTP_AUDITING_ENABLED
6614         sctp_audit_log(0xC3, 1);
6615 #endif
6616         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6617 #ifdef SCTP_DEBUG
6618                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6619                         kprintf("SCTP hits empty queue with cnt set to %d?\n",
6620                                asoc->sent_queue_retran_cnt);
6621                 }
6622 #endif
6623                 asoc->sent_queue_cnt = 0;
6624                 asoc->sent_queue_cnt_removeable = 0;
6625         }
6626         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6627                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6628                         /* we only worry about things marked for resend */
6629                         continue;
6630                 }
6631                 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6632                     (chk->rec.chunk_id == SCTP_ASCONF) ||
6633                     (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6634                     (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6635                         if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6636                                 /* For stream reset we only retran the request
6637                                  * not the response.
6638                                  */
6639                                 struct sctp_stream_reset_req *strreq;
6640                                 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6641                                 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6642                                         continue;
6643                                 }
6644                         }
6645                         ctl_cnt++;
6646                         if (chk->rec.chunk_id == SCTP_ASCONF) {
6647                                 no_fragmentflg = 1;
6648                                 asconf = 1;
6649                         }
6650                         if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6651                                 fwd_tsn = 1;
6652                                 fwd = chk;
6653                         }
6654                         m = sctp_copy_mbufchain(chk->data, m);
6655                         break;
6656                 }
6657         }
6658         one_chunk = 0;
6659         cnt_thru = 0;
6660         /* do we have control chunks to retransmit? */
6661         if (m != NULL) {
6662                 /* Start a timer no matter if we suceed or fail */
6663                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6664                         sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6665                 } else if (chk->rec.chunk_id == SCTP_ASCONF)
6666                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6667
6668                 if (m->m_len == 0) {
6669                         /* Special case for when you get a 0 len
6670                          * mbuf at the head due to the lack
6671                          * of a MHDR at the beginning.
6672                          */
6673                         m->m_len = sizeof(struct sctphdr);
6674                 } else {
6675                         M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6676                         if (m == NULL) {
6677                                 return (ENOBUFS);
6678                         }
6679                 }
6680                 shdr = mtod(m, struct sctphdr *);
6681                 shdr->src_port = inp->sctp_lport;
6682                 shdr->dest_port = stcb->rport;
6683                 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6684                 shdr->checksum = 0;
6685                 chk->snd_count++;               /* update our count */
6686
6687                 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6688                     (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
6689                     no_fragmentflg, 0, NULL, asconf))) {
6690                         sctp_pegs[SCTP_DATA_OUT_ERR]++;
6691                         return (error);
6692                 }
6693                 /*
6694                  *We don't want to mark the net->sent time here since this
6695                  * we use this for HB and retrans cannot measure RTT
6696                  */
6697                 /*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6698                 *cnt_out += 1;
6699                 chk->sent = SCTP_DATAGRAM_SENT;
6700                 asoc->sent_queue_retran_cnt--;
6701                 if (asoc->sent_queue_retran_cnt < 0) {
6702                     asoc->sent_queue_retran_cnt = 0;
6703                 }
6704                 if (fwd_tsn == 0) {
6705                         return (0);
6706                 } else {
6707                         /* Clean up the fwd-tsn list */
6708                         sctp_clean_up_ctl (asoc);
6709                         return (0);
6710                 }
6711         }
6712         /* Ok, it is just data retransmission we need to do or
6713          * that and a fwd-tsn with it all.
6714          */
6715         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6716                 return (-1);
6717         }
6718 #ifdef SCTP_DEBUG
6719         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6720                 kprintf("Normal chunk retransmission cnt:%d\n",
6721                        asoc->sent_queue_retran_cnt);
6722         }
6723 #endif
6724         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6725             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6726                 /* not yet open, resend the cookie and that is it */
6727                 return (1);
6728         }
6729
6730
6731 #ifdef SCTP_AUDITING_ENABLED
6732         sctp_auditing(20, inp, stcb, NULL);
6733 #endif
6734         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6735                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6736                         /* No, not sent to this net or not ready for rtx */
6737                         continue;
6738
6739                 }
6740                 /* pick up the net */
6741                 net = chk->whoTo;
6742                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6743                         mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6744                 } else {
6745                         mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6746                 }
6747
6748                 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6749                         /* No room in peers rwnd */
6750                         uint32_t tsn;
6751                         tsn = asoc->last_acked_seq + 1;
6752                         if (tsn == chk->rec.data.TSN_seq) {
6753                                 /* we make a special exception for this case.
6754                                  * The peer has no rwnd but is missing the
6755                                  * lowest chunk.. which is probably what is
6756                                  * holding up the rwnd.
6757                                  */
6758                                 goto one_chunk_around;
6759                         }
6760 #ifdef SCTP_DEBUG
6761                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6762                                 kprintf("blocked-peers_rwnd:%d tf:%d\n",
6763                                        (int)asoc->peers_rwnd,
6764                                        (int)asoc->total_flight);
6765                         }
6766 #endif
6767                         sctp_pegs[SCTP_RWND_BLOCKED]++;
6768                         return (1);
6769                 }
6770         one_chunk_around:
6771                 if (asoc->peers_rwnd < mtu) {
6772                         one_chunk = 1;
6773                 }
6774 #ifdef SCTP_AUDITING_ENABLED
6775                 sctp_audit_log(0xC3, 2);
6776 #endif
6777                 bundle_at = 0;
6778                 m = NULL;
6779                 net->fast_retran_ip = 0;
6780                 if (chk->rec.data.doing_fast_retransmit == 0) {
6781                         /* if no FR in progress skip destination that
6782                          * have flight_size > cwnd.
6783                          */
6784                         if (net->flight_size >= net->cwnd) {
6785                                 sctp_pegs[SCTP_CWND_BLOCKED]++;
6786                                 continue;
6787                         }
6788                 } else {
6789                         /* Mark the destination net to have FR recovery
6790                          * limits put on it.
6791                          */
6792                         net->fast_retran_ip = 1;
6793                 }
6794
6795                 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6796                         /* ok we will add this one */
6797                         m = sctp_copy_mbufchain(chk->data, m);
6798                         if (m == NULL) {
6799                                 return (ENOMEM);
6800                         }
6801                         /* upate our MTU size */
6802                         /* Do clear IP_DF ? */
6803                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6804                                 no_fragmentflg = 0;
6805                         }
6806                         mtu -= chk->send_size;
6807                         data_list[bundle_at++] = chk;
6808                         if (one_chunk && (asoc->total_flight <= 0)) {
6809                                 sctp_pegs[SCTP_WINDOW_PROBES]++;
6810                                 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6811                         }
6812                 }
6813                 if (one_chunk == 0) {
6814                         /* now are there anymore forward from chk to pick up?*/
6815                         fwd = TAILQ_NEXT(chk, sctp_next);
6816                         while (fwd) {
6817                                 if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6818                                         /* Nope, not for retran */
6819                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6820                                         continue;
6821                                 }
6822                                 if (fwd->whoTo != net) {
6823                                         /* Nope, not the net in question */
6824                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6825                                         continue;
6826                                 }
6827                                 if (fwd->send_size <= mtu) {
6828                                         m = sctp_copy_mbufchain(fwd->data, m);
6829                                         if (m == NULL) {
6830                                                 return (ENOMEM);
6831                                         }
6832                                         /* upate our MTU size */
6833                                         /* Do clear IP_DF ? */
6834                                         if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6835                                                 no_fragmentflg = 0;
6836                                         }
6837                                         mtu -= fwd->send_size;
6838                                         data_list[bundle_at++] = fwd;
6839                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6840                                                 break;
6841                                         }
6842                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6843                                 } else {
6844                                         /* can't fit so we are done */
6845                                         break;
6846                                 }
6847                         }
6848                 }
6849                 /* Is there something to send for this destination? */
6850                 if (m) {
6851                         /* No matter if we fail/or suceed we should
6852                          * start a timer. A failure is like a lost
6853                          * IP packet :-)
6854                          */
6855                         if (!callout_pending(&net->rxt_timer.timer)) {
6856                                 /* no timer running on this destination
6857                                  * restart it.
6858                                  */
6859                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6860                                 tmr_started = 1;
6861                         }
6862                         if (m->m_len == 0) {
6863                                 /* Special case for when you get a 0 len
6864                                  * mbuf at the head due to the lack
6865                                  * of a MHDR at the beginning.
6866                                  */
6867                                 m->m_len = sizeof(struct sctphdr);
6868                         } else {
6869                                 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6870                                 if (m == NULL) {
6871                                         return (ENOBUFS);
6872                                 }
6873                         }
6874                         shdr = mtod(m, struct sctphdr *);
6875                         shdr->src_port = inp->sctp_lport;
6876                         shdr->dest_port = stcb->rport;
6877                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6878                         shdr->checksum = 0;
6879
6880                         /* Now lets send it, if there is anything to send :> */
6881                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6882                                                                (struct sockaddr *)&net->ro._l_addr,
6883                                                                m,
6884                                                                no_fragmentflg, 0, NULL, asconf))) {
6885                                 /* error, we could not output */
6886                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6887                                 return (error);
6888                         }
6889                         /* For HB's */
6890                         /*
6891                          * We don't want to mark the net->sent time here since
6892                          * this we use this for HB and retrans cannot measure
6893                          * RTT
6894                          */
6895                         /*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6896
6897                         /* For auto-close */
6898                         cnt_thru++;
6899                         if (*now_filled == 0) {
6900                                 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6901                                 *now = asoc->time_last_sent;
6902                                 *now_filled = 1;
6903                         } else {
6904                                 asoc->time_last_sent = *now;
6905                         }
6906                         *cnt_out += bundle_at;
6907 #ifdef SCTP_AUDITING_ENABLED
6908                         sctp_audit_log(0xC4, bundle_at);
6909 #endif
6910                         for (i = 0; i < bundle_at; i++) {
6911                                 sctp_pegs[SCTP_RETRANTSN_SENT]++;
6912                                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
6913                                 data_list[i]->snd_count++;
6914                                 asoc->sent_queue_retran_cnt--;
6915                                 /* record the time */
6916                                 data_list[i]->sent_rcv_time = asoc->time_last_sent;
6917                                 if (asoc->sent_queue_retran_cnt < 0) {
6918                                     asoc->sent_queue_retran_cnt = 0;
6919                                 }
6920                                 net->flight_size += data_list[i]->book_size;
6921                                 asoc->total_flight += data_list[i]->book_size;
6922                                 asoc->total_flight_count++;
6923
6924 #ifdef SCTP_LOG_RWND
6925                                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6926                                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6927 #endif
6928                                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6929                                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6930                                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6931                                         /* SWS sender side engages */
6932                                         asoc->peers_rwnd = 0;
6933                                 }
6934
6935                                 if ((i == 0) &&
6936                                     (data_list[i]->rec.data.doing_fast_retransmit)) {
6937                                         sctp_pegs[SCTP_FAST_RETRAN]++;
6938                                         if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6939                                             (tmr_started == 0)) {
6940                                                 /*
6941                                                  * ok we just fast-retrans'd
6942                                                  * the lowest TSN, i.e the
6943                                                  * first on the list. In this
6944                                                  * case we want to give some
6945                                                  * more time to get a SACK
6946                                                  * back without a t3-expiring.
6947                                                  */
6948                                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6949                                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6950                                         }
6951                                 }
6952                         }
6953 #ifdef SCTP_AUDITING_ENABLED
6954                         sctp_auditing(21, inp, stcb, NULL);
6955 #endif
6956                 } else {
6957                         /* None will fit */
6958                         return (1);
6959                 }
6960                 if (asoc->sent_queue_retran_cnt <= 0) {
6961                         /* all done we have no more to retran */
6962                         asoc->sent_queue_retran_cnt = 0;
6963                         break;
6964                 }
6965                 if (one_chunk) {
6966                         /* No more room in rwnd */
6967                         return (1);
6968                 }
6969                 /* stop the for loop here. we sent out a packet */
6970                 break;
6971         }
6972         return (0);
6973 }
6974
6975
6976 static int
6977 sctp_timer_validation(struct sctp_inpcb *inp,
6978                       struct sctp_tcb *stcb,
6979                       struct sctp_association *asoc,
6980                       int ret)
6981 {
6982         struct sctp_nets *net;
6983         /* Validate that a timer is running somewhere */
6984         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6985                 if (callout_pending(&net->rxt_timer.timer)) {
6986                         /* Here is a timer */
6987                         return (ret);
6988                 }
6989         }
6990         /* Gak, we did not have a timer somewhere */
6991 #ifdef SCTP_DEBUG
6992         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6993                 kprintf("Deadlock avoided starting timer on a dest at retran\n");
6994         }
6995 #endif
6996         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
6997         return (ret);
6998 }
6999
7000 int
7001 sctp_chunk_output(struct sctp_inpcb *inp,
7002                   struct sctp_tcb *stcb,
7003                   int from_where)
7004 {
7005         /* Ok this is the generic chunk service queue.
7006          * we must do the following:
7007          *  - See if there are retransmits pending, if so we
7008          *      must do these first and return.
7009          *  - Service the stream queue that is next,
7010          *    moving any message (note I must get a complete
7011          *    message i.e. FIRST/MIDDLE and LAST to the out
7012          *    queue in one pass) and assigning TSN's
7013          *  - Check to see if the cwnd/rwnd allows any output, if
7014          *      so we go ahead and fomulate and send the low level
7015          *    chunks. Making sure to combine any control in the
7016          *    control chunk queue also.
7017          */
7018         struct sctp_association *asoc;
7019         struct sctp_nets *net;
7020         int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
7021         struct timeval now;
7022         int now_filled=0;
7023         int cwnd_full=0;
7024         asoc = &stcb->asoc;
7025         tot_out = 0;
7026         num_out = 0;
7027         reason_code = 0;
7028         sctp_pegs[SCTP_CALLS_TO_CO]++;
7029 #ifdef SCTP_DEBUG
7030         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7031                 kprintf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
7032         }
7033 #endif
7034         while (asoc->sent_queue_retran_cnt) {
7035                 /* Ok, it is retransmission time only, we send out only ONE
7036                  * packet with a single call off to the retran code.
7037                  */
7038                 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
7039                 if (ret > 0) {
7040                         /* Can't send anymore */
7041 #ifdef SCTP_DEBUG
7042                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7043                                 kprintf("retransmission ret:%d -- full\n", ret);
7044                         }
7045 #endif
7046                         /*
7047                          * now lets push out control by calling med-level
7048                          * output once. this assures that we WILL send HB's
7049                          * if queued too.
7050                          */
7051                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
7052                                               &cwnd_full, from_where,
7053                                               &now, &now_filled);
7054 #ifdef SCTP_DEBUG
7055                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7056                                 kprintf("Control send outputs:%d@full\n", num_out);
7057                         }
7058 #endif
7059 #ifdef SCTP_AUDITING_ENABLED
7060                         sctp_auditing(8, inp, stcb, NULL);
7061 #endif
7062                         return (sctp_timer_validation(inp, stcb, asoc, ret));
7063                 }
7064                 if (ret < 0) {
7065                         /*
7066                          * The count was off.. retran is not happening so do
7067                          * the normal retransmission.
7068                          */
7069 #ifdef SCTP_DEBUG
7070                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7071                                 kprintf("Done with retrans, none left fill up window\n");
7072                         }
7073 #endif
7074 #ifdef SCTP_AUDITING_ENABLED
7075                         sctp_auditing(9, inp, stcb, NULL);
7076 #endif
7077                         break;
7078                 }
7079                 if (from_where == 1) {
7080                         /* Only one transmission allowed out of a timeout */
7081 #ifdef SCTP_DEBUG
7082                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7083                                 kprintf("Only one packet allowed out\n");
7084                         }
7085 #endif
7086 #ifdef SCTP_AUDITING_ENABLED
7087                         sctp_auditing(10, inp, stcb, NULL);
7088 #endif
7089                         /* Push out any control */
7090                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
7091                                               &now, &now_filled);
7092                         return (ret);
7093                 }
7094                 if ((num_out == 0) && (ret == 0)) {
7095                         /* No more retrans to send */
7096                         break;
7097                 }
7098         }
7099 #ifdef SCTP_AUDITING_ENABLED
7100         sctp_auditing(12, inp, stcb, NULL);
7101 #endif
7102         /* Check for bad destinations, if they exist move chunks around. */
7103         burst_limit = asoc->max_burst;
7104         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7105                 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
7106                     SCTP_ADDR_NOT_REACHABLE) {
7107                         /*
7108                          * if possible move things off of this address
7109                          * we still may send below due to the dormant state
7110                          * but we try to find an alternate address to send
7111                          * to and if we have one we move all queued data on
7112                          * the out wheel to this alternate address.
