sys/netinet/sctp_output.c

   1 /*      $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $    */
   2 /*      $DragonFly: src/sys/netinet/sctp_output.c,v 1.12 2007/11/10 17:55:25 swildner Exp $     */
   3
   4 /*
   5  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #if !(defined(__OpenBSD__) || defined (__APPLE__))
  34 #include "opt_ipsec.h"
  35 #endif
  36 #if defined(__FreeBSD__) || defined(__DragonFly__)
  37 #include "opt_compat.h"
  38 #include "opt_inet6.h"
  39 #include "opt_inet.h"
  40 #endif
  41 #if defined(__NetBSD__)
  42 #include "opt_inet.h"
  43 #endif
  44 #ifdef __APPLE__
  45 #include <sctp.h>
  46 #elif !defined(__OpenBSD__)
  47 #include "opt_sctp.h"
  48 #endif
  49 #include <sys/param.h>
  50 #include <sys/systm.h>
  51 #include <sys/malloc.h>
  52 #include <sys/mbuf.h>
  53 #ifndef __OpenBSD__
  54 #include <sys/domain.h>
  55 #endif
  56 #include <sys/protosw.h>
  57 #include <sys/socket.h>
  58 #include <sys/socketvar.h>
  59 #include <sys/proc.h>
  60 #include <sys/kernel.h>
  61 #include <sys/sysctl.h>
  62 #include <sys/resourcevar.h>
  63 #include <sys/uio.h>
  64 #ifdef INET6
  65 #include <sys/domain.h>
  66 #endif
  67 #include <sys/thread2.h>
  68 #include <sys/socketvar2.h>
  69
  70 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  71 #include <sys/limits.h>
  72 #else
  73 #include <machine/limits.h>
  74 #endif
  75 #include <machine/cpu.h>
  76
  77 #include <net/if.h>
  78 #include <net/if_types.h>
  79
  80 #if defined(__FreeBSD__) || defined(__DragonFly__)
  81 #include <net/if_var.h>
  82 #endif
  83
  84 #include <net/route.h>
  85
  86 #include <netinet/in.h>
  87 #include <netinet/in_systm.h>
  88 #include <netinet/ip.h>
  89 #include <netinet/in_pcb.h>
  90 #include <netinet/in_var.h>
  91 #include <netinet/ip_var.h>
  92
  93 #ifdef INET6
  94 #include <netinet/ip6.h>
  95 #include <netinet6/ip6_var.h>
  96 #include <netinet6/scope6_var.h>
  97 #include <netinet6/nd6.h>
  98
  99 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
 100 #include <netinet6/in6_pcb.h>
 101 #elif defined(__OpenBSD__)
 102 #include <netinet/in_pcb.h>
 103 #endif
 104
 105 #include <netinet/icmp6.h>
 106
 107 #endif /* INET6 */
 108
 109 #include <net/net_osdep.h>
 110
 111 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
 112 #ifndef in6pcb
 113 #define in6pcb          inpcb
 114 #endif
 115 #endif
 116
 117 #include <netinet/sctp_pcb.h>
 118
 119 #ifdef IPSEC
 120 #ifndef __OpenBSD__
 121 #include <netinet6/ipsec.h>
 122 #include <netproto/key/key.h>
 123 #else
 124 #undef IPSEC
 125 #endif
 126 #endif /* IPSEC */
 127
 128 #include <netinet/sctp_var.h>
 129 #include <netinet/sctp_header.h>
 130 #include <netinet/sctputil.h>
 131 #include <netinet/sctp_pcb.h>
 132 #include <netinet/sctp_output.h>
 133 #include <netinet/sctp_uio.h>
 134 #include <netinet/sctputil.h>
 135 #include <netinet/sctp_hashdriver.h>
 136 #include <netinet/sctp_timer.h>
 137 #include <netinet/sctp_asconf.h>
 138 #include <netinet/sctp_indata.h>
 139
 140 #ifdef SCTP_DEBUG
 141 extern uint32_t sctp_debug_on;
 142 #endif
 143
 144 extern int sctp_peer_chunk_oh;
 145
 146 static int
 147 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
 148 {
 149         struct cmsghdr cmh;
 150         int tlen, at;
 151
 152         tlen = control->m_len;
 153         at = 0;
 154         /*
 155          * Independent of how many mbufs, find the c_type inside the control
 156          * structure and copy out the data.