7113                          */
7114                         sctp_move_to_an_alt(stcb, asoc, net);
7115                 } else {
7116                         /*
7117                         if ((asoc->sat_network) || (net->addr_is_local)) {
7118                                 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7119                         }
7120                         */
7121 #ifdef SCTP_DEBUG
7122                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7123                                 kprintf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7124                         }
7125 #endif
7126
7127 #ifdef SCTP_USE_ALLMAN_BURST
7128                         if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7129                                 if (net->ssthresh < net->cwnd)
7130                                         net->ssthresh = net->cwnd;
7131                                 net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7132 #ifdef SCTP_LOG_MAXBURST
7133                                 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7134 #endif
7135                                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7136                         }
7137                         net->fast_retran_ip = 0;
7138 #endif
7139                 }
7140
7141         }
7142         /* Fill up what we can to the destination */
7143         burst_cnt = 0;
7144         cwnd_full = 0;
7145         do {
7146 #ifdef SCTP_DEBUG
7147                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7148                         kprintf("Burst count:%d - call m-c-o\n", burst_cnt);
7149                 }
7150 #endif
7151                 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7152                                               &reason_code, 0,  &cwnd_full, from_where,
7153                                               &now, &now_filled);
7154                 if (error) {
7155 #ifdef SCTP_DEBUG
7156                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7157                                 kprintf("Error %d was returned from med-c-op\n", error);
7158                         }
7159 #endif
7160 #ifdef SCTP_LOG_MAXBURST
7161                         sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7162 #endif
7163                         break;
7164                 }
7165 #ifdef SCTP_DEBUG
7166                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7167                         kprintf("m-c-o put out %d\n", num_out);
7168                 }
7169 #endif
7170                 tot_out += num_out;
7171                 burst_cnt++;
7172         } while (num_out
7173 #ifndef SCTP_USE_ALLMAN_BURST
7174                  &&  (burst_cnt < burst_limit)
7175 #endif
7176                 );
7177 #ifndef SCTP_USE_ALLMAN_BURST
7178         if (burst_cnt >= burst_limit) {
7179                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7180                 asoc->burst_limit_applied = 1;
7181 #ifdef SCTP_LOG_MAXBURST
7182                 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7183 #endif
7184         } else {
7185                 asoc->burst_limit_applied = 0;
7186         }
7187 #endif
7188
7189 #ifdef SCTP_DEBUG
7190         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7191                 kprintf("Ok, we have put out %d chunks\n", tot_out);
7192         }
7193 #endif
7194         if (tot_out == 0) {
7195                 sctp_pegs[SCTP_CO_NODATASNT]++;
7196                 if (asoc->stream_queue_cnt > 0) {
7197                         sctp_pegs[SCTP_SOS_NOSNT]++;
7198                 } else {
7199                         sctp_pegs[SCTP_NOS_NOSNT]++;
7200                 }
7201                 if (asoc->send_queue_cnt > 0) {
7202                         sctp_pegs[SCTP_SOSE_NOSNT]++;
7203                 } else {
7204                         sctp_pegs[SCTP_NOSE_NOSNT]++;
7205                 }
7206         }
7207         /* Now we need to clean up the control chunk chain if
7208          * a ECNE is on it. It must be marked as UNSENT again
7209          * so next call will continue to send it until
7210          * such time that we get a CWR, to remove it.
7211          */
7212         sctp_fix_ecn_echo(asoc);
7213         return (error);
7214 }
7215
7216
7217 int
7218 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, struct sockaddr *addr,
7219             struct mbuf *control, struct thread *p, int flags)
7220 {
7221         struct sctp_inpcb *t_inp;
7222         struct sctp_tcb *stcb;
7223         struct sctp_nets *net;
7224         struct sctp_association *asoc;
7225         int create_lock_applied = 0;
7226         int queue_only, error = 0;
7227         struct sctp_sndrcvinfo srcv;
7228         int un_sent = 0;
7229         int use_rcvinfo = 0;
7230         t_inp = inp;
7231         /*  struct route ro;*/
7232
7233         crit_enter();
7234         queue_only = 0;
7235         stcb = NULL;
7236         asoc = NULL;
7237         net = NULL;
7238
7239 #ifdef SCTP_DEBUG
7240         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7241                 kprintf("USR Send BEGINS\n");
7242         }
7243 #endif
7244
7245         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7246             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7247                 /* The listner can NOT send */
7248                 if (control) {
7249                         sctppcbinfo.mbuf_track--;
7250                         sctp_m_freem(control);
7251                         control = NULL;
7252                 }
7253                 sctp_m_freem(m);
7254                 crit_exit();
7255                 return (EFAULT);
7256         }
7257         /* Can't allow a V6 address on a non-v6 socket */
7258         if (addr) {
7259                 SCTP_ASOC_CREATE_LOCK(inp);
7260                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7261                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7262                         /* Should I really unlock ? */
7263                         SCTP_ASOC_CREATE_UNLOCK(inp);
7264                         if (control) {
7265                                 sctppcbinfo.mbuf_track--;
7266                                 sctp_m_freem(control);
7267                                 control = NULL;
7268                         }
7269                         sctp_m_freem(m);
7270                         crit_exit();
7271                         return (EFAULT);
7272                 }
7273                 create_lock_applied = 1;
7274                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7275                     (addr->sa_family == AF_INET6)) {
7276                         SCTP_ASOC_CREATE_UNLOCK(inp);
7277                         if (control) {
7278                                 sctppcbinfo.mbuf_track--;
7279                                 sctp_m_freem(control);
7280                                 control = NULL;
7281                         }
7282                         sctp_m_freem(m);
7283                         crit_exit();
7284                         return (EINVAL);
7285                 }
7286         }
7287         if (control) {
7288                 sctppcbinfo.mbuf_track++;
7289                 if (sctp_find_cmsg(SCTP_SNDRCV, &srcv, control,
7290                                    sizeof(srcv))) {
7291                         if (srcv.sinfo_flags & MSG_SENDALL) {
7292                                 /* its a sendall */
7293                                 sctppcbinfo.mbuf_track--;
7294                                 sctp_m_freem(control);
7295                                 crit_exit();
7296                                 if (create_lock_applied) {
7297                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7298                                         create_lock_applied = 0;
7299                                 }
7300                                 return (sctp_sendall(inp, NULL, m, &srcv));
7301                         }
7302                         if (srcv.sinfo_assoc_id) {
7303                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7304                                         SCTP_INP_RLOCK(inp);
7305                                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7306                                         if (stcb)
7307                                                 SCTP_TCB_LOCK(stcb);
7308                                         SCTP_INP_RUNLOCK(inp);
7309
7310                                         if (stcb == NULL) {
7311                                                 if (create_lock_applied) {
7312                                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7313                                                         create_lock_applied = 0;
7314                                                 }
7315                                                 sctppcbinfo.mbuf_track--;
7316                                                 sctp_m_freem(control);
7317                                                 sctp_m_freem(m);
7318                                                 crit_exit();
7319                                                 return (ENOTCONN);
7320                                         }
7321                                         net = stcb->asoc.primary_destination;
7322                                 } else {
7323                                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7324                                 }
7325                                 /*
7326                                  * Question: Should I error here if the
7327
7328                                  * assoc_id is no longer valid?
7329                                  * i.e. I can't find it?
7330                                  */
7331                                 if ((stcb) &&
7332                                     (addr != NULL)) {
7333                                         /* Must locate the net structure */
7334                                         if (addr)
7335                                                 net = sctp_findnet(stcb, addr);
7336                                 }
7337                                 if (net == NULL)
7338                                         net = stcb->asoc.primary_destination;
7339                         }
7340                         use_rcvinfo = 1;
7341                 }
7342         }
7343         if (stcb == NULL) {
7344                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7345                         SCTP_INP_RLOCK(inp);
7346                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7347                         if (stcb)
7348                                 SCTP_TCB_LOCK(stcb);
7349                         SCTP_INP_RUNLOCK(inp);
7350                         if (stcb == NULL) {
7351                                 crit_exit();
7352                                 if (create_lock_applied) {
7353                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7354                                         create_lock_applied = 0;
7355                                 }
7356                                 if (control) {
7357                                         sctppcbinfo.mbuf_track--;
7358                                         sctp_m_freem(control);
7359                                         control = NULL;
7360                                 }
7361                                 sctp_m_freem(m);
7362                                 return (ENOTCONN);
7363                         }
7364                         if (addr == NULL) {
7365                                 net = stcb->asoc.primary_destination;
7366                         } else {
7367                                 net = sctp_findnet(stcb, addr);
7368                                 if (net == NULL) {
7369                                         net = stcb->asoc.primary_destination;
7370                                 }
7371                         }
7372                 } else {
7373                         if (addr != NULL) {
7374                                 SCTP_INP_WLOCK(inp);
7375                                 SCTP_INP_INCR_REF(inp);
7376                                 SCTP_INP_WUNLOCK(inp);
7377                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7378                                 if (stcb == NULL) {
7379                                         SCTP_INP_WLOCK(inp);
7380                                         SCTP_INP_DECR_REF(inp);
7381                                         SCTP_INP_WUNLOCK(inp);
7382                                 }
7383                         }
7384                 }
7385         }
7386         if ((stcb == NULL) &&
7387             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7388                 if (control) {
7389                         sctppcbinfo.mbuf_track--;
7390                         sctp_m_freem(control);
7391                         control = NULL;
7392                 }
7393                 if (create_lock_applied) {
7394                         SCTP_ASOC_CREATE_UNLOCK(inp);
7395                         create_lock_applied = 0;
7396                 }
7397                 sctp_m_freem(m);
7398                 crit_exit();
7399                 return (ENOTCONN);
7400         } else if ((stcb == NULL) &&
7401                    (addr == NULL)) {
7402                 if (control) {
7403                         sctppcbinfo.mbuf_track--;
7404                         sctp_m_freem(control);
7405                         control = NULL;
7406                 }
7407                 if (create_lock_applied) {
7408                         SCTP_ASOC_CREATE_UNLOCK(inp);
7409                         create_lock_applied = 0;
7410                 }
7411                 sctp_m_freem(m);
7412                 crit_exit();
7413                 return (ENOENT);
7414         } else if (stcb == NULL) {
7415                 /* UDP mode, we must go ahead and start the INIT process */
7416                 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7417                         /* Strange user to do this */
7418                         if (control) {
7419                                 sctppcbinfo.mbuf_track--;
7420                                 sctp_m_freem(control);
7421                                 control = NULL;
7422                         }
7423                         if (create_lock_applied) {
7424                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7425                                 create_lock_applied = 0;
7426                         }
7427                         sctp_m_freem(m);
7428                         crit_exit();
7429                         return (ENOENT);
7430                 }
7431                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7432                 if (stcb == NULL) {
7433                         if (control) {
7434                                 sctppcbinfo.mbuf_track--;
7435                                 sctp_m_freem(control);
7436                                 control = NULL;
7437                         }
7438                         if (create_lock_applied) {
7439                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7440                                 create_lock_applied = 0;
7441                         }
7442                         sctp_m_freem(m);
7443                         crit_exit();
7444                         return (error);
7445                 }
7446                 if (create_lock_applied) {
7447                         SCTP_ASOC_CREATE_UNLOCK(inp);
7448                         create_lock_applied = 0;
7449                 } else {
7450                         kprintf("Huh-1, create lock should have been applied!\n");
7451                 }
7452                 queue_only = 1;
7453                 asoc = &stcb->asoc;
7454                 asoc->state = SCTP_STATE_COOKIE_WAIT;
7455                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7456                 if (control) {
7457                         /* see if a init structure exists in cmsg headers */
7458                         struct sctp_initmsg initm;
7459                         int i;
7460                         if (sctp_find_cmsg(SCTP_INIT, &initm, control,
7461                                            sizeof(initm))) {
7462                                 /* we have an INIT override of the default */
7463                                 if (initm.sinit_max_attempts)
7464                                         asoc->max_init_times = initm.sinit_max_attempts;
7465                                 if (initm.sinit_num_ostreams)
7466                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
7467                                 if (initm.sinit_max_instreams)
7468                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
7469                                 if (initm.sinit_max_init_timeo)
7470                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7471                         }
7472                         if (asoc->streamoutcnt < asoc->pre_open_streams) {
7473                                 /* Default is NOT correct */
7474 #ifdef SCTP_DEBUG
7475                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7476                                         kprintf("Ok, defout:%d pre_open:%d\n",
7477                                                asoc->streamoutcnt, asoc->pre_open_streams);
7478                                 }
7479 #endif
7480                                 kfree(asoc->strmout, M_PCB);
7481                                 asoc->strmout = NULL;
7482                                 asoc->streamoutcnt = asoc->pre_open_streams;
7483                                 asoc->strmout = kmalloc(asoc->streamoutcnt * sizeof(struct sctp_stream_out),
7484                                                         M_PCB, M_WAITOK);
7485                                 for (i = 0; i < asoc->streamoutcnt; i++) {
7486                                         /*
7487                                          * inbound side must be set to 0xffff,
7488                                          * also NOTE when we get the INIT-ACK
7489                                          * back (for INIT sender) we MUST
7490                                          * reduce the count (streamoutcnt) but
7491                                          * first check if we sent to any of the
7492                                          * upper streams that were dropped (if
7493                                          * some were). Those that were dropped
7494                                          * must be notified to the upper layer
7495                                          * as failed to send.
7496                                          */
7497                                         asoc->strmout[i].next_sequence_sent = 0x0;
7498                                         TAILQ_INIT(&asoc->strmout[i].outqueue);
7499                                         asoc->strmout[i].stream_no = i;
7500                                         asoc->strmout[i].next_spoke.tqe_next = 0;
7501                                         asoc->strmout[i].next_spoke.tqe_prev = 0;
7502                                 }
7503                         }
7504                 }
7505                 sctp_send_initiate(inp, stcb);
7506                 /*
7507                  * we may want to dig in after this call and adjust the MTU
7508                  * value. It defaulted to 1500 (constant) but the ro structure
7509                  * may now have an update and thus we may need to change it
7510                  * BEFORE we append the message.
7511                  */
7512                 net = stcb->asoc.primary_destination;
7513         } else {
7514                 if (create_lock_applied) {
7515                         SCTP_ASOC_CREATE_UNLOCK(inp);
7516                         create_lock_applied = 0;
7517                 }
7518                 asoc = &stcb->asoc;
7519                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7520                     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7521                         queue_only = 1;
7522                 }
7523                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7524                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7525                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7526                     (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7527                         if (control) {
7528                                 sctppcbinfo.mbuf_track--;
7529                                 sctp_m_freem(control);
7530                                 control = NULL;
7531                         }
7532                         if ((use_rcvinfo) &&
7533                             (srcv.sinfo_flags & MSG_ABORT)) {
7534                                 sctp_msg_append(stcb, net, m, &srcv, flags);
7535                                 error = 0;
7536                         } else {
7537                                 if (m)
7538                                         sctp_m_freem(m);
7539                                 error = ECONNRESET;
7540                         }
7541                         crit_exit();
7542                         SCTP_TCB_UNLOCK(stcb);
7543                         return (error);
7544                 }
7545         }
7546         if (create_lock_applied) {
7547                 /* we should never hit here with the create lock applied
7548                  *
7549                  */
7550                 SCTP_ASOC_CREATE_UNLOCK(inp);
7551                 create_lock_applied = 0;
7552         }
7553
7554
7555         if (use_rcvinfo == 0) {
7556                 srcv = stcb->asoc.def_send;
7557         }
7558 #ifdef SCTP_DEBUG
7559         else {
7560                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7561                         kprintf("stream:%d\n", srcv.sinfo_stream);
7562                         kprintf("flags:%x\n", (u_int)srcv.sinfo_flags);
7563                         kprintf("ppid:%d\n", srcv.sinfo_ppid);
7564                         kprintf("context:%d\n", srcv.sinfo_context);
7565                 }
7566         }
7567 #endif
7568         if (control) {
7569                 sctppcbinfo.mbuf_track--;
7570                 sctp_m_freem(control);
7571                 control = NULL;
7572         }
7573         if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7574                 /* we take the override or the unconfirmed */
7575                 ;
7576         } else {
7577                 net = stcb->asoc.primary_destination;
7578         }
7579         if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7580                 SCTP_TCB_UNLOCK(stcb);
7581                 crit_exit();
7582                 return (error);
7583         }
7584         if (net->flight_size > net->cwnd) {
7585                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7586                 queue_only = 1;
7587         } else if (asoc->ifp_had_enobuf) {
7588                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7589                 queue_only = 1;
7590         } else {
7591                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7592                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7593                            SCTP_MED_OVERHEAD);
7594
7595                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7596                     (stcb->asoc.total_flight > 0) &&
7597                     (un_sent < (int)stcb->asoc.smallest_mtu)
7598                         ) {
7599
7600                         /* Ok, Nagle is set on and we have
7601                          * data outstanding. Don't send anything
7602                          * and let the SACK drive out the data.