 157          */
 158         while (at < tlen) {
 159                 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
 160                         /* not enough room for one more we are done. */
 161                         return (0);
 162                 }
 163                 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
 164                 if ((cmh.cmsg_len + at) > tlen) {
 165                         /*
 166                          * this is real messed up since there is not enough
 167                          * data here to cover the cmsg header. We are done.
 168                          */
 169                         return (0);
 170                 }
 171                 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
 172                     (c_type == cmh.cmsg_type)) {
 173                         /* found the one we want, copy it out */
 174                         at += CMSG_ALIGN(sizeof(struct cmsghdr));
 175                         if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
 176                                 /*
 177                                  * space of cmsg_len after header not
 178                                  * big enough
 179                                  */
 180                                 return (0);
 181                         }
 182                         m_copydata(control, at, cpsize, data);
 183                         return (1);
 184                  } else {
 185                         at += CMSG_ALIGN(cmh.cmsg_len);
 186                         if (cmh.cmsg_len == 0) {
 187                                 break;
 188                         }
 189                 }
 190         }
 191         /* not found */
 192         return (0);
 193 }
 194
 195 static struct mbuf *
 196 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
 197 {
 198         struct sctp_paramhdr *parmh;
 199         struct mbuf *mret;
 200         int len;
 201         if (ifa->ifa_addr->sa_family == AF_INET) {
 202                 len = sizeof(struct sctp_ipv4addr_param);
 203         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 204                 len = sizeof(struct sctp_ipv6addr_param);
 205         } else {
 206                 /* unknown type */
 207                 return (m);
 208         }
 209
 210         if (M_TRAILINGSPACE(m) >= len) {
 211                 /* easy side we just drop it on the end */
 212                 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
 213                 mret = m;
 214         } else {
 215                 /* Need more space */
 216                 mret = m;
 217                 while (mret->m_next != NULL) {
 218                         mret = mret->m_next;
 219                 }
 220                 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
 221                 if (mret->m_next == NULL) {
 222                         /* We are hosed, can't add more addresses */
 223                         return (m);
 224                 }
 225                 mret = mret->m_next;
 226                 parmh = mtod(mret, struct sctp_paramhdr *);
 227         }
 228         /* now add the parameter */
 229         if (ifa->ifa_addr->sa_family == AF_INET) {
 230                 struct sctp_ipv4addr_param *ipv4p;
 231                 struct sockaddr_in *sin;
 232                 sin = (struct sockaddr_in *)ifa->ifa_addr;
 233                 ipv4p = (struct sctp_ipv4addr_param *)parmh;
 234                 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
 235                 parmh->param_length = htons(len);
 236                 ipv4p->addr = sin->sin_addr.s_addr;
 237                 mret->m_len += len;
 238         } else if (ifa->ifa_addr->sa_family == AF_INET6) {
 239                 struct sctp_ipv6addr_param *ipv6p;
 240                 struct sockaddr_in6 *sin6;
 241                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
 242                 ipv6p = (struct sctp_ipv6addr_param *)parmh;
 243                 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
 244                 parmh->param_length = htons(len);
 245                 memcpy(ipv6p->addr, &sin6->sin6_addr,
 246                     sizeof(ipv6p->addr));
 247                 /* clear embedded scope in the address */
 248                 in6_clearscope((struct in6_addr *)ipv6p->addr);
 249                 mret->m_len += len;
 250         } else {
 251                 return (m);
 252         }
 253         return (mret);
 254 }
 255
 256
 257
 258 static struct mbuf *
 259 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
 260     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
 261 {
 262         struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
 263         struct sctp_state_cookie *stc;
 264         struct sctp_paramhdr *ph;
 265         uint8_t *signature;
 266         int sig_offset;
 267         uint16_t cookie_sz;
 268
 269         mret = NULL;
 270
 271         MGET(mret, MB_DONTWAIT, MT_DATA);
 272         if (mret == NULL) {
 273                 return (NULL);
 274         }
 275         copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
 276         if (copy_init == NULL) {
 277                 sctp_m_freem(mret);
 278                 return (NULL);
 279         }
 280         copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
 281             MB_DONTWAIT);
 282         if (copy_initack == NULL) {
 283                 sctp_m_freem(mret);
 284                 sctp_m_freem(copy_init);
 285                 return (NULL);
 286         }
 287         /* easy side we just drop it on the end */