7603                          */
7604                         sctp_pegs[SCTP_NAGLE_NOQ]++;
7605                         queue_only = 1;
7606                 } else {
7607                         sctp_pegs[SCTP_NAGLE_OFF]++;
7608                 }
7609         }
7610         if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7611                 /* we can attempt to send too.*/
7612 #ifdef SCTP_DEBUG
7613                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7614                         kprintf("USR Send calls sctp_chunk_output\n");
7615                 }
7616 #endif
7617 #ifdef SCTP_AUDITING_ENABLED
7618                 sctp_audit_log(0xC0, 1);
7619                 sctp_auditing(6, inp, stcb, net);
7620 #endif
7621                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7622                 sctp_chunk_output(inp, stcb, 0);
7623 #ifdef SCTP_AUDITING_ENABLED
7624                 sctp_audit_log(0xC0, 2);
7625                 sctp_auditing(7, inp, stcb, net);
7626 #endif
7627
7628         }
7629 #ifdef SCTP_DEBUG
7630         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7631                 kprintf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7632         }
7633 #endif
7634         SCTP_TCB_UNLOCK(stcb);
7635         crit_exit();
7636         return (0);
7637 }
7638
7639 void
7640 send_forward_tsn(struct sctp_tcb *stcb,
7641                  struct sctp_association *asoc)
7642 {
7643         struct sctp_tmit_chunk *chk;
7644         struct sctp_forward_tsn_chunk *fwdtsn;
7645
7646         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7647                 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7648                         /* mark it to unsent */
7649                         chk->sent = SCTP_DATAGRAM_UNSENT;
7650                         chk->snd_count = 0;
7651                         /* Do we correct its output location? */
7652                         if (chk->whoTo != asoc->primary_destination) {
7653                                 sctp_free_remote_addr(chk->whoTo);
7654                                 chk->whoTo = asoc->primary_destination;
7655                                 chk->whoTo->ref_count++;
7656                         }
7657                         goto sctp_fill_in_rest;
7658                 }
7659         }
7660         /* Ok if we reach here we must build one */
7661         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7662         if (chk == NULL) {
7663                 return;
7664         }
7665         sctppcbinfo.ipi_count_chunk++;
7666         sctppcbinfo.ipi_gencnt_chunk++;
7667         chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7668         chk->asoc = asoc;
7669         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
7670         if (chk->data == NULL) {
7671                 chk->whoTo->ref_count--;
7672                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7673                 sctppcbinfo.ipi_count_chunk--;
7674                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7675                         panic("Chunk count is negative");
7676                 }
7677                 sctppcbinfo.ipi_gencnt_chunk++;
7678                 return;
7679         }
7680         chk->data->m_data += SCTP_MIN_OVERHEAD;
7681         chk->sent = SCTP_DATAGRAM_UNSENT;
7682         chk->snd_count = 0;
7683         chk->whoTo = asoc->primary_destination;
7684         chk->whoTo->ref_count++;
7685         TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7686         asoc->ctrl_queue_cnt++;
7687  sctp_fill_in_rest:
7688         /* Here we go through and fill out the part that
7689          * deals with stream/seq of the ones we skip.
7690          */
7691         chk->data->m_pkthdr.len = chk->data->m_len = 0;
7692         {
7693                 struct sctp_tmit_chunk *at, *tp1, *last;
7694                 struct sctp_strseq *strseq;
7695                 unsigned int cnt_of_space, i, ovh;
7696                 unsigned int space_needed;
7697                 unsigned int cnt_of_skipped = 0;
7698                 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7699                         if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7700                                 /* no more to look at */
7701                                 break;
7702                         }
7703                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7704                                 /* We don't report these */
7705                                 continue;
7706                         }
7707                         cnt_of_skipped++;
7708                 }
7709                 space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7710                                 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7711                 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7712                     ((chk->data->m_flags & M_EXT) == 0)) {
7713                         /* Need a M_EXT, get one and move
7714                          * fwdtsn to data area.
7715                          */
7716                         MCLGET(chk->data, MB_DONTWAIT);
7717                 }
7718                 cnt_of_space = M_TRAILINGSPACE(chk->data);
7719
7720                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7721                         ovh = SCTP_MIN_OVERHEAD;
7722                 } else {
7723                         ovh = SCTP_MIN_V4_OVERHEAD;
7724                 }
7725                 if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7726                         /* trim to a mtu size */
7727                         cnt_of_space = asoc->smallest_mtu - ovh;
7728                 }
7729                 if (cnt_of_space < space_needed) {
7730                         /* ok we must trim down the chunk by lowering
7731                          * the advance peer ack point.
7732                          */
7733                         cnt_of_skipped = (cnt_of_space-
7734                                           ((sizeof(struct sctp_forward_tsn_chunk))/
7735                                             sizeof(struct sctp_strseq)));
7736                         /* Go through and find the TSN that
7737                          * will be the one we report.
7738                          */
7739                         at = TAILQ_FIRST(&asoc->sent_queue);
7740                         for (i = 0; i < cnt_of_skipped; i++) {
7741                                 tp1 = TAILQ_NEXT(at, sctp_next);
7742                                 at = tp1;
7743                         }
7744                         last = at;
7745                         /* last now points to last one I can report, update peer ack point */
7746                         asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7747                         space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7748                 }
7749                 chk->send_size = space_needed;
7750                 /* Setup the chunk */
7751                 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7752                 fwdtsn->ch.chunk_length = htons(chk->send_size);
7753                 fwdtsn->ch.chunk_flags = 0;
7754                 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7755                 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7756                 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7757                                   (cnt_of_skipped * sizeof(struct sctp_strseq)));
7758                 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7759                 fwdtsn++;
7760                 /* Move pointer to after the fwdtsn and transfer to
7761                  * the strseq pointer.
7762                  */
7763                 strseq = (struct sctp_strseq *)fwdtsn;
7764                 /*
7765                  * Now populate the strseq list. This is done blindly
7766                  * without pulling out duplicate stream info. This is
7767                  * inefficent but won't harm the process since the peer
7768                  * will look at these in sequence and will thus release
7769                  * anything. It could mean we exceed the PMTU and chop
7770                  * off some that we could have included.. but this is
7771                  * unlikely (aka 1432/4 would mean 300+ stream seq's would
7772                  * have to be reported in one FWD-TSN. With a bit of work
7773                  * we can later FIX this to optimize and pull out duplcates..
7774                  * but it does add more overhead. So for now... not!
7775                  */
7776                 at = TAILQ_FIRST(&asoc->sent_queue);
7777                 for (i = 0; i < cnt_of_skipped; i++) {
7778                         tp1 = TAILQ_NEXT(at, sctp_next);
7779                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7780                                 /* We don't report these */
7781                                 i--;
7782                                 at = tp1;
7783                                 continue;
7784                         }
7785                         strseq->stream = ntohs(at->rec.data.stream_number);
7786                         strseq->sequence = ntohs(at->rec.data.stream_seq);
7787                         strseq++;
7788                         at = tp1;
7789                 }
7790         }
7791         return;
7792
7793 }
7794
7795 void
7796 sctp_send_sack(struct sctp_tcb *stcb)
7797 {
7798         /*
7799          * Queue up a SACK in the control queue. We must first check to
7800          * see if a SACK is somehow on the control queue. If so, we will
7801          * take and and remove the old one.
7802          */
7803         struct sctp_association *asoc;
7804         struct sctp_tmit_chunk *chk, *a_chk;
7805         struct sctp_sack_chunk *sack;
7806         struct sctp_gap_ack_block *gap_descriptor;
7807         uint32_t *dup;
7808         int start;
7809         unsigned int i, maxi, seeing_ones, m_size;
7810         unsigned int num_gap_blocks, space;
7811
7812         start = maxi = 0;
7813         seeing_ones = 1;
7814         a_chk = NULL;
7815         asoc = &stcb->asoc;
7816         if (asoc->last_data_chunk_from == NULL) {
7817                 /* Hmm we never received anything */
7818                 return;
7819         }
7820         sctp_set_rwnd(stcb, asoc);
7821         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7822                 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7823                         /* Hmm, found a sack already on queue, remove it */
7824                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7825                         asoc->ctrl_queue_cnt++;
7826                         a_chk = chk;
7827                         if (a_chk->data)
7828                                 sctp_m_freem(a_chk->data);
7829                         a_chk->data = NULL;
7830                         sctp_free_remote_addr(a_chk->whoTo);
7831                         a_chk->whoTo = NULL;
7832                         break;
7833                 }
7834         }
7835         if (a_chk == NULL) {
7836                 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7837                 if (a_chk == NULL) {
7838                         /* No memory so we drop the idea, and set a timer */
7839                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7840                                         stcb->sctp_ep, stcb, NULL);
7841                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7842                                          stcb->sctp_ep, stcb, NULL);
7843                         return;
7844                 }
7845                 sctppcbinfo.ipi_count_chunk++;
7846                 sctppcbinfo.ipi_gencnt_chunk++;
7847                 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7848         }
7849         a_chk->asoc = asoc;
7850         a_chk->snd_count = 0;
7851         a_chk->send_size = 0;   /* fill in later */
7852         a_chk->sent = SCTP_DATAGRAM_UNSENT;
7853         m_size = (asoc->mapping_array_size << 3);
7854
7855         if ((asoc->numduptsns) ||
7856             (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7857                 ) {
7858                 /* Ok, we have some duplicates or the destination for the
7859                  * sack is unreachable, lets see if we can select an alternate
7860                  * than asoc->last_data_chunk_from
7861                  */
7862                 if ((!(asoc->last_data_chunk_from->dest_state &
7863                       SCTP_ADDR_NOT_REACHABLE)) &&
7864                     (asoc->used_alt_onsack > 2)) {
7865                         /* We used an alt last time, don't this time */
7866                         a_chk->whoTo = NULL;
7867                 } else {
7868                         asoc->used_alt_onsack++;
7869                         a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7870                 }
7871                 if (a_chk->whoTo == NULL) {
7872                         /* Nope, no alternate */
7873                         a_chk->whoTo = asoc->last_data_chunk_from;
7874                         asoc->used_alt_onsack = 0;
7875                 }
7876         } else {
7877                 /* No duplicates so we use the last
7878                  * place we received data from.
7879                  */
7880 #ifdef SCTP_DEBUG
7881                 if (asoc->last_data_chunk_from == NULL) {
7882                         kprintf("Huh, last_data_chunk_from is null when we want to sack??\n");
7883                 }
7884 #endif
7885                 asoc->used_alt_onsack = 0;
7886                 a_chk->whoTo = asoc->last_data_chunk_from;
7887         }
7888         if (a_chk->whoTo)
7889                 a_chk->whoTo->ref_count++;
7890
7891         /* Ok now lets formulate a MBUF with our sack */
7892         MGETHDR(a_chk->data, MB_DONTWAIT, MT_DATA);
7893         if ((a_chk->data == NULL) ||
7894             (a_chk->whoTo == NULL)) {
7895                 /* rats, no mbuf memory */
7896                 if (a_chk->data) {
7897                         /* was a problem with the destination */
7898                         sctp_m_freem(a_chk->data);
7899                         a_chk->data = NULL;
7900                 }
7901                 a_chk->whoTo->ref_count--;
7902                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7903                 sctppcbinfo.ipi_count_chunk--;
7904                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7905                         panic("Chunk count is negative");
7906                 }
7907                 sctppcbinfo.ipi_gencnt_chunk++;
7908                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7909                                 stcb->sctp_ep, stcb, NULL);
7910                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7911                                  stcb->sctp_ep, stcb, NULL);
7912                 return;
7913         }
7914         /* First count the number of gap ack blocks we need */
7915         if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7916                 /* We know if there are none above the cum-ack we
7917                  * have everything with NO gaps
7918                  */
7919                 num_gap_blocks = 0;
7920         } else {
7921                 /* Ok we must count how many gaps we
7922                  * have.
7923                  */
7924                 num_gap_blocks = 0;
7925                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7926                         maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7927                 } else {
7928                         maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7929                 }
7930                 if (maxi > m_size) {
7931                         /* impossible but who knows, someone is playing with us  :> */
7932 #ifdef SCTP_DEBUG
7933                         kprintf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7934                                maxi,
7935                                m_size,
7936                                asoc->highest_tsn_inside_map,
7937                                asoc->mapping_array_base_tsn,
7938                                asoc->cumulative_tsn
7939                                );
7940 #endif
7941                         num_gap_blocks = 0;
7942                         goto no_gaps_now;
7943                 }
7944                 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7945                         start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7946                 } else {
7947                         /* Set it so we start at 0 */
7948                         start = -1;
7949                 }
7950                 /* Ok move start up one to look at the NEXT past the cum-ack */
7951                 start++;
7952                 for (i = start; i <= maxi; i++) {
7953                         if (seeing_ones) {
7954                                 /* while seeing ones I must
7955                                  * transition back to 0 before
7956                                  * finding the next gap and
7957                                  * counting the segment.
7958                                  */
7959                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7960                                         seeing_ones = 0;
7961                                 }
7962                         } else {
7963                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7964                                         seeing_ones = 1;
7965                                         num_gap_blocks++;
7966                                 }
7967                         }
7968                 }
7969         no_gaps_now:
7970                 if (num_gap_blocks == 0) {
7971                         /*
7972                          * Traveled all of the bits and NO one,
7973                          * must have reneged
7974                          */
7975                         if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
7976                            asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
7977 #ifdef SCTP_MAP_LOGGING
7978                            sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
7979 #endif
7980                         }
7981                 }
7982         }
7983
7984         /* Now calculate the space needed */
7985         space = (sizeof(struct sctp_sack_chunk) +
7986                  (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7987                  (asoc->numduptsns * sizeof(int32_t))
7988                 );
7989         if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
7990                 /* Reduce the size of the sack to fit */
7991                 int calc, fit;
7992                 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
7993                 calc -= sizeof(struct sctp_gap_ack_block);
7994                 fit = calc/sizeof(struct sctp_gap_ack_block);
7995                 if (fit > (int)num_gap_blocks) {
7996                         /* discard some dups */
7997                         asoc->numduptsns = (fit - num_gap_blocks);
7998                 } else {
7999                         /* discard all dups and some gaps */
8000                         num_gap_blocks = fit;
8001                         asoc->numduptsns = 0;
8002                 }
8003                 /* recalc space */
8004                 space = (sizeof(struct sctp_sack_chunk) +
8005                          (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8006                          (asoc->numduptsns * sizeof(int32_t))
8007                         );
8008
8009         }
8010
8011         if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
8012                 /* We need a cluster */
8013                 MCLGET(a_chk->data, MB_DONTWAIT);
8014                 if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
8015                         /* can't get a cluster
8016                          * give up and try later.