 288         ph = mtod(mret, struct sctp_paramhdr *);
 289         mret->m_len = sizeof(struct sctp_state_cookie) +
 290             sizeof(struct sctp_paramhdr);
 291         stc = (struct sctp_state_cookie *)((caddr_t)ph +
 292             sizeof(struct sctp_paramhdr));
 293         ph->param_type = htons(SCTP_STATE_COOKIE);
 294         ph->param_length = 0;   /* fill in at the end */
 295         /* Fill in the stc cookie data */
 296         *stc = *stc_in;
 297
 298         /* tack the INIT and then the INIT-ACK onto the chain */
 299         cookie_sz = 0;
 300         m_at = mret;
 301         for (m_at = mret; m_at; m_at = m_at->m_next) {
 302                 cookie_sz += m_at->m_len;
 303                 if (m_at->m_next == NULL) {
 304                         m_at->m_next = copy_init;
 305                         break;
 306                 }
 307         }
 308
 309         for (m_at = copy_init; m_at; m_at = m_at->m_next) {
 310                 cookie_sz += m_at->m_len;
 311                 if (m_at->m_next == NULL) {
 312                         m_at->m_next = copy_initack;
 313                         break;
 314                 }
 315         }
 316
 317         for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
 318                 cookie_sz += m_at->m_len;
 319                 if (m_at->m_next == NULL) {
 320                         break;
 321                 }
 322         }
 323         MGET(sig, MB_DONTWAIT, MT_DATA);
 324         if (sig == NULL) {
 325                 /* no space */
 326                 sctp_m_freem(mret);
 327                 sctp_m_freem(copy_init);
 328                 sctp_m_freem(copy_initack);
 329                 return (NULL);
 330         }
 331         sig->m_len = 0;
 332         m_at->m_next = sig;
 333         sig_offset = 0;
 334         signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
 335         /* Time to sign the cookie */
 336         sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
 337             (int)(inp->sctp_ep.current_secret_number)],
 338             SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
 339             (uint8_t *)signature);
 340         sig->m_len += SCTP_SIGNATURE_SIZE;
 341         cookie_sz += SCTP_SIGNATURE_SIZE;
 342
 343         ph->param_length = htons(cookie_sz);
 344         return (mret);
 345 }
 346
 347
 348 static struct sockaddr_in *
 349 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 350 {
 351         struct sockaddr_in *sin;
 352         /*
 353          * Here we determine if its a prefered address. A
 354          * prefered address means it is the same scope or
 355          * higher scope then the destination.
 356          *  L = loopback, P = private, G = global
 357          * -----------------------------------------
 358          *  src    |      dest     |    result
 359          *-----------------------------------------
 360          *   L     |       L       |    yes
 361          *-----------------------------------------
 362          *   P     |       L       |    yes
 363          *-----------------------------------------
 364          *   G     |       L       |    yes
 365          *-----------------------------------------
 366          *   L     |       P       |    no
 367          *-----------------------------------------
 368          *   P     |       P       |    yes
 369          *-----------------------------------------
 370          *   G     |       P       |    no
 371          *-----------------------------------------
 372          *   L     |       G       |    no
 373          *-----------------------------------------
 374          *   P     |       G       |    no
 375          *-----------------------------------------
 376          *   G     |       G       |    yes
 377          *-----------------------------------------
 378          */
 379
 380         if (ifa->ifa_addr->sa_family != AF_INET) {
 381                 /* forget non-v4 */
 382                 return (NULL);
 383         }
 384         /* Ok the address may be ok */
 385         sin = (struct sockaddr_in *)ifa->ifa_addr;
 386         if (sin->sin_addr.s_addr == 0) {
 387                 return (NULL);
 388         }
 389         *sin_local = *sin_loop = 0;
 390         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 391             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 392                 *sin_loop = 1;
 393                 *sin_local = 1;
 394         }
 395         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 396                 *sin_local = 1;
 397         }
 398         if (!loopscope && *sin_loop) {
 399                 /* Its a loopback address and we don't have loop scope */
 400                 return (NULL);
 401         }
 402         if (!ipv4_scope && *sin_local) {
 403                 /* Its a private address, and we don't have private address scope */
 404                 return (NULL);
 405         }
 406         if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
 407                 /* its a global src and a private dest */
 408                 return (NULL);
 409         }
 410         /* its a prefered address */
 411         return (sin);
 412 }
 413
 414 static struct sockaddr_in *
 415 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 416 {
 417         struct sockaddr_in *sin;
 418         /*
 419          * Here we determine if its a acceptable address. A
 420          * acceptable address means it is the same scope or
 421          * higher scope but we can allow for NAT which means
 422          * its ok to have a global dest and a private src.
 423          *
 424          *  L = loopback, P = private, G = global
 425          * -----------------------------------------
 426          *  src    |      dest     |    result
 427          *-----------------------------------------
 428          *   L     |       L       |    yes
 429          *-----------------------------------------
 430          *   P     |       L       |    yes
 431          *-----------------------------------------
 432          *   G     |       L       |    yes
 433          *-----------------------------------------
 434          *   L     |       P       |    no
 435          *-----------------------------------------
 436          *   P     |       P       |    yes
 437          *-----------------------------------------
 438          *   G     |       P       |    yes - probably this won't work.
 439          *-----------------------------------------
 440          *   L     |       G       |    no
 441          *-----------------------------------------
 442          *   P     |       G       |    yes
 443          *-----------------------------------------
 444          *   G     |       G       |    yes
 445          *-----------------------------------------
 446          */
 447
 448         if (ifa->ifa_addr->sa_family != AF_INET) {
 449                 /* forget non-v4 */
 450                 return (NULL);
 451         }
 452         /* Ok the address may be ok */
 453         sin = (struct sockaddr_in *)ifa->ifa_addr;
 454         if (sin->sin_addr.s_addr == 0) {
 455                 return (NULL);
 456         }
 457         *sin_local = *sin_loop = 0;
 458         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
 459             (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 460                 *sin_loop = 1;
 461                 *sin_local = 1;
 462         }
 463         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 464                 *sin_local = 1;
 465         }
 466         if (!loopscope && *sin_loop) {
 467                 /* Its a loopback address and we don't have loop scope */
 468                 return (NULL);
 469         }
 470         /* its an acceptable address */
 471         return (sin);
 472 }
 473
 474 /*
 475  * This treats the address list on the ep as a restricted list
 476  * (negative list). If a the passed address is listed, then
 477  * the address is NOT allowed on the association.
 478  */
 479 int
 480 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
 481 {
 482         struct sctp_laddr *laddr;
 483 #ifdef SCTP_DEBUG
 484         int cnt=0;
 485 #endif
 486         if (stcb == NULL) {
 487                 /* There are no restrictions, no TCB :-) */
 488                 return (0);
 489         }
 490 #ifdef SCTP_DEBUG
 491         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 492                 cnt++;
 493         }
 494         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 495                 kprintf("There are %d addresses on the restricted list\n", cnt);
 496         }
 497         cnt = 0;
 498 #endif
 499         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 500                 if (laddr->ifa == NULL) {
 501 #ifdef SCTP_DEBUG
 502                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 503                                 kprintf("Help I have fallen and I can't get up!\n");
 504                         }
 505 #endif
 506                         continue;
 507                 }
 508 #ifdef SCTP_DEBUG
 509                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
 510                         cnt++;
 511                         kprintf("Restricted address[%d]:", cnt);
 512                         sctp_print_address(laddr->ifa->ifa_addr);
 513                 }
 514 #endif
 515                 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
 516                         /* Yes it is on the list */
 517                         return (1);
 518                 }
 519         }
 520         return (0);
 521 }
 522
 523 static int
 524 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 525 {
 526         struct sctp_laddr *laddr;
 527
 528         if (ifa == NULL)
 529                 return (0);
 530         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 531                 if (laddr->ifa == NULL) {
 532 #ifdef SCTP_DEBUG
 533                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 534                                 kprintf("Help I have fallen and I can't get up!\n");
 535                         }
 536 #endif
 537                         continue;
 538                 }
 539                 if (laddr->ifa->ifa_addr == NULL)
 540                         continue;
 541                 if (laddr->ifa == ifa)
 542                         /* same pointer */
 543                         return (1);
 544                 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
 545                         /* skip non compatible address comparison */
 546                         continue;
 547                 }
 548                 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 549                         /* Yes it is restricted */
 550                         return (1);
 551                 }
 552         }
 553         return (0);
 554 }
 555
 556
 557
 558 static struct in_addr
 559 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
 560                                  struct rtentry *rt,
 561                                  uint8_t ipv4_scope,
 562                                  uint8_t loopscope)
 563 {
 564         struct in_addr ans;
 565         struct sctp_laddr *laddr;
 566         struct sockaddr_in *sin;
 567         struct ifnet *ifn;
 568         struct ifaddr *ifa;
 569         uint8_t sin_loop, sin_local;
 570
 571         /* first question, is the ifn we will emit on
 572          * in our list, if so, we want that one.