8017                          */
8018                         if (a_chk->data)
8019                                 sctp_m_freem(a_chk->data);
8020                         a_chk->data = NULL;
8021                         a_chk->whoTo->ref_count--;
8022                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
8023                         sctppcbinfo.ipi_count_chunk--;
8024                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8025                                 panic("Chunk count is negative");
8026                         }
8027                         sctppcbinfo.ipi_gencnt_chunk++;
8028                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
8029                                         stcb->sctp_ep, stcb, NULL);
8030                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
8031                                          stcb->sctp_ep, stcb, NULL);
8032                         return;
8033                 }
8034         }
8035
8036         /* ok, lets go through and fill it in */
8037         a_chk->data->m_data += SCTP_MIN_OVERHEAD;
8038         sack = mtod(a_chk->data, struct sctp_sack_chunk *);
8039         sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
8040         sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
8041         sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
8042         sack->sack.a_rwnd = htonl(asoc->my_rwnd);
8043         asoc->my_last_reported_rwnd = asoc->my_rwnd;
8044         sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
8045         sack->sack.num_dup_tsns = htons(asoc->numduptsns);
8046
8047         a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
8048                             (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8049                             (asoc->numduptsns * sizeof(int32_t)));
8050         a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
8051         sack->ch.chunk_length = htons(a_chk->send_size);
8052
8053         gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
8054         seeing_ones = 0;
8055         for (i = start; i <= maxi; i++) {
8056                 if (num_gap_blocks == 0) {
8057                         break;
8058                 }
8059                 if (seeing_ones) {
8060                         /* while seeing Ones I must
8061                          * transition back to 0 before
8062                          * finding the next gap
8063                          */
8064                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
8065                                 gap_descriptor->end = htons(((uint16_t)(i-start)));
8066                                 gap_descriptor++;
8067                                 seeing_ones = 0;
8068                                 num_gap_blocks--;
8069                         }
8070                 } else {
8071                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
8072                                 gap_descriptor->start = htons(((uint16_t)(i+1-start)));
8073                                 /* advance struct to next pointer */
8074                                 seeing_ones = 1;
8075                         }
8076                 }
8077         }
8078         if (num_gap_blocks) {
8079                 /* special case where the array is all 1's
8080                  * to the end of the array.
8081                  */
8082                 gap_descriptor->end = htons(((uint16_t)((i-start))));
8083                 gap_descriptor++;
8084         }
8085         /* now we must add any dups we are going to report. */
8086         if (asoc->numduptsns) {
8087                 dup = (uint32_t *)gap_descriptor;
8088                 for (i = 0; i < asoc->numduptsns; i++) {
8089                         *dup = htonl(asoc->dup_tsns[i]);
8090                         dup++;
8091                 }
8092                 asoc->numduptsns = 0;
8093         }
8094         /* now that the chunk is prepared queue it to the control
8095          * chunk queue.
8096          */
8097         TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
8098         asoc->ctrl_queue_cnt++;
8099         sctp_pegs[SCTP_PEG_SACKS_SENT]++;
8100         return;
8101 }
8102
8103 void
8104 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
8105 {
8106         struct mbuf *m_abort;
8107         struct sctp_abort_msg *abort_m;
8108         int sz;
8109         abort_m = NULL;
8110         MGETHDR(m_abort, MB_DONTWAIT, MT_HEADER);
8111         if (m_abort == NULL) {
8112                 /* no mbuf's */
8113                 return;
8114         }
8115         m_abort->m_data += SCTP_MIN_OVERHEAD;
8116         abort_m = mtod(m_abort, struct sctp_abort_msg *);
8117         m_abort->m_len = sizeof(struct sctp_abort_msg);
8118         m_abort->m_next = operr;
8119         sz = 0;
8120         if (operr) {
8121                 struct mbuf *n;
8122                 n = operr;
8123                 while (n) {
8124                         sz += n->m_len;
8125                         n = n->m_next;
8126                 }
8127         }
8128         abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8129         abort_m->msg.ch.chunk_flags = 0;
8130         abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8131                                              sz);
8132         abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8133         abort_m->sh.dest_port = stcb->rport;
8134         abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8135         abort_m->sh.checksum = 0;
8136         m_abort->m_pkthdr.len = m_abort->m_len + sz;
8137         m_abort->m_pkthdr.rcvif = 0;
8138         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8139             stcb->asoc.primary_destination,
8140             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
8141             m_abort, 1, 0, NULL, 0);
8142 }
8143
8144 int
8145 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8146                             struct sctp_nets *net)
8147
8148 {
8149         /* formulate and SEND a SHUTDOWN-COMPLETE */
8150         struct mbuf *m_shutdown_comp;
8151         struct sctp_shutdown_complete_msg *comp_cp;
8152
8153         m_shutdown_comp = NULL;
8154         MGETHDR(m_shutdown_comp, MB_DONTWAIT, MT_HEADER);
8155         if (m_shutdown_comp == NULL) {
8156                 /* no mbuf's */
8157                 return (-1);
8158         }
8159         m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8160         comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8161         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8162         comp_cp->shut_cmp.ch.chunk_flags = 0;
8163         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8164         comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8165         comp_cp->sh.dest_port = stcb->rport;
8166         comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8167         comp_cp->sh.checksum = 0;
8168
8169         m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8170         m_shutdown_comp->m_pkthdr.rcvif = 0;
8171         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8172             (struct sockaddr *)&net->ro._l_addr, m_shutdown_comp,
8173             1, 0, NULL, 0);
8174         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8175             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8176                 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8177                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
8178                 soisdisconnected(stcb->sctp_ep->sctp_socket);
8179         }
8180         return (0);
8181 }
8182
8183 int
8184 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8185 {
8186         /* formulate and SEND a SHUTDOWN-COMPLETE */
8187         struct mbuf *mout;
8188         struct ip *iph, *iph_out;
8189         struct ip6_hdr *ip6, *ip6_out;
8190         int offset_out;
8191         struct sctp_shutdown_complete_msg *comp_cp;
8192
8193         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
8194         if (mout == NULL) {
8195                 /* no mbuf's */
8196                 return (-1);
8197         }
8198         iph = mtod(m, struct ip *);
8199         iph_out = NULL;
8200         ip6_out = NULL;
8201         offset_out = 0;
8202         if (iph->ip_v == IPVERSION) {
8203                 mout->m_len = sizeof(struct ip) +
8204                     sizeof(struct sctp_shutdown_complete_msg);
8205                 mout->m_next = NULL;
8206                 iph_out = mtod(mout, struct ip *);
8207
8208                 /* Fill in the IP header for the ABORT */
8209                 iph_out->ip_v = IPVERSION;
8210                 iph_out->ip_hl = (sizeof(struct ip)/4);
8211                 iph_out->ip_tos = (u_char)0;
8212                 iph_out->ip_id = 0;
8213                 iph_out->ip_off = 0;
8214                 iph_out->ip_ttl = MAXTTL;
8215                 iph_out->ip_p = IPPROTO_SCTP;
8216                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8217                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8218
8219                 /* let IP layer calculate this */
8220                 iph_out->ip_sum = 0;
8221                 offset_out += sizeof(*iph_out);
8222                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8223                     (caddr_t)iph_out + offset_out);
8224         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8225                 ip6 = (struct ip6_hdr *)iph;
8226                 mout->m_len = sizeof(struct ip6_hdr) +
8227                     sizeof(struct sctp_shutdown_complete_msg);
8228                 mout->m_next = NULL;
8229                 ip6_out = mtod(mout, struct ip6_hdr *);
8230
8231                 /* Fill in the IPv6 header for the ABORT */
8232                 ip6_out->ip6_flow = ip6->ip6_flow;
8233                 ip6_out->ip6_hlim = ip6_defhlim;
8234                 ip6_out->ip6_nxt = IPPROTO_SCTP;
8235                 ip6_out->ip6_src = ip6->ip6_dst;
8236                 ip6_out->ip6_dst = ip6->ip6_src;
8237                 ip6_out->ip6_plen = mout->m_len;
8238                 offset_out += sizeof(*ip6_out);
8239                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8240                     (caddr_t)ip6_out + offset_out);
8241         } else {
8242                 /* Currently not supported. */
8243                 return (-1);
8244         }
8245
8246         /* Now copy in and fill in the ABORT tags etc. */
8247         comp_cp->sh.src_port = sh->dest_port;
8248         comp_cp->sh.dest_port = sh->src_port;
8249         comp_cp->sh.checksum = 0;
8250         comp_cp->sh.v_tag = sh->v_tag;
8251         comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8252         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8253         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8254
8255         mout->m_pkthdr.len = mout->m_len;
8256         /* add checksum */
8257         if ((sctp_no_csum_on_loopback) &&
8258            (m->m_pkthdr.rcvif) &&
8259            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
8260                 comp_cp->sh.checksum =  0;
8261         } else {
8262                 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8263         }
8264
8265         /* zap the rcvif, it should be null */
8266         mout->m_pkthdr.rcvif = 0;
8267         /* zap the stack pointer to the route */
8268         if (iph_out != NULL) {
8269                 struct route ro;
8270
8271                 bzero(&ro, sizeof ro);
8272 #ifdef SCTP_DEBUG
8273                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8274                         kprintf("sctp_shutdown_complete2 calling ip_output:\n");
8275                         sctp_print_address_pkt(iph_out, &comp_cp->sh);
8276                 }
8277 #endif
8278                 /* set IPv4 length */
8279 #if defined(__FreeBSD__)
8280                 iph_out->ip_len = mout->m_pkthdr.len;
8281 #else
8282                 iph_out->ip_len = htons(mout->m_pkthdr.len);
8283 #endif
8284                 /* out it goes */
8285                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
8286 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
8287     || defined(__NetBSD__) || defined(__DragonFly__)
8288                     , NULL
8289 #endif
8290                     );
8291                 /* Free the route if we got one back */
8292                 if (ro.ro_rt)
8293                         RTFREE(ro.ro_rt);
8294         } else if (ip6_out != NULL) {
8295 #ifdef NEW_STRUCT_ROUTE
8296                 struct route ro;
8297 #else
8298                 struct route_in6 ro;
8299 #endif
8300
8301                 bzero(&ro, sizeof(ro));
8302 #ifdef SCTP_DEBUG
8303                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8304                         kprintf("sctp_shutdown_complete2 calling ip6_output:\n");
8305                         sctp_print_address_pkt((struct ip *)ip6_out,
8306                             &comp_cp->sh);
8307                 }
8308 #endif
8309                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
8310 #if defined(__NetBSD__)
8311                            , NULL
8312 #endif
8313 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
8314                            , NULL
8315 #endif
8316                     );
8317                 /* Free the route if we got one back */
8318                 if (ro.ro_rt)
8319                         RTFREE(ro.ro_rt);
8320         }
8321         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8322         return (0);
8323 }
8324
8325 static struct sctp_nets *
8326 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8327 {
8328         struct sctp_nets *net, *hnet;
8329         int ms_goneby, highest_ms, state_overide=0;
8330
8331         SCTP_GETTIME_TIMEVAL(now);
8332         highest_ms = 0;
8333         hnet = NULL;
8334         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8335                 if (
8336                         ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8337                         (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8338                         ) {
8339                         /* Skip this guy from consideration if HB is off AND its confirmed*/
8340 #ifdef SCTP_DEBUG
8341                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8342                                 kprintf("Skipping net:%p state:%d nohb/out-of-scope\n",
8343                                        net, net->dest_state);
8344                         }
8345 #endif
8346                         continue;
8347                 }
8348                 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
8349                         /* skip this dest net from consideration */
8350 #ifdef SCTP_DEBUG
8351                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8352                                 kprintf("Skipping net:%p reachable NOT\n",
8353                                        net);
8354                         }
8355 #endif
8356                         continue;
8357                 }
8358                 if (net->last_sent_time.tv_sec) {
8359                         /* Sent to so we subtract */
8360                         ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8361                 } else
8362                         /* Never been sent to */
8363                         ms_goneby = 0x7fffffff;
8364 #ifdef SCTP_DEBUG
8365                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8366                         kprintf("net:%p ms_goneby:%d\n",
8367                                net, ms_goneby);
8368                 }
8369 #endif
8370                 /* When the address state is unconfirmed but still considered reachable, we
8371                  * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8372                  * state, thenw we cut it back to HB at a more normal pace.
8373                  */
8374                 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8375                         state_overide = 1;
8376                 } else {
8377                         state_overide = 0;
8378                 }
8379
8380                 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8381                     (ms_goneby > highest_ms)) {
8382                         highest_ms = ms_goneby;
8383                         hnet = net;
8384 #ifdef SCTP_DEBUG
8385                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8386                                 kprintf("net:%p is the new high\n",
8387                                        net);
8388                         }
8389 #endif
8390                 }
8391         }
8392         if (hnet &&
8393            ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8394                 state_overide = 1;
8395         } else {
8396                 state_overide = 0;
8397         }
8398
8399         if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8400                 /* Found the one with longest delay bounds
8401                  * OR it is unconfirmed and still not marked
8402                  * unreachable.
8403                  */
8404 #ifdef SCTP_DEBUG
8405                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8406                         kprintf("net:%p is the hb winner -",
8407                                 hnet);
8408                         if (hnet)
8409                                 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr);
8410                         else
8411                                 kprintf(" none\n");
8412                 }
8413 #endif
8414                 /* update the timer now */
8415                 hnet->last_sent_time = *now;
8416                 return (hnet);
8417         }
8418         /* Nothing to HB */
8419         return (NULL);
8420 }
8421
8422 int
8423 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8424 {
8425         struct sctp_tmit_chunk *chk;
8426         struct sctp_nets *net;
8427         struct sctp_heartbeat_chunk *hb;
8428         struct timeval now;
8429         struct sockaddr_in *sin;
8430         struct sockaddr_in6 *sin6;
8431
8432         if (user_req == 0) {
8433                 net = sctp_select_hb_destination(stcb, &now);
8434                 if (net == NULL) {
8435                         /* All our busy none to send to, just
8436                          * start the timer again.
8437                          */
8438                         if (stcb->asoc.state == 0) {
8439                                 return (0);
8440                         }
8441                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8442                                          stcb->sctp_ep,
8443                                          stcb,
8444                                          net);
8445                         return (0);
8446                 }
8447 #ifndef SCTP_USE_ALLMAN_BURST
8448                 else {
8449                         /* found one idle.. decay cwnd on this one
8450                          * by 1/2 if none outstanding.
8451                          */
8452
8453                         if (net->flight_size == 0) {
8454                                 net->cwnd /= 2;
8455                                 if (net->addr_is_local) {
8456                                         if (net->cwnd < (net->mtu *4)) {
8457                                                 net->cwnd = net->mtu * 4;
8458                                         }
8459                                 } else {
8460                                         if (net->cwnd < (net->mtu * 2)) {
8461                                                 net->cwnd = net->mtu * 2;
8462                                         }
8463                                 }
8464
8465                         }
8466
8467                 }
8468 #endif
8469         } else {
8470                 net = u_net;
8471                 if (net == NULL) {
8472                         return (0);
8473                 }
8474                 SCTP_GETTIME_TIMEVAL(&now);
8475         }
8476         sin = (struct sockaddr_in *)&net->ro._l_addr;
8477         if (sin->sin_family != AF_INET) {
8478                 if (sin->sin_family != AF_INET6) {
8479                         /* huh */
8480                         return (0);
8481                 }
8482         }
8483         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8484         if (chk == NULL) {
8485 #ifdef SCTP_DEBUG
8486                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8487                         kprintf("Gak, can't get a chunk for hb\n");
8488                 }
8489 #endif
8490                 return (0);
8491         }
8492         sctppcbinfo.ipi_gencnt_chunk++;
8493         sctppcbinfo.ipi_count_chunk++;
8494         chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8495         chk->asoc = &stcb->asoc;
8496         chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8497         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8498         if (chk->data == NULL) {
8499                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8500                 sctppcbinfo.ipi_count_chunk--;
8501                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8502                         panic("Chunk count is negative");
8503                 }
8504                 sctppcbinfo.ipi_gencnt_chunk++;
8505                 return (0);
8506         }
8507         chk->data->m_data += SCTP_MIN_OVERHEAD;
8508         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8509         chk->sent = SCTP_DATAGRAM_UNSENT;
8510         chk->snd_count = 0;
8511         chk->whoTo = net;
8512         chk->whoTo->ref_count++;
8513         /* Now we have a mbuf that we can fill in with the details */
8514         hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8515
8516         /* fill out chunk header */
8517         hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8518         hb->ch.chunk_flags = 0;
8519         hb->ch.chunk_length = htons(chk->send_size);
8520         /* Fill out hb parameter */
8521         hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8522         hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8523         hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8524         hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8525         /* Did our user request this one, put it in */
8526         hb->heartbeat.hb_info.user_req = user_req;
8527         hb->heartbeat.hb_info.addr_family = sin->sin_family;
8528         hb->heartbeat.hb_info.addr_len = sin->sin_len;
8529         if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8530                 /* we only take from the entropy pool if the address is
8531                  * not confirmed.