 573          */
 574         ifn = rt->rt_ifp;
 575         if (ifn) {
 576                 /* is a prefered one on the interface we route out? */
 577                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 578                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 579                         if (sin == NULL)
 580                                 continue;
 581                         if (sctp_is_addr_in_ep(inp, ifa)) {
 582                                 return (sin->sin_addr);
 583                         }
 584                 }
 585                 /* is an acceptable one on the interface we route out? */
 586                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 587                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 588                         if (sin == NULL)
 589                                 continue;
 590                         if (sctp_is_addr_in_ep(inp, ifa)) {
 591                                 return (sin->sin_addr);
 592                         }
 593                 }
 594         }
 595         /* ok, what about a prefered address in the inp */
 596         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 597              laddr && (laddr != inp->next_addr_touse);
 598              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 599                 if (laddr->ifa == NULL) {
 600                         /* address has been removed */
 601                         continue;
 602                 }
 603                 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 604                 if (sin == NULL)
 605                         continue;
 606                 return (sin->sin_addr);
 607
 608         }
 609         /* ok, what about an acceptable address in the inp */
 610         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
 611              laddr && (laddr != inp->next_addr_touse);
 612              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 613                 if (laddr->ifa == NULL) {
 614                         /* address has been removed */
 615                         continue;
 616                 }
 617                 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 618                 if (sin == NULL)
 619                         continue;
 620                 return (sin->sin_addr);
 621
 622         }
 623
 624         /* no address bound can be a source for the destination we are in trouble */
 625 #ifdef SCTP_DEBUG
 626         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 627                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
 628         }
 629 #endif
 630         memset(&ans, 0, sizeof(ans));
 631         return (ans);
 632 }
 633
 634
 635
 636 static struct in_addr
 637 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
 638                                   struct sctp_tcb *stcb,
 639                                   struct sctp_nets *net,
 640                                   struct rtentry *rt,
 641                                   uint8_t ipv4_scope,
 642                                   uint8_t loopscope,
 643                                   int non_asoc_addr_ok)
 644 {
 645         /*
 646          * Here we have two cases, bound all asconf
 647          * allowed. bound all asconf not allowed.
 648          *
 649          */
 650         struct sctp_laddr *laddr, *starting_point;
 651         struct in_addr ans;
 652         struct ifnet *ifn;
 653         struct ifaddr *ifa;
 654         uint8_t sin_loop, sin_local, start_at_beginning=0;
 655         struct sockaddr_in *sin;
 656
 657         /* first question, is the ifn we will emit on
 658          * in our list, if so, we want that one.
 659          */
 660         ifn = rt->rt_ifp;
 661
 662         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
 663                 /*
 664                  * Here we use the list of addresses on the endpoint. Then
 665                  * the addresses listed on the "restricted" list is just that,
 666                  * address that have not been added and can't be used (unless
 667                  * the non_asoc_addr_ok is set).
 668                  */
 669 #ifdef SCTP_DEBUG
 670                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 671                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
 672                 }
 673 #endif
 674                 /* first question, is the ifn we will emit on
 675                  * in our list, if so, we want that one.
 676                  */
 677                 if (ifn) {
 678                         /* first try for an prefered address on the ep */
 679                         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 680                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 681                                         sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 682                                         if (sin == NULL)
 683                                                 continue;
 684                                         if ((non_asoc_addr_ok == 0) &&
 685                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 686                                                 /* on the no-no list */
 687                                                 continue;
 688                                         }
 689                                         return (sin->sin_addr);
 690                                 }
 691                         }
 692                         /* next try for an acceptable address on the ep */
 693                         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 694                                 if (sctp_is_addr_in_ep(inp, ifa)) {
 695                                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 696                                         if (sin == NULL)
 697                                                 continue;
 698                                         if ((non_asoc_addr_ok == 0) &&
 699                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 700                                                 /* on the no-no list */
 701                                                 continue;
 702                                         }
 703                                         return (sin->sin_addr);
 704                                 }
 705                         }
 706
 707                 }
 708                 /* if we can't find one like that then we must
 709                  * look at all addresses bound to pick one at
 710                  * first prefereable then secondly acceptable.
 711                  */
 712                 starting_point = stcb->asoc.last_used_address;
 713         sctpv4_from_the_top:
 714                 if (stcb->asoc.last_used_address == NULL) {
 715                         start_at_beginning=1;
 716                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 717                 }
 718                 /* search beginning with the last used address */
 719                 for (laddr = stcb->asoc.last_used_address; laddr;
 720                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 721                         if (laddr->ifa == NULL) {
 722                                 /* address has been removed */
 723                                 continue;
 724                         }
 725                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 726                         if (sin == NULL)
 727                                 continue;
 728                         if ((non_asoc_addr_ok == 0) &&
 729                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 730                                 /* on the no-no list */
 731                                 continue;
 732                         }
 733                         return (sin->sin_addr);
 734
 735                 }
 736                 if (start_at_beginning == 0) {
 737                         stcb->asoc.last_used_address = NULL;
 738                         goto sctpv4_from_the_top;
 739                 }
 740                 /* now try for any higher scope than the destination */
 741                 stcb->asoc.last_used_address = starting_point;
 742                 start_at_beginning = 0;
 743         sctpv4_from_the_top2:
 744                 if (stcb->asoc.last_used_address == NULL) {
 745                         start_at_beginning=1;
 746                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
 747                 }
 748                 /* search beginning with the last used address */
 749                 for (laddr = stcb->asoc.last_used_address; laddr;
 750                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
 751                         if (laddr->ifa == NULL) {
 752                                 /* address has been removed */
 753                                 continue;
 754                         }
 755                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 756                         if (sin == NULL)
 757                                 continue;
 758                         if ((non_asoc_addr_ok == 0) &&
 759                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
 760                                 /* on the no-no list */
 761                                 continue;
 762                         }
 763                         return (sin->sin_addr);
 764                 }
 765                 if (start_at_beginning == 0) {
 766                         stcb->asoc.last_used_address = NULL;
 767                         goto sctpv4_from_the_top2;
 768                 }
 769         } else {
 770                 /*
 771                  * Here we have an address list on the association, thats the
 772                  * only valid source addresses that we can use.
 773                  */
 774 #ifdef SCTP_DEBUG
 775                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 776                         kprintf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
 777                 }
 778 #endif
 779                 /* First look at all addresses for one that is on
 780                  * the interface we route out
 781                  */
 782                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 783                              sctp_nxt_addr) {
 784                         if (laddr->ifa == NULL) {
 785                                 /* address has been removed */
 786                                 continue;
 787                         }
 788                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 789                         if (sin == NULL)
 790                                 continue;
 791                         /* first question, is laddr->ifa an address associated with the emit interface */
 792                         if (ifn) {
 793                                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 794                                         if (laddr->ifa == ifa) {
 795                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 796                                                 return (sin->sin_addr);
 797                                         }
 798                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 799                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 800                                                 return (sin->sin_addr);
 801                                         }
 802                                 }
 803                         }
 804                 }
 805                 /* what about an acceptable one on the interface? */
 806                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 807                              sctp_nxt_addr) {
 808                         if (laddr->ifa == NULL) {
 809                                 /* address has been removed */
 810                                 continue;
 811                         }
 812                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 813                         if (sin == NULL)
 814                                 continue;
 815                         /* first question, is laddr->ifa an address associated with the emit interface */
 816                         if (ifn) {
 817                                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 818                                         if (laddr->ifa == ifa) {
 819                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 820                                                 return (sin->sin_addr);
 821                                         }
 822                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
 823                                                 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
 824                                                 return (sin->sin_addr);
 825                                         }
 826                                 }
 827                         }
 828                 }
 829                 /* ok, next one that is preferable in general */
 830                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 831                              sctp_nxt_addr) {
 832                         if (laddr->ifa == NULL) {
 833                                 /* address has been removed */
 834                                 continue;
 835                         }
 836                         sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 837                         if (sin == NULL)
 838                                 continue;
 839                         return (sin->sin_addr);
 840                 }
 841
 842                 /* last, what about one that is acceptable */
 843                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
 844                              sctp_nxt_addr) {
 845                         if (laddr->ifa == NULL) {
 846                                 /* address has been removed */
 847                                 continue;
 848                         }
 849                         sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 850                         if (sin == NULL)
 851                                 continue;
 852                         return (sin->sin_addr);
 853                 }
 854         }
 855         memset(&ans, 0, sizeof(ans));
 856         return (ans);
 857 }
 858
 859 static struct sockaddr_in *
 860 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 861                                                     uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
 862 {
 863         struct ifaddr *ifa;
 864         struct sockaddr_in *sin;
 865         uint8_t sin_loop, sin_local;
 866         int num_eligible_addr = 0;
 867         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 868                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 869                 if (sin == NULL)
 870                         continue;
 871                 if (stcb) {
 872                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 873                                 /* It is restricted for some reason.. probably
 874                                  * not yet added.