8532                  */
8533                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8534                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8535         } else {
8536                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8537                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8538         }
8539         if (sin->sin_family == AF_INET) {
8540                 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8541         } else if (sin->sin_family == AF_INET6) {
8542                 /* We leave the scope the way it is in our lookup table. */
8543                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
8544                 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8545         } else {
8546                 /* huh compiler bug */
8547 #ifdef SCTP_DEBUG
8548                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8549                         kprintf("Compiler bug bleeds a mbuf and a chunk\n");
8550                 }
8551 #endif
8552                 return (0);
8553         }
8554         /* ok we have a destination that needs a beat */
8555         /* lets do the theshold management Qiaobing style */
8556         if (user_req == 0) {
8557                 if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8558                                               stcb->asoc.max_send_times)) {
8559                         /* we have lost the association, in a way this
8560                          * is quite bad since we really are one less time
8561                          * since we really did not send yet. This is the
8562                          * down side to the Q's style as defined in the RFC
8563                          * and not my alternate style defined in the RFC.
8564                          */
8565                         if (chk->data != NULL) {
8566                                 sctp_m_freem(chk->data);
8567                                 chk->data = NULL;
8568                         }
8569                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8570                         sctppcbinfo.ipi_count_chunk--;
8571                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8572                                 panic("Chunk count is negative");
8573                         }
8574                         sctppcbinfo.ipi_gencnt_chunk++;
8575                         return (-1);
8576                 }
8577         }
8578         net->hb_responded = 0;
8579 #ifdef SCTP_DEBUG
8580         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8581                 kprintf("Inserting chunk for HB\n");
8582         }
8583 #endif
8584         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8585         stcb->asoc.ctrl_queue_cnt++;
8586         sctp_pegs[SCTP_HB_SENT]++;
8587         /*
8588          * Call directly med level routine to put out the chunk. It will
8589          * always tumble out control chunks aka HB but it may even tumble
8590          * out data too.
8591          */
8592         if (user_req == 0) {
8593                 /* Ok now lets start the HB timer if it is NOT a user req */
8594                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8595                                  stcb, net);
8596         }
8597         return (1);
8598 }
8599
8600 void
8601 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8602                    uint32_t high_tsn)
8603 {
8604         struct sctp_association *asoc;
8605         struct sctp_ecne_chunk *ecne;
8606         struct sctp_tmit_chunk *chk;
8607         asoc = &stcb->asoc;
8608         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8609                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8610                         /* found a previous ECN_ECHO update it if needed */
8611                         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8612                         ecne->tsn = htonl(high_tsn);
8613                         return;
8614                 }
8615         }
8616         /* nope could not find one to update so we must build one */
8617         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8618         if (chk == NULL) {
8619                 return;
8620         }
8621         sctp_pegs[SCTP_ECNE_SENT]++;
8622         sctppcbinfo.ipi_count_chunk++;
8623         sctppcbinfo.ipi_gencnt_chunk++;
8624         chk->rec.chunk_id = SCTP_ECN_ECHO;
8625         chk->asoc = &stcb->asoc;
8626         chk->send_size = sizeof(struct sctp_ecne_chunk);
8627         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8628         if (chk->data == NULL) {
8629                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8630                 sctppcbinfo.ipi_count_chunk--;
8631                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8632                         panic("Chunk count is negative");
8633                 }
8634                 sctppcbinfo.ipi_gencnt_chunk++;
8635                 return;
8636         }
8637         chk->data->m_data += SCTP_MIN_OVERHEAD;
8638         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8639         chk->sent = SCTP_DATAGRAM_UNSENT;
8640         chk->snd_count = 0;
8641         chk->whoTo = net;
8642         chk->whoTo->ref_count++;
8643         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8644         ecne->ch.chunk_type = SCTP_ECN_ECHO;
8645         ecne->ch.chunk_flags = 0;
8646         ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8647         ecne->tsn = htonl(high_tsn);
8648         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8649         asoc->ctrl_queue_cnt++;
8650 }
8651
8652 void
8653 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8654                          struct mbuf *m, int iphlen, int bad_crc)
8655 {
8656         struct sctp_association *asoc;
8657         struct sctp_pktdrop_chunk *drp;
8658         struct sctp_tmit_chunk *chk;
8659         uint8_t *datap;
8660         int len;
8661         unsigned int small_one;
8662         struct ip *iph;
8663
8664         long spc;
8665         asoc = &stcb->asoc;
8666         if (asoc->peer_supports_pktdrop == 0) {
8667                 /* peer must declare support before I
8668                  * send one.
8669                  */
8670                 return;
8671         }
8672         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8673         if (chk == NULL) {
8674                 return;
8675         }
8676         sctppcbinfo.ipi_count_chunk++;
8677         sctppcbinfo.ipi_gencnt_chunk++;
8678
8679         iph = mtod(m, struct ip *);
8680         if (iph == NULL) {
8681                 return;
8682         }
8683         if (iph->ip_v == IPVERSION) {
8684                 /* IPv4 */
8685 #if defined(__FreeBSD__)
8686                 len = chk->send_size = iph->ip_len;
8687 #else
8688                 len = chk->send_size = (iph->ip_len - iphlen);
8689 #endif
8690         } else {
8691                 struct ip6_hdr *ip6h;
8692                 /* IPv6 */
8693                 ip6h = mtod(m, struct ip6_hdr *);
8694                 len = chk->send_size = htons(ip6h->ip6_plen);
8695         }
8696         if ((len+iphlen) > m->m_pkthdr.len) {
8697                 /* huh */
8698                 chk->send_size = len = m->m_pkthdr.len - iphlen;
8699         }
8700         chk->asoc = &stcb->asoc;
8701         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8702         if (chk->data == NULL) {
8703         jump_out:
8704                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8705                 sctppcbinfo.ipi_count_chunk--;
8706                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8707                         panic("Chunk count is negative");
8708                 }
8709                 sctppcbinfo.ipi_gencnt_chunk++;
8710                 return;
8711         }
8712         if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8713                 MCLGET(chk->data, MB_DONTWAIT);
8714                 if ((chk->data->m_flags & M_EXT) == 0) {
8715                         /* Give up */
8716                         sctp_m_freem(chk->data);
8717                         chk->data = NULL;
8718                         goto jump_out;
8719                 }
8720         }
8721         chk->data->m_data += SCTP_MIN_OVERHEAD;
8722         drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8723         if (drp == NULL) {
8724                 sctp_m_freem(chk->data);
8725                 chk->data = NULL;
8726                 goto jump_out;
8727         }
8728         small_one = asoc->smallest_mtu;
8729         if (small_one > MCLBYTES) {
8730                 /* Only one cluster worth of data MAX */
8731                 small_one = MCLBYTES;
8732         }
8733         chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8734                           sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8735         if (chk->book_size > small_one) {
8736                 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8737                 drp->trunc_len = htons(chk->send_size);
8738                 chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8739                                              sizeof(struct sctp_pktdrop_chunk) +
8740                                              sizeof(struct sctphdr));
8741                 len = chk->send_size;
8742         } else {
8743                 /* no truncation needed */
8744                 drp->ch.chunk_flags = 0;
8745                 drp->trunc_len = htons(0);
8746         }
8747         if (bad_crc) {
8748                 drp->ch.chunk_flags |= SCTP_BADCRC;
8749         }
8750         chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8751         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8752         chk->sent = SCTP_DATAGRAM_UNSENT;
8753         chk->snd_count = 0;
8754         if (net) {
8755                 /* we should hit here */
8756                 chk->whoTo = net;
8757         } else {
8758                 chk->whoTo = asoc->primary_destination;
8759         }
8760         chk->whoTo->ref_count++;
8761         chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8762         drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8763         drp->ch.chunk_length = htons(chk->send_size);
8764         spc = stcb->sctp_socket->so_rcv.ssb_hiwat;
8765         if (spc < 0) {
8766                 spc = 0;
8767         }
8768         drp->bottle_bw = htonl(spc);
8769         drp->current_onq = htonl(asoc->size_on_delivery_queue +
8770                                  asoc->size_on_reasm_queue +
8771                                  asoc->size_on_all_streams +
8772                                  asoc->my_rwnd_control_len +
8773                                  stcb->sctp_socket->so_rcv.ssb_cc);
8774         drp->reserved = 0;
8775         datap = drp->data;
8776         m_copydata(m, iphlen, len, datap);
8777         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8778         asoc->ctrl_queue_cnt++;
8779 }
8780
8781 void
8782 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8783 {
8784         struct sctp_association *asoc;
8785         struct sctp_cwr_chunk *cwr;
8786         struct sctp_tmit_chunk *chk;
8787
8788         asoc = &stcb->asoc;
8789         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8790                 if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8791                         /* found a previous ECN_CWR update it if needed */
8792                         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8793                         if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8794                                               MAX_TSN)) {
8795                                 cwr->tsn = htonl(high_tsn);
8796                         }
8797                         return;
8798                 }
8799         }
8800         /* nope could not find one to update so we must build one */
8801         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8802         if (chk == NULL) {
8803                 return;
8804         }
8805         sctppcbinfo.ipi_count_chunk++;
8806         sctppcbinfo.ipi_gencnt_chunk++;
8807         chk->rec.chunk_id = SCTP_ECN_CWR;
8808         chk->asoc = &stcb->asoc;
8809         chk->send_size = sizeof(struct sctp_cwr_chunk);
8810         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8811         if (chk->data == NULL) {
8812                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8813                 sctppcbinfo.ipi_count_chunk--;
8814                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8815                         panic("Chunk count is negative");
8816                 }
8817                 sctppcbinfo.ipi_gencnt_chunk++;
8818                 return;
8819         }
8820         chk->data->m_data += SCTP_MIN_OVERHEAD;
8821         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8822         chk->sent = SCTP_DATAGRAM_UNSENT;
8823         chk->snd_count = 0;
8824         chk->whoTo = net;
8825         chk->whoTo->ref_count++;
8826         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8827         cwr->ch.chunk_type = SCTP_ECN_CWR;
8828         cwr->ch.chunk_flags = 0;
8829         cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8830         cwr->tsn = htonl(high_tsn);
8831         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8832         asoc->ctrl_queue_cnt++;
8833 }
8834 static void
8835 sctp_reset_the_streams(struct sctp_tcb *stcb,
8836      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8837 {
8838         int i;
8839
8840         if (req->reset_flags & SCTP_RESET_ALL) {
8841                 for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8842                         stcb->asoc.strmout[i].next_sequence_sent = 0;
8843                 }
8844         } else if (number_entries) {
8845                 for (i=0; i<number_entries; i++) {
8846                         if (list[i] >= stcb->asoc.streamoutcnt) {
8847                                 /* no such stream */
8848                                 continue;
8849                         }
8850                         stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8851                 }
8852         }
8853         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8854 }
8855
8856 void
8857 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8858      struct sctp_stream_reset_request *req)
8859 {
8860         struct sctp_association *asoc;
8861         struct sctp_stream_reset_resp *strack;
8862         struct sctp_tmit_chunk *chk;
8863         uint32_t seq;
8864         int number_entries, i;
8865         uint8_t two_way=0, not_peer=0;
8866         uint16_t *list=NULL;
8867
8868         asoc = &stcb->asoc;
8869         if (req->reset_flags & SCTP_RESET_ALL)
8870                 number_entries = 0;
8871         else
8872                 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8873
8874         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8875         if (chk == NULL) {
8876                 return;
8877         }
8878         sctppcbinfo.ipi_count_chunk++;
8879         sctppcbinfo.ipi_gencnt_chunk++;
8880         chk->rec.chunk_id = SCTP_STREAM_RESET;
8881         chk->asoc = &stcb->asoc;
8882         chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8883         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8884         if (chk->data == NULL) {
8885         strresp_jump_out:
8886                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8887                 sctppcbinfo.ipi_count_chunk--;
8888                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8889                         panic("Chunk count is negative");
8890                 }
8891                 sctppcbinfo.ipi_gencnt_chunk++;
8892                 return;
8893         }
8894         chk->data->m_data += SCTP_MIN_OVERHEAD;
8895         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8896         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8897                 MCLGET(chk->data, MB_DONTWAIT);
8898                 if ((chk->data->m_flags & M_EXT) == 0) {
8899                         /* Give up */
8900                         sctp_m_freem(chk->data);
8901                         chk->data = NULL;
8902                         goto strresp_jump_out;
8903                 }
8904                 chk->data->m_data += SCTP_MIN_OVERHEAD;
8905         }
8906         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8907                 /* can't do it, no room */
8908                 /* Give up */
8909                 sctp_m_freem(chk->data);
8910                 chk->data = NULL;
8911                 goto strresp_jump_out;
8912
8913         }
8914         chk->sent = SCTP_DATAGRAM_UNSENT;
8915         chk->snd_count = 0;
8916         chk->whoTo = asoc->primary_destination;
8917         chk->whoTo->ref_count++;
8918         strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8919
8920         strack->ch.chunk_type = SCTP_STREAM_RESET;
8921         strack->ch.chunk_flags = 0;
8922         strack->ch.chunk_length = htons(chk->send_size);
8923
8924         memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8925
8926         strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8927         strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8928
8929
8930
8931         if (chk->send_size % 4) {
8932                 /* need a padding for the end */
8933                 int pad;
8934                 uint8_t *end;
8935                 end = (uint8_t *)((caddr_t)strack + chk->send_size);
8936                 pad = chk->send_size % 4;
8937                 for (i = 0; i < pad; i++) {
8938                         end[i] = 0;
8939                 }
8940                 chk->send_size += pad;
8941         }
8942
8943         /* actual response */
8944         if (req->reset_flags & SCTP_RESET_YOUR) {
8945                 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8946         } else {
8947                 strack->sr_resp.reset_flags = 0;
8948         }
8949
8950         /* copied from reset request */
8951         strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8952         seq = ntohl(req->reset_req_seq);
8953
8954         list = req->list_of_streams;
8955         /* copy the un-converted network byte order streams */
8956         for (i=0; i<number_entries; i++) {
8957                 strack->sr_resp.list_of_streams[i] = list[i];
8958         }
8959         if (asoc->str_reset_seq_in == seq) {
8960                 /* is it the next expected? */
8961                 asoc->str_reset_seq_in++;
8962                 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8963                 asoc->str_reset_sending_seq = asoc->sending_seq;
8964                 if (number_entries) {
8965                         int i;
8966                         uint16_t temp;
8967                         /* convert them to host byte order */
8968                         for (i=0 ; i<number_entries; i++) {
8969                                 temp = ntohs(list[i]);
8970                                 list[i] = temp;
8971                         }
8972                 }
8973                 if (req->reset_flags & SCTP_RESET_YOUR) {
8974                         /* reset my outbound streams */
8975                         sctp_reset_the_streams(stcb, req , number_entries, list);
8976                 }
8977                 if (req->reset_flags & SCTP_RECIPRICAL) {
8978                         /* reset peer too */
8979                         sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
8980                 }
8981
8982         } else {
8983                 /* no its a retran so I must just ack and do nothing */
8984                 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
8985         }
8986         strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
8987         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8988                           chk,
8989                           sctp_next);
8990         asoc->ctrl_queue_cnt++;
8991 }
8992
8993
8994 void
8995 sctp_send_str_reset_req(struct sctp_tcb *stcb,
8996      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
8997 {
8998         /* Send a stream reset request. The number_entrys may be 0 and list NULL
8999          * if the request is to reset all streams. If two_way is true then we
9000          * not only request a RESET of the received streams but we also
9001          * request the peer to send a reset req to us too.
9002          * Flag combinations in table:
9003          *
9004          *       two_way | not_peer  | = | Flags
9005          *       ------------------------------
9006          *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
9007          *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
9008          *         0     |    1      | = | Not a Valid Request (not anyone)
9009          *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
9010          */
9011         struct sctp_association *asoc;
9012         struct sctp_stream_reset_req *strreq;
9013         struct sctp_tmit_chunk *chk;
9014
9015
9016         asoc = &stcb->asoc;
9017         if (asoc->stream_reset_outstanding) {
9018                 /* Already one pending, must get ACK back
9019                  * to clear the flag.
9020                  */
9021                 return;
9022         }
9023
9024         if ((two_way == 0) && (not_peer == 1)) {
9025                 /* not a valid request */
9026                 return;
9027         }
9028
9029         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9030         if (chk == NULL) {
9031                 return;
9032         }
9033         sctppcbinfo.ipi_count_chunk++;
9034         sctppcbinfo.ipi_gencnt_chunk++;
9035         chk->rec.chunk_id = SCTP_STREAM_RESET;
9036         chk->asoc = &stcb->asoc;
9037         chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
9038         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
9039         if (chk->data == NULL) {
9040         strreq_jump_out:
9041                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9042                 sctppcbinfo.ipi_count_chunk--;
9043                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9044                         panic("Chunk count is negative");
9045                 }
9046                 sctppcbinfo.ipi_gencnt_chunk++;
9047                 return;
9048         }
9049         chk->data->m_data += SCTP_MIN_OVERHEAD;
9050         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
9051         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9052                 MCLGET(chk->data, MB_DONTWAIT);
9053                 if ((chk->data->m_flags & M_EXT) == 0) {
9054                         /* Give up */
9055                         sctp_m_freem(chk->data);
9056                         chk->data = NULL;
9057                         goto strreq_jump_out;
9058                 }
9059                 chk->data->m_data += SCTP_MIN_OVERHEAD;
9060         }
9061         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9062                 /* can't do it, no room */
9063                 /* Give up */
9064                 sctp_m_freem(chk->data);
9065                 chk->data = NULL;
9066                 goto strreq_jump_out;
9067         }
9068         chk->sent = SCTP_DATAGRAM_UNSENT;
9069         chk->snd_count = 0;
9070         chk->whoTo = asoc->primary_destination;
9071         chk->whoTo->ref_count++;
9072
9073         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
9074         strreq->ch.chunk_type = SCTP_STREAM_RESET;
9075         strreq->ch.chunk_flags = 0;
9076         strreq->ch.chunk_length = htons(chk->send_size);
9077
9078         strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
9079         strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
9080
9081         if (chk->send_size % 4) {
9082                 /* need a padding for the end */
9083                 int pad, i;
9084                 uint8_t *end;
9085                 end = (uint8_t *)((caddr_t)strreq + chk->send_size);
9086                 pad = chk->send_size % 4;
9087                 for (i=0; i<pad; i++) {
9088                         end[i] = 0;
9089                 }
9090                 chk->send_size += pad;
9091         }
9092
9093         strreq->sr_req.reset_flags = 0;
9094         if (number_entrys == 0) {
9095                 strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
9096         }
9097         if (two_way == 0) {
9098                 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
9099         } else {
9100                 if (not_peer == 0) {
9101                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
9102                 } else {
9103                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
9104                 }
9105         }
9106         memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
9107         strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
9108         if (number_entrys) {
9109                 /* populate the specific entry's */
9110                 int i;
9111                 for (i=0; i < number_entrys; i++) {
9112                         strreq->sr_req.list_of_streams[i] = htons(list[i]);
9113                 }
9114         }
9115         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9116                           chk,
9117                           sctp_next);
9118         asoc->ctrl_queue_cnt++;
9119         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
9120         asoc->stream_reset_outstanding = 1;
9121 }
9122
9123 void
9124 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
9125     struct mbuf *err_cause)
9126 {
9127         /*
9128          * Formulate the abort message, and send it back down.
9129          */
9130         struct mbuf *mout;
9131         struct sctp_abort_msg *abm;
9132         struct ip *iph, *iph_out;
9133         struct ip6_hdr *ip6, *ip6_out;
9134         int iphlen_out;
9135
9136         /* don't respond to ABORT with ABORT */
9137         if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
9138                 if (err_cause)
9139                         sctp_m_freem(err_cause);
9140                 return;
9141         }
9142         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
9143         if (mout == NULL) {
9144                 if (err_cause)
9145                         sctp_m_freem(err_cause);
9146                 return;
9147         }
9148         iph = mtod(m, struct ip *);
9149         iph_out = NULL;
9150         ip6_out = NULL;
9151         if (iph->ip_v == IPVERSION) {
9152                 iph_out = mtod(mout, struct ip *);
9153                 mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9154                 mout->m_next = err_cause;
9155
9156                 /* Fill in the IP header for the ABORT */
9157                 iph_out->ip_v = IPVERSION;
9158                 iph_out->ip_hl = (sizeof(struct ip) / 4);
9159                 iph_out->ip_tos = (u_char)0;
9160                 iph_out->ip_id = 0;
9161                 iph_out->ip_off = 0;
9162                 iph_out->ip_ttl = MAXTTL;
9163                 iph_out->ip_p = IPPROTO_SCTP;
9164                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9165                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9166                 /* let IP layer calculate this */
9167                 iph_out->ip_sum = 0;
9168
9169                 iphlen_out = sizeof(*iph_out);
9170                 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
9171         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9172                 ip6 = (struct ip6_hdr *)iph;
9173                 ip6_out = mtod(mout, struct ip6_hdr *);
9174                 mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9175                 mout->m_next = err_cause;
9176
9177                 /* Fill in the IP6 header for the ABORT */
9178                 ip6_out->ip6_flow = ip6->ip6_flow;
9179                 ip6_out->ip6_hlim = ip6_defhlim;
9180                 ip6_out->ip6_nxt = IPPROTO_SCTP;
9181                 ip6_out->ip6_src = ip6->ip6_dst;
9182                 ip6_out->ip6_dst = ip6->ip6_src;
9183
9184                 iphlen_out = sizeof(*ip6_out);
9185                 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
9186         } else {
9187                 /* Currently not supported */
9188                 return;
9189         }
9190
9191         abm->sh.src_port = sh->dest_port;
9192         abm->sh.dest_port = sh->src_port;
9193         abm->sh.checksum = 0;
9194         if (vtag == 0) {
9195                 abm->sh.v_tag = sh->v_tag;
9196                 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9197         } else {
9198                 abm->sh.v_tag = htonl(vtag);
9199                 abm->msg.ch.chunk_flags = 0;
9200         }
9201         abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9202
9203         if (err_cause) {
9204                 struct mbuf *m_tmp = err_cause;
9205                 int err_len = 0;
9206                 /* get length of the err_cause chain */
9207                 while (m_tmp != NULL) {
9208                         err_len += m_tmp->m_len;
9209                         m_tmp = m_tmp->m_next;
9210                 }
9211                 mout->m_pkthdr.len = mout->m_len + err_len;
9212                 if (err_len % 4) {
9213                         /* need pad at end of chunk */
9214                         u_int32_t cpthis=0;
9215                         int padlen;
9216                         padlen = 4 - (mout->m_pkthdr.len % 4);
9217                         m_copyback(mout, mout->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9218                 }
9219                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9220         } else {
9221                 mout->m_pkthdr.len = mout->m_len;
9222                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9223         }
9224
9225         /* add checksum */
9226         if ((sctp_no_csum_on_loopback) &&
9227            (m->m_pkthdr.rcvif) &&
9228            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9229                 abm->sh.checksum =  0;
9230         } else {
9231                 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9232         }
9233
9234         /* zap the rcvif, it should be null */
9235         mout->m_pkthdr.rcvif = 0;
9236         if (iph_out != NULL) {
9237                 struct route ro;
9238
9239                 /* zap the stack pointer to the route */
9240                 bzero(&ro, sizeof ro);
9241 #ifdef SCTP_DEBUG
9242                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9243                         kprintf("sctp_send_abort calling ip_output:\n");
9244                         sctp_print_address_pkt(iph_out, &abm->sh);
9245                 }
9246 #endif
9247                 /* set IPv4 length */
9248 #if defined(__FreeBSD__)
9249                 iph_out->ip_len = mout->m_pkthdr.len;
9250 #else
9251                 iph_out->ip_len = htons(mout->m_pkthdr.len);
9252 #endif
9253                 /* out it goes */
9254                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
9255 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9256     || defined(__NetBSD__) || defined(__DragonFly__)
9257                     , NULL
9258 #endif
9259                     );
9260                 /* Free the route if we got one back */
9261                 if (ro.ro_rt)
9262                         RTFREE(ro.ro_rt);
9263         } else if (ip6_out != NULL) {
9264 #ifdef NEW_STRUCT_ROUTE
9265                 struct route ro;
9266 #else
9267                 struct route_in6 ro;
9268 #endif
9269
9270                 /* zap the stack pointer to the route */
9271                 bzero(&ro, sizeof(ro));
9272 #ifdef SCTP_DEBUG
9273                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9274                         kprintf("sctp_send_abort calling ip6_output:\n");
9275                         sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9276                 }
9277 #endif
9278                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
9279 #if defined(__NetBSD__)
9280                         , NULL
9281 #endif
9282 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9283                     , NULL
9284 #endif
9285                     );
9286                 /* Free the route if we got one back */
9287                 if (ro.ro_rt)
9288                         RTFREE(ro.ro_rt);
9289         }
9290         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9291 }
9292
9293 void
9294 sctp_send_operr_to(struct mbuf *m, int iphlen,
9295                    struct mbuf *scm,
9296                    uint32_t vtag)
9297 {
9298         struct sctphdr *ihdr;
9299         int retcode;
9300         struct sctphdr *ohdr;
9301         struct sctp_chunkhdr *ophdr;
9302
9303         struct ip *iph;
9304 #ifdef SCTP_DEBUG
9305         struct sockaddr_in6 lsa6, fsa6;
9306 #endif
9307         uint32_t val;
9308         iph = mtod(m, struct ip *);
9309         ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
9310         if (!(scm->m_flags & M_PKTHDR)) {
9311                 /* must be a pkthdr */
9312                 kprintf("Huh, not a packet header in send_operr\n");
9313                 m_freem(scm);
9314                 return;
9315         }
9316         M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), MB_DONTWAIT);
9317         if (scm == NULL) {
9318                 /* can't send because we can't add a mbuf */
9319                 return;
9320         }
9321         ohdr = mtod(scm, struct sctphdr *);
9322         ohdr->src_port = ihdr->dest_port;
9323         ohdr->dest_port = ihdr->src_port;
9324         ohdr->v_tag = vtag;
9325         ohdr->checksum = 0;
9326         ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9327         ophdr->chunk_type = SCTP_OPERATION_ERROR;
9328         ophdr->chunk_flags = 0;
9329         ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9330         if (scm->m_pkthdr.len % 4) {
9331                 /* need padding */
9332                 u_int32_t cpthis=0;
9333                 int padlen;
9334                 padlen = 4 - (scm->m_pkthdr.len % 4);
9335                 m_copyback(scm, scm->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9336         }
9337         if ((sctp_no_csum_on_loopback) &&
9338             (m->m_pkthdr.rcvif) &&
9339             (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9340                 val = 0;
9341         } else {
9342                 val = sctp_calculate_sum(scm, NULL, 0);
9343         }
9344         ohdr->checksum = val;
9345         if (iph->ip_v == IPVERSION) {
9346                 /* V4 */
9347                 struct ip *out;
9348                 struct route ro;
9349                 M_PREPEND(scm, sizeof(struct ip), MB_DONTWAIT);
9350                 if (scm == NULL)
9351                         return;
9352                 bzero(&ro, sizeof ro);
9353                 out = mtod(scm, struct ip *);
9354                 out->ip_v = iph->ip_v;
9355                 out->ip_hl = (sizeof(struct ip)/4);
9356                 out->ip_tos = iph->ip_tos;
9357                 out->ip_id = iph->ip_id;
9358                 out->ip_off = 0;
9359                 out->ip_ttl = MAXTTL;
9360                 out->ip_p = IPPROTO_SCTP;
9361                 out->ip_sum = 0;
9362                 out->ip_src = iph->ip_dst;
9363                 out->ip_dst = iph->ip_src;
9364 #if defined(__FreeBSD__)
9365                 out->ip_len = scm->m_pkthdr.len;
9366 #else
9367                 out->ip_len = htons(scm->m_pkthdr.len);
9368 #endif
9369                 retcode = ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL
9370 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9371     || defined(__NetBSD__) || defined(__DragonFly__)
9372                     , NULL
9373 #endif
9374                         );
9375                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9376                 /* Free the route if we got one back */
9377                 if (ro.ro_rt)
9378                         RTFREE(ro.ro_rt);
9379         } else {
9380                 /* V6 */
9381 #ifdef NEW_STRUCT_ROUTE
9382                 struct route ro;
9383 #else
9384                 struct route_in6 ro;
9385 #endif
9386                 struct ip6_hdr *out6, *in6;
9387
9388                 M_PREPEND(scm, sizeof(struct ip6_hdr), MB_DONTWAIT);
9389                 if (scm == NULL)
9390                         return;
9391                 bzero(&ro, sizeof ro);
9392                 in6 = mtod(m, struct ip6_hdr *);
9393                 out6 = mtod(scm, struct ip6_hdr *);
9394                 out6->ip6_flow = in6->ip6_flow;
9395                 out6->ip6_hlim = ip6_defhlim;
9396                 out6->ip6_nxt = IPPROTO_SCTP;
9397                 out6->ip6_src = in6->ip6_dst;
9398                 out6->ip6_dst = in6->ip6_src;
9399
9400 #ifdef SCTP_DEBUG
9401                 bzero(&lsa6, sizeof(lsa6));
9402                 lsa6.sin6_len = sizeof(lsa6);
9403                 lsa6.sin6_family = AF_INET6;
9404                 lsa6.sin6_addr = out6->ip6_src;
9405                 bzero(&fsa6, sizeof(fsa6));
9406                 fsa6.sin6_len = sizeof(fsa6);
9407                 fsa6.sin6_family = AF_INET6;
9408                 fsa6.sin6_addr = out6->ip6_dst;
9409                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9410                         kprintf("sctp_operr_to calling ipv6 output:\n");
9411                         kprintf("src: ");
9412                         sctp_print_address((struct sockaddr *)&lsa6);
9413                         kprintf("dst ");
9414                         sctp_print_address((struct sockaddr *)&fsa6);
9415                 }
9416 #endif /* SCTP_DEBUG */
9417                 ip6_output(scm, NULL, &ro, 0, NULL, NULL
9418 #if defined(__NetBSD__)
9419             , NULL
9420 #endif
9421 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9422             , NULL
9423 #endif
9424                 );
9425                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9426                 /* Free the route if we got one back */
9427                 if (ro.ro_rt)
9428                         RTFREE(ro.ro_rt);
9429         }
9430 }
9431
9432 static int
9433 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9434 {
9435         int left, cancpy, willcpy, error;
9436         left = cpsz;
9437
9438         if (m == NULL) {
9439                 /* TSNH */
9440                 *mbcnt = 0;
9441                 return (ENOMEM);
9442         }
9443         m->m_len = 0;
9444         if ((left+resv_upfront) > (int)MHLEN) {
9445                 MCLGET(m, MB_WAIT);
9446                 if (m == NULL) {
9447                         *mbcnt = 0;
9448                         return (ENOMEM);
9449                 }
9450                 if ((m->m_flags & M_EXT) == 0) {
9451                         *mbcnt = 0;
9452                         return (ENOMEM);
9453                 }
9454                 *mbcnt += m->m_ext.ext_size;
9455         }
9456         *mbcnt += MSIZE;
9457         cancpy = M_TRAILINGSPACE(m);
9458         willcpy = min(cancpy, left);
9459         if ((willcpy + resv_upfront) > cancpy) {
9460                 willcpy -= resv_upfront;
9461         }
9462         while (left > 0) {
9463                 /* Align data to the end */
9464                 if ((m->m_flags & M_EXT) == 0) {
9465                         if (m->m_flags & M_PKTHDR) {
9466                                 MH_ALIGN(m, willcpy);
9467                         } else {
9468                                 M_ALIGN(m, willcpy);
9469                         }
9470                 } else {
9471                         MC_ALIGN(m, willcpy);
9472                 }
9473                 error = uiomove(mtod(m, caddr_t), willcpy, uio);
9474                 if (error) {
9475                         return (error);
9476                 }
9477                 m->m_len = willcpy;
9478                 m->m_nextpkt = 0;
9479                 left -= willcpy;
9480                 if (left > 0) {
9481                         MGET(m->m_next, MB_WAIT, MT_DATA);
9482                         if (m->m_next == NULL) {
9483                                 *mbcnt = 0;
9484                                 return (ENOMEM);
9485                         }
9486                         m = m->m_next;
9487                         m->m_len = 0;
9488                         *mbcnt += MSIZE;
9489                         if (left > (int)MHLEN) {
9490                                 MCLGET(m, MB_WAIT);
9491                                 if (m == NULL) {
9492                                         *mbcnt = 0;
9493                                         return (ENOMEM);
9494                                 }
9495                                 if ((m->m_flags & M_EXT) == 0) {
9496                                         *mbcnt = 0;
9497                                         return (ENOMEM);
9498                                 }
9499                                 *mbcnt += m->m_ext.ext_size;
9500                         }
9501                         cancpy = M_TRAILINGSPACE(m);
9502                         willcpy = min(cancpy, left);
9503                 }
9504         }
9505         return (0);
9506 }
9507
9508 static int
9509 sctp_copy_it_in(struct sctp_inpcb *inp,
9510                 struct sctp_tcb *stcb,
9511                 struct sctp_association *asoc,
9512                 struct sctp_nets *net,
9513                 struct sctp_sndrcvinfo *srcv,
9514                 struct uio *uio,
9515                 int flags)
9516 {
9517         /* This routine must be very careful in
9518          * its work. Protocol processing is
9519          * up and running so care must be taken to
9520          * spl...() when you need to do something
9521          * that may effect the stcb/asoc. The sb is
9522          * locked however. When data is copied the
9523          * protocol processing should be enabled since
9524          * this is a slower operation...
9525          */
9526         struct socket *so;
9527         int error = 0;
9528         int frag_size, mbcnt = 0, mbcnt_e = 0;
9529         unsigned int sndlen;
9530         unsigned int tot_demand;
9531         int tot_out, dataout;
9532         struct sctp_tmit_chunk *chk;
9533         struct mbuf *mm;
9534         struct sctp_stream_out *strq;
9535         uint32_t my_vtag;
9536         int resv_in_first;
9537
9538         crit_enter();
9539         so = stcb->sctp_socket;
9540         chk = NULL;
9541         mm = NULL;
9542
9543         sndlen = uio->uio_resid;
9544         /* lock the socket buf */
9545         SOCKBUF_LOCK(&so->so_snd);
9546         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
9547         if (error) {
9548                 crit_exit();
9549                 goto out_locked;
9550         }
9551
9552         /* will it ever fit ? */
9553         if (sndlen > so->so_snd.ssb_hiwat) {
9554                 /* It will NEVER fit */
9555                 error = EMSGSIZE;
9556                 crit_exit();
9557                 goto release;
9558         }
9559         /* Do I need to block? */
9560         if ((so->so_snd.ssb_hiwat <
9561             (sndlen + asoc->total_output_queue_size)) ||
9562             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9563             (asoc->total_output_mbuf_queue_size >
9564             so->so_snd.ssb_mbmax)
9565         ) {
9566                 /* prune any prsctp bufs out */
9567                 if (asoc->peer_supports_prsctp) {
9568                         sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9569                 }
9570                 /*
9571                  * We store off a pointer to the endpoint.
9572                  * Since on return from this we must check to
9573                  * see if an so_error is set. If so we may have
9574                  * been reset and our stcb destroyed. Returning
9575                  * an error will flow back to the user...
9576                  */
9577                 while ((so->so_snd.ssb_hiwat <
9578                     (sndlen + asoc->total_output_queue_size)) ||
9579                     (asoc->chunks_on_out_queue >
9580                     sctp_max_chunks_on_queue) ||
9581                     (asoc->total_output_mbuf_queue_size >
9582                     so->so_snd.ssb_mbmax)
9583                 ) {
9584                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
9585                                 /* Non-blocking io in place */
9586                                 error = EWOULDBLOCK;
9587                                 crit_exit();
9588                                 goto release;
9589                         }
9590                         inp->sctp_tcb_at_block = (void *)stcb;
9591                         inp->error_on_block = 0;
9592 #ifdef SCTP_BLK_LOGGING
9593                         sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9594                             so, asoc);
9595 #endif
9596                         ssb_unlock(&so->so_snd);
9597                         SCTP_TCB_UNLOCK(stcb);
9598                         error = ssb_wait(&so->so_snd);
9599                         SCTP_INP_RLOCK(inp);
9600                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9601                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9602                                 /* Should I really unlock ? */
9603                                 SCTP_INP_RUNLOCK(inp);
9604                                 error = EFAULT;
9605                                 crit_exit();
9606                                 goto out_locked;
9607                         }
9608                         SCTP_TCB_LOCK(stcb);
9609                         SCTP_INP_RUNLOCK(inp);
9610
9611                         inp->sctp_tcb_at_block = 0;
9612 #ifdef SCTP_BLK_LOGGING
9613                         sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9614                             so, asoc);
9615 #endif
9616                         if (inp->error_on_block) {
9617                                 /*
9618                                  * if our asoc was killed, the free code
9619                                  * (in sctp_pcb.c) will save a error in
9620                                  * here for us
9621                                  */
9622                                 error = inp->error_on_block;
9623                                 crit_exit();
9624                                 goto out_locked;
9625                         }
9626                         if (error) {
9627                                 crit_exit();
9628                                 goto out_locked;
9629                         }
9630                         /* did we encounter a socket error? */
9631                         if (so->so_error) {
9632                                 error = so->so_error;
9633                                 crit_exit();
9634                                 goto out_locked;
9635                         }
9636                         error = ssb_lock(&so->so_snd, M_WAITOK);
9637                         if (error) {
9638                                 /* Can't acquire the lock */
9639                                 crit_exit();
9640                                 goto out_locked;
9641                         }
9642 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9643                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9644 #else
9645                         if (so->so_state & SS_CANTSENDMORE) {
9646 #endif
9647                                 /* The socket is now set not to sendmore.. its gone */
9648                                 error = EPIPE;
9649                                 crit_exit();
9650                                 goto release;
9651                         }
9652                         if (so->so_error) {
9653                                 error = so->so_error;
9654                                 crit_exit();
9655                                 goto release;
9656                         }
9657                         if (asoc->peer_supports_prsctp) {
9658                                 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9659                         }
9660                 }
9661         }
9662         dataout = tot_out = uio->uio_resid;
9663         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9664                 resv_in_first = SCTP_MED_OVERHEAD;
9665         } else {
9666                 resv_in_first = SCTP_MED_V4_OVERHEAD;
9667         }
9668
9669         /* Are we aborting? */
9670         if (srcv->sinfo_flags & MSG_ABORT) {
9671                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9672                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9673                         /* It has to be up before we abort */
9674                         /* how big is the user initiated abort? */
9675
9676                         /* I wonder about doing a MGET without a splnet set.
9677                          * it is done that way in the sosend code so I guess
9678                          * it is ok :-0
9679                          */
9680                         MGETHDR(mm, MB_WAIT, MT_DATA);
9681                         if (mm) {
9682                                 struct sctp_paramhdr *ph;
9683
9684                                 tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9685                                 if (tot_demand > MHLEN) {
9686                                         if (tot_demand > MCLBYTES) {
9687                                                 /* truncate user data */
9688                                                 tot_demand = MCLBYTES;
9689                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9690                                         }
9691                                         MCLGET(mm, MB_WAIT);
9692                                         if ((mm->m_flags & M_EXT) == 0) {
9693                                                 /* truncate further */
9694                                                 tot_demand = MHLEN;
9695                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9696                                         }
9697                                 }
9698                                 /* now move forward the data pointer */
9699                                 ph = mtod(mm, struct sctp_paramhdr *);
9700                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9701                                 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9702                                 ph++;
9703                                 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9704                                 mm->m_len = mm->m_pkthdr.len;
9705                                 error = uiomove((caddr_t)ph, tot_out, uio);
9706                                 if (error) {
9707                                         /*
9708                                          * Here if we can't get his data we
9709                                          * still abort we just don't get to
9710                                          * send the users note :-0
9711                                          */
9712                                         sctp_m_freem(mm);
9713                                         mm = NULL;
9714                                 }
9715                         }
9716                         ssb_unlock(&so->so_snd);
9717                         SOCKBUF_UNLOCK(&so->so_snd);
9718                         sctp_abort_an_association(stcb->sctp_ep, stcb,
9719                                                   SCTP_RESPONSE_TO_USER_REQ,
9720                                                   mm);
9721                         mm = NULL;
9722                         crit_exit();
9723                         goto out_notlocked;
9724                 }
9725                 crit_exit();
9726                 goto release;
9727         }
9728
9729         /* Now can we send this? */
9730         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9731             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9732             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9733             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9734                 /* got data while shutting down */
9735                 error = ECONNRESET;
9736                 crit_exit();
9737                 goto release;
9738         }
9739         /* Is the stream no. valid? */
9740         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9741                 /* Invalid stream number */
9742                 error = EINVAL;
9743                 crit_exit();
9744                 goto release;
9745         }
9746         if (asoc->strmout == NULL) {
9747                 /* huh? software error */
9748 #ifdef SCTP_DEBUG
9749                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9750                         kprintf("software error in sctp_copy_it_in\n");
9751                 }
9752 #endif
9753                 error = EFAULT;
9754                 crit_exit();
9755                 goto release;
9756         }
9757         if ((srcv->sinfo_flags & MSG_EOF) &&
9758             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9759             (tot_out == 0)) {
9760                 crit_exit();
9761                 goto zap_by_it_now;
9762         }
9763         if (tot_out == 0) {
9764                 /* not allowed */
9765                 error = EMSGSIZE;
9766                 crit_exit();
9767                 goto release;
9768         }
9769         /* save off the tag */
9770         my_vtag = asoc->my_vtag;
9771         strq = &asoc->strmout[srcv->sinfo_stream];
9772         /* First lets figure out the "chunking" point */
9773         frag_size = sctp_get_frag_point(stcb, asoc);
9774
9775         /* two choices here, it all fits in one chunk or
9776          * we need multiple chunks.
9777          */
9778         crit_exit();
9779         SOCKBUF_UNLOCK(&so->so_snd);
9780         if (tot_out <= frag_size) {
9781                 /* no need to setup a template */
9782                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9783                 if (chk == NULL) {
9784                         error = ENOMEM;
9785                         SOCKBUF_LOCK(&so->so_snd);
9786                         goto release;
9787                 }
9788                 sctppcbinfo.ipi_count_chunk++;
9789                 sctppcbinfo.ipi_gencnt_chunk++;
9790                 asoc->chunks_on_out_queue++;
9791                 MGETHDR(mm, MB_WAIT, MT_DATA);
9792                 if (mm == NULL) {
9793                         error = ENOMEM;
9794                         goto clean_up;
9795                 }
9796                 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9797                 if (error)
9798                         goto clean_up;
9799                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9800                 chk->mbcnt = mbcnt_e;
9801                 mbcnt += mbcnt_e;
9802                 mbcnt_e = 0;
9803                 mm->m_pkthdr.len = tot_out;
9804                 chk->data = mm;
9805                 mm = NULL;
9806
9807                 /* the actual chunk flags */
9808                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9809                 chk->whoTo->ref_count++;
9810
9811                 /* fix up the send_size if it is not present */
9812                 chk->send_size = tot_out;
9813                 chk->book_size = chk->send_size;
9814                 /* ok, we are commited */
9815                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9816                         /* bump the ssn if we are unordered. */
9817                         strq->next_sequence_sent++;
9818                 }
9819                 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9820                         asoc->sent_queue_cnt_removeable++;
9821                 }
9822                 crit_enter();
9823                 if ((asoc->state == 0) ||
9824                     (my_vtag != asoc->my_vtag) ||
9825                     (so != inp->sctp_socket) ||
9826                     (inp->sctp_socket == 0)) {
9827                         /* connection was aborted */
9828                         crit_exit();
9829                         error = ECONNRESET;
9830                         goto clean_up;
9831                 }
9832                 asoc->stream_queue_cnt++;
9833                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9834                 /* now check if this stream is on the wheel */
9835                 if ((strq->next_spoke.tqe_next == NULL) &&
9836                     (strq->next_spoke.tqe_prev == NULL)) {
9837                         /* Insert it on the wheel since it is not
9838                          * on it currently
9839                          */
9840                         sctp_insert_on_wheel(asoc, strq);
9841                 }
9842                 crit_exit();
9843 clean_up:
9844                 if (error) {
9845                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9846                         sctppcbinfo.ipi_count_chunk--;
9847                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9848                                 panic("Chunk count is negative");
9849                         }
9850                         SOCKBUF_LOCK(&so->so_snd);
9851                         goto release;
9852                 }
9853         } else {
9854                 /* we need to setup a template */
9855                 struct sctp_tmit_chunk template;
9856                 struct sctpchunk_listhead tmp;
9857
9858                 /* setup the template */
9859                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9860
9861                 /* Prepare the temp list */
9862                 TAILQ_INIT(&tmp);
9863
9864                 /* Template is complete, now time for the work */
9865                 while (tot_out > 0) {
9866                         /* Get a chunk */
9867                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9868                         if (chk == NULL) {
9869                                 /*
9870                                  * ok we must spin through and dump anything
9871                                  * we have allocated and then jump to the
9872                                  * no_membad
9873                                  */
9874                                 error = ENOMEM;
9875                         }
9876                         sctppcbinfo.ipi_count_chunk++;
9877                         asoc->chunks_on_out_queue++;
9878
9879                         sctppcbinfo.ipi_gencnt_chunk++;
9880                         *chk = template;
9881                         chk->whoTo->ref_count++;
9882                         MGETHDR(chk->data, MB_WAIT, MT_DATA);
9883                         if (chk->data == NULL) {
9884                                 error = ENOMEM;
9885                                 goto temp_clean_up;
9886                         }
9887                         tot_demand = min(tot_out, frag_size);
9888                         error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9889                         if (error)
9890                                 goto temp_clean_up;
9891                         /* now fix the chk->send_size */
9892                         chk->mbcnt = mbcnt_e;
9893                         mbcnt += mbcnt_e;
9894                         mbcnt_e = 0;
9895                         chk->send_size = tot_demand;
9896                         chk->data->m_pkthdr.len = tot_demand;
9897                         chk->book_size = chk->send_size;
9898                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9899                                 asoc->sent_queue_cnt_removeable++;
9900                         }
9901                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9902                         tot_out -= tot_demand;
9903                 }
9904                 /* Now the tmp list holds all chunks and data */
9905                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9906                         /* bump the ssn if we are unordered. */
9907                         strq->next_sequence_sent++;
9908                 }
9909                 /* Mark the first/last flags. This will
9910                  * result int a 3 for a single item on the list
9911                  */
9912                 chk = TAILQ_FIRST(&tmp);
9913                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9914                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9915                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9916
9917                 /* now move it to the streams actual queue */
9918                 /* first stop protocol processing */
9919                 crit_enter();
9920                 if ((asoc->state == 0) ||
9921                     (my_vtag != asoc->my_vtag) ||
9922                     (so != inp->sctp_socket) ||
9923                     (inp->sctp_socket == 0)) {
9924                         /* connection was aborted */
9925                         crit_exit();
9926                         error = ECONNRESET;
9927                         goto temp_clean_up;
9928                 }
9929                 chk = TAILQ_FIRST(&tmp);
9930                 while (chk) {
9931                         chk->data->m_nextpkt = 0;
9932                         TAILQ_REMOVE(&tmp, chk, sctp_next);
9933                         asoc->stream_queue_cnt++;
9934                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9935                         chk = TAILQ_FIRST(&tmp);
9936                 }
9937                 /* now check if this stream is on the wheel */
9938                 if ((strq->next_spoke.tqe_next == NULL) &&
9939                     (strq->next_spoke.tqe_prev == NULL)) {
9940                         /* Insert it on the wheel since it is not
9941                          * on it currently
9942                          */
9943                         sctp_insert_on_wheel(asoc, strq);
9944                 }
9945                 /* Ok now we can allow pping */
9946                 crit_exit();
9947 temp_clean_up:
9948                 if (error) {
9949                         SOCKBUF_LOCK(&so->so_snd);
9950                         chk = TAILQ_FIRST(&tmp);
9951                         while (chk) {
9952                                 if (chk->data) {
9953                                         sctp_m_freem(chk->data);
9954                                         chk->data = NULL;
9955                                 }
9956                                 TAILQ_REMOVE(&tmp, chk, sctp_next);
9957                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9958                                 sctppcbinfo.ipi_count_chunk--;
9959                                 asoc->chunks_on_out_queue--;
9960                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9961                                         panic("Chunk count is negative");
9962                                 }
9963                                 sctppcbinfo.ipi_gencnt_chunk++;
9964                                 chk = TAILQ_FIRST(&tmp);
9965                         }
9966                         goto release;
9967                 }
9968         }
9969 zap_by_it_now:
9970 #ifdef SCTP_MBCNT_LOGGING
9971         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9972                        asoc->total_output_queue_size,
9973                        dataout,
9974                        asoc->total_output_mbuf_queue_size,
9975                        mbcnt);
9976 #endif
9977         crit_enter();
9978         SOCKBUF_LOCK(&so->so_snd);
9979         asoc->total_output_queue_size += dataout;
9980         asoc->total_output_mbuf_queue_size += mbcnt;
9981         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
9982             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
9983                 so->so_snd.ssb_cc += dataout;
9984                 so->so_snd.ssb_mbcnt += mbcnt;
9985         }
9986         if ((srcv->sinfo_flags & MSG_EOF) &&
9987             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
9988                 ) {
9989                 int some_on_streamwheel = 0;
9990                 error = 0;
9991                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
9992                         /* Check to see if some data queued */
9993                         struct sctp_stream_out *outs;
9994                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
9995                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
9996                                         some_on_streamwheel = 1;
9997                                         break;
9998                                 }
9999                         }
10000                 }
10001                 if (TAILQ_EMPTY(&asoc->send_queue) &&
10002                     TAILQ_EMPTY(&asoc->sent_queue) &&
10003                     (some_on_streamwheel == 0)) {
10004                         /* there is nothing queued to send, so I'm done... */
10005                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
10006                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
10007                                 /* only send SHUTDOWN the first time through */
10008 #ifdef SCTP_DEBUG
10009                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
10010                                         kprintf("%s:%d sends a shutdown\n",
10011                                                __FILE__,
10012                                                __LINE__
10013                                                 );
10014                                 }
10015 #endif
10016                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
10017                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
10018                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
10019                                                  asoc->primary_destination);
10020                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
10021                                                  asoc->primary_destination);
10022                         }
10023                 } else {
10024                         /*
10025                          * we still got (or just got) data to send, so set
10026                          * SHUTDOWN_PENDING
10027                          */
10028                         /*
10029                          * XXX sockets draft says that MSG_EOF should be sent
10030                          * with no data.  currently, we will allow user data
10031                          * to be sent first and move to SHUTDOWN-PENDING
10032                          */
10033                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
10034                 }
10035         }
10036         crit_exit();
10037 #ifdef SCTP_DEBUG
10038         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
10039                 kprintf("++total out:%d total_mbuf_out:%d\n",
10040                        (int)asoc->total_output_queue_size,
10041                        (int)asoc->total_output_mbuf_queue_size);
10042         }
10043 #endif
10044
10045 release:
10046         ssb_unlock(&so->so_snd);
10047 out_locked:
10048         SOCKBUF_UNLOCK(&so->so_snd);
10049 out_notlocked:
10050         if (mm)
10051                 sctp_m_freem(mm);
10052         return (error);
10053 }
10054
10055
10056 int
10057 sctp_sosend(struct socket *so,
10058 #ifdef __NetBSD__
10059             struct mbuf *addr_mbuf,
10060 #else
10061             struct sockaddr *addr,
10062 #endif
10063             struct uio *uio,
10064             struct mbuf *top,
10065             struct mbuf *control,
10066 #if defined(__NetBSD__) || defined(__APPLE__)
10067             int flags
10068 #else
10069             int flags,
10070 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10071             struct thread *p
10072 #else
10073             struct proc *p
10074 #endif
10075 #endif
10076 )
10077 {
10078         int error, use_rcvinfo;
10079         int queue_only = 0, queue_only_for_init=0;
10080         int un_sent = 0;
10081         int now_filled=0;
10082         struct sctp_inpcb *inp;
10083         struct sctp_tcb *stcb=NULL;
10084         struct sctp_sndrcvinfo srcv;
10085         struct timeval now;
10086         struct sctp_nets *net;
10087         struct sctp_association *asoc;
10088         struct sctp_inpcb *t_inp;
10089         int create_lock_applied = 0;
10090 #if defined(__APPLE__)
10091         struct proc *p = current_proc();
10092 #elif defined(__NetBSD__)
10093         struct proc *p = curproc; /* XXX */
10094         struct sockaddr *addr = NULL;
10095         if (addr_mbuf)
10096                 addr = mtod(addr_mbuf, struct sockaddr *);
10097 #endif
10098
10099         error = use_rcvinfo = 0;
10100         net = NULL;
10101         stcb = NULL;
10102         asoc = NULL;
10103         t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
10104
10105         crit_enter();
10106
10107         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
10108             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
10109                 /* The listner can NOT send */
10110                 error = EFAULT;
10111                 crit_exit();
10112                 goto out;
10113         }
10114         if (addr) {
10115                 SCTP_ASOC_CREATE_LOCK(inp);
10116                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
10117                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
10118                         /* Should I really unlock ? */
10119                         error = EFAULT;
10120                         crit_exit();
10121                         goto out;
10122
10123                 }
10124                 create_lock_applied = 1;
10125                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
10126                     (addr->sa_family == AF_INET6)) {
10127                         error = EINVAL;
10128                         crit_exit();
10129                         goto out;
10130                 }
10131         }
10132         /* now we must find the assoc */
10133         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
10134                 SCTP_INP_RLOCK(inp);
10135                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
10136                 if (stcb == NULL) {
10137                         SCTP_INP_RUNLOCK(inp);
10138                         error = ENOTCONN;
10139                         crit_exit();
10140                         goto out;
10141                 }
10142                 SCTP_TCB_LOCK(stcb);
10143                 SCTP_INP_RUNLOCK(inp);
10144                 net = stcb->asoc.primary_destination;
10145         }
10146         /* get control */
10147         if (control) {
10148                 /* process cmsg snd/rcv info (maybe a assoc-id) */
10149                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10150                                    sizeof(srcv))) {
10151                         /* got one */
10152                         if (srcv.sinfo_flags & MSG_SENDALL) {
10153                                 /* its a sendall */
10154                                 sctppcbinfo.mbuf_track--;
10155                                 sctp_m_freem(control);
10156
10157                                 if (create_lock_applied) {
10158                                         SCTP_ASOC_CREATE_UNLOCK(inp);
10159                                         create_lock_applied = 0;
10160                                 }
10161                                 return (sctp_sendall(inp, uio, top, &srcv));
10162                         }
10163                         use_rcvinfo = 1;
10164                 }
10165         }
10166         if (stcb == NULL) {
10167                 /* Need to do a lookup */
10168                 if (use_rcvinfo && srcv.sinfo_assoc_id) {
10169                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
10170                         /*
10171                          * Question: Should I error here if the assoc_id is
10172                          * no longer valid? i.e. I can't find it?
10173                          */
10174                         if ((stcb) &&
10175                             (addr != NULL)) {
10176                                 /* Must locate the net structure */
10177                                 net = sctp_findnet(stcb, addr);
10178                         }
10179                 }
10180                 if (stcb == NULL) {
10181                         if (addr != NULL) {
10182                                 /* Since we did not use findep we must
10183                                  * increment it, and if we don't find a
10184                                  * tcb decrement it.
10185                                  */
10186                                 SCTP_INP_WLOCK(inp);
10187                                 SCTP_INP_INCR_REF(inp);
10188                                 SCTP_INP_WUNLOCK(inp);
10189                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
10190                                 if (stcb == NULL) {
10191                                         SCTP_INP_WLOCK(inp);
10192                                         SCTP_INP_DECR_REF(inp);
10193                                         SCTP_INP_WUNLOCK(inp);
10194                                 }
10195                         }
10196                 }
10197         }
10198         if ((stcb == NULL) &&
10199             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
10200                 error = ENOTCONN;
10201                 crit_exit();
10202                 goto out;
10203         } else if ((stcb == NULL) && (addr == NULL)) {
10204                 error = ENOENT;
10205                 crit_exit();
10206                 goto out;
10207         } else if (stcb == NULL) {
10208                 /* UDP style, we must go ahead and start the INIT process */
10209                 if ((use_rcvinfo) &&
10210                     (srcv.sinfo_flags & MSG_ABORT)) {
10211                         /* User asks to abort a non-existant asoc */
10212                         error = ENOENT;
10213                         crit_exit();
10214                         goto out;
10215                 }
10216                 /* get an asoc/stcb struct */
10217                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
10218                 if (stcb == NULL) {
10219                         /* Error is setup for us in the call */
10220                         crit_exit();
10221                         goto out;
10222                 }
10223                 if (create_lock_applied) {
10224                         SCTP_ASOC_CREATE_UNLOCK(inp);
10225                         create_lock_applied = 0;
10226                 } else {
10227                         kprintf("Huh-3? create lock should have been on??\n");
10228                 }
10229                 /* Turn on queue only flag to prevent data from being sent */
10230                 queue_only = 1;
10231                 asoc = &stcb->asoc;
10232                 asoc->state = SCTP_STATE_COOKIE_WAIT;
10233                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
10234                 if (control) {
10235                         /* see if a init structure exists in cmsg headers */
10236                         struct sctp_initmsg initm;
10237                         int i;
10238                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
10239                                 /* we have an INIT override of the default */
10240                                 if (initm.sinit_max_attempts)
10241                                         asoc->max_init_times = initm.sinit_max_attempts;
10242                                 if (initm.sinit_num_ostreams)
10243                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
10244                                 if (initm.sinit_max_instreams)
10245                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
10246                                 if (initm.sinit_max_init_timeo)
10247                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10248                                 if (asoc->streamoutcnt < asoc->pre_open_streams) {
10249                                         /* Default is NOT correct */
10250 #ifdef SCTP_DEBUG
10251                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10252                                                 kprintf("Ok, defout:%d pre_open:%d\n",
10253                                                        asoc->streamoutcnt, asoc->pre_open_streams);
10254                                         }
10255 #endif
10256                                         kfree(asoc->strmout, M_PCB);
10257                                         asoc->strmout = NULL;
10258                                         asoc->streamoutcnt = asoc->pre_open_streams;
10259
10260                                         /* What happesn if this fails? .. we panic ...*/
10261                                         asoc->strmout =
10262                                             kmalloc(asoc->streamoutcnt *
10263                                                 sizeof(struct sctp_stream_out),
10264                                                 M_PCB, M_WAITOK);
10265                                         for (i = 0; i < asoc->streamoutcnt; i++) {
10266                                                 /*
10267                                                  * inbound side must be set to 0xffff,
10268                                                  * also NOTE when we get the INIT-ACK
10269                                                  * back (for INIT sender) we MUST
10270                                                  * reduce the count (streamoutcnt) but
10271                                                  * first check if we sent to any of the
10272                                                  * upper streams that were dropped (if
10273                                                  * some were). Those that were dropped
10274                                                  * must be notified to the upper layer
10275                                                  * as failed to send.
10276                                                  */
10277                                                 asoc->strmout[i].next_sequence_sent = 0x0;
10278                                                 TAILQ_INIT(&asoc->strmout[i].outqueue);
10279                                                 asoc->strmout[i].stream_no = i;
10280                                                 asoc->strmout[i].next_spoke.tqe_next = 0;
10281                                                 asoc->strmout[i].next_spoke.tqe_prev = 0;
10282                                         }
10283                                 }
10284                         }
10285
10286                 }
10287                 /* out with the INIT */
10288                 queue_only_for_init = 1;
10289                 sctp_send_initiate(inp, stcb);
10290                 /*
10291                  * we may want to dig in after this call and adjust the MTU
10292                  * value. It defaulted to 1500 (constant) but the ro structure
10293                  * may now have an update and thus we may need to change it
10294                  * BEFORE we append the message.
10295                  */
10296                 net = stcb->asoc.primary_destination;
10297                 asoc = &stcb->asoc;
10298         } else {
10299                 asoc = &stcb->asoc;
10300         }
10301         if (create_lock_applied) {
10302                 SCTP_ASOC_CREATE_UNLOCK(inp);
10303                 create_lock_applied = 0;
10304         }
10305         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10306             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10307                 queue_only = 1;
10308         }
10309         if (use_rcvinfo == 0) {
10310                 /* Grab the default stuff from the asoc */
10311                 srcv = stcb->asoc.def_send;
10312         }
10313         /* we are now done with all control */
10314         if (control) {
10315                 sctp_m_freem(control);
10316                 control = NULL;
10317         }
10318
10319         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10320             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10321             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10322             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10323                 if ((use_rcvinfo) &&
10324                     (srcv.sinfo_flags & MSG_ABORT)) {
10325                         ;
10326                 } else {
10327                         error = ECONNRESET;
10328                         crit_exit();
10329                         goto out;
10330                 }
10331         }
10332         /* Ok, we will attempt a msgsnd :> */
10333         if (p)
10334 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10335                 p->td_lwp->lwp_ru.ru_msgsnd++;
10336 #else
10337         p->p_stats->p_ru.ru_msgsnd++;
10338 #endif
10339
10340         if (stcb) {
10341                 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10342                         /* we take the override or the unconfirmed */
10343                         ;
10344                 } else {
10345                         net = stcb->asoc.primary_destination;
10346                 }
10347         }
10348
10349         if (top == NULL) {
10350                 /* Must copy it all in from user land. The
10351                  * socket buf is locked but we don't suspend
10352                  * protocol processing until we are ready to
10353                  * send/queue it.
10354                  */
10355                 crit_exit();
10356                 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10357                 if (error)
10358                         goto out;
10359         } else {
10360                 /* Here we must either pull in the user data to chunk
10361                  * buffers, or use top to do a msg_append.
10362                  */
10363                 error = sctp_msg_append(stcb, net, top, &srcv, flags);
10364                 crit_exit();
10365                 if (error)
10366                         goto out;
10367                 /* zap the top since it is now being used */
10368                 top = 0;
10369         }
10370
10371         if (net->flight_size > net->cwnd) {
10372                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10373                 queue_only = 1;
10374
10375         } else if (asoc->ifp_had_enobuf) {
10376                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10377                 queue_only = 1;
10378         } else {
10379                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10380                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10381                            SCTP_MED_OVERHEAD);
10382
10383                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10384                     (stcb->asoc.total_flight > 0) &&
10385                     (un_sent < (int)stcb->asoc.smallest_mtu)) {
10386
10387                         /* Ok, Nagle is set on and we have data outstanding. Don't
10388                          * send anything and let SACKs drive out the data unless we
10389                          * have a "full" segment to send.
10390                          */
10391                         sctp_pegs[SCTP_NAGLE_NOQ]++;
10392                         queue_only = 1;
10393                 } else {
10394                         sctp_pegs[SCTP_NAGLE_OFF]++;
10395                 }
10396         }
10397         if (queue_only_for_init) {
10398                 /* It is possible to have a turn around of the
10399                  * INIT/INIT-ACK/COOKIE before I have a chance to
10400                  * copy in the data. In such a case I DO want to
10401                  * send it out by reversing the queue only flag.
10402                  */
10403                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10404                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10405                         /* yep, reverse it */
10406                         queue_only = 0;
10407                 }
10408         }
10409
10410         if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10411                 /* we can attempt to send too.*/
10412 #ifdef SCTP_DEBUG
10413                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10414                         kprintf("USR Send calls sctp_chunk_output\n");
10415                 }
10416 #endif
10417                 crit_enter();
10418                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10419                 sctp_chunk_output(inp, stcb, 0);
10420                 crit_exit();
10421         } else if ((queue_only == 0) &&
10422                    (stcb->asoc.peers_rwnd == 0) &&
10423                    (stcb->asoc.total_flight == 0)) {
10424                 /* We get to have a probe outstanding */
10425                 crit_enter();
10426                 sctp_from_user_send = 1;
10427                 sctp_chunk_output(inp, stcb, 0);
10428                 sctp_from_user_send = 0;
10429                 crit_exit();
10430
10431         } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10432                 int num_out, reason, cwnd_full;
10433                 /* Here we do control only */
10434                 crit_enter();
10435                 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10436                                       &reason, 1, &cwnd_full, 1, &now, &now_filled);
10437                 crit_exit();
10438         }
10439 #ifdef SCTP_DEBUG
10440         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10441                 kprintf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10442                        queue_only, stcb->asoc.peers_rwnd, un_sent,
10443                        stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10444                        stcb->asoc.total_output_queue_size);
10445         }
10446 #endif
10447  out:
10448         if (create_lock_applied) {
10449                 SCTP_ASOC_CREATE_UNLOCK(inp);
10450                 create_lock_applied = 0;
10451         }
10452         if (stcb)
10453                 SCTP_TCB_UNLOCK(stcb);
10454         if (top)
10455                 sctp_m_freem(top);
10456         if (control)
10457                 sctp_m_freem(control);
10458         return (error);
10459 }