 875                                  */
 876                                 continue;
 877                         }
 878                 }
 879                 if (cur_addr_num == num_eligible_addr) {
 880                         return (sin);
 881                 }
 882         }
 883         return (NULL);
 884 }
 885
 886
 887 static int
 888 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
 889                                      uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
 890 {
 891         struct ifaddr *ifa;
 892         struct sockaddr_in *sin;
 893         int num_eligible_addr = 0;
 894
 895         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 896                 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
 897                 if (sin == NULL)
 898                         continue;
 899                 if (stcb) {
 900                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 901                                 /* It is restricted for some reason.. probably
 902                                  * not yet added.
 903                                  */
 904                                 continue;
 905                         }
 906                 }
 907                 num_eligible_addr++;
 908         }
 909         return (num_eligible_addr);
 910
 911 }
 912
 913 static struct in_addr
 914 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
 915                         struct sctp_tcb *stcb,
 916                         struct sctp_nets *net,
 917                         struct rtentry *rt,
 918                         uint8_t ipv4_scope,
 919                         uint8_t loopscope,
 920                         int non_asoc_addr_ok)
 921 {
 922         int cur_addr_num=0, num_prefered=0;
 923         uint8_t sin_loop, sin_local;
 924         struct ifnet *ifn;
 925         struct sockaddr_in *sin;
 926         struct in_addr ans;
 927         struct ifaddr *ifa;
 928         /*
 929          * For v4 we can use (in boundall) any address in the association. If
 930          * non_asoc_addr_ok is set we can use any address (at least in theory).
 931          * So we look for prefered addresses first. If we find one, we use it.
 932          * Otherwise we next try to get an address on the interface, which we
 933          * should be able to do (unless non_asoc_addr_ok is false and we are
 934          * routed out that way). In these cases where we can't use the address
 935          * of the interface we go through all the ifn's looking for an address
 936          * we can use and fill that in. Punting means we send back address
 937          * 0, which will probably cause problems actually since then IP will
 938          * fill in the address of the route ifn, which means we probably already
 939          * rejected it.. i.e. here comes an abort :-<.
 940          */
 941         ifn = rt->rt_ifp;
 942         if (net) {
 943                 cur_addr_num = net->indx_of_eligible_next_to_use;
 944         }
 945         if (ifn == NULL) {
 946                 goto bound_all_v4_plan_c;
 947         }
 948         num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
 949 #ifdef SCTP_DEBUG
 950         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 951                 kprintf("Found %d prefered source addresses\n", num_prefered);
 952         }
 953 #endif
 954         if (num_prefered == 0) {
 955                 /* no eligible addresses, we must use some other
 956                  * interface address if we can find one.
 957                  */
 958                 goto bound_all_v4_plan_b;
 959         }
 960         /* Ok we have num_eligible_addr set with how many we can use,
 961          * this may vary from call to call due to addresses being deprecated etc..
 962          */
 963         if (cur_addr_num >= num_prefered) {
 964                 cur_addr_num = 0;
 965         }
 966         /* select the nth address from the list (where cur_addr_num is the nth) and
 967          * 0 is the first one, 1 is the second one etc...
 968          */
 969 #ifdef SCTP_DEBUG
 970         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
 971                 kprintf("cur_addr_num:%d\n", cur_addr_num);
 972         }
 973 #endif
 974         sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
 975                                                                    ipv4_scope, cur_addr_num);
 976
 977         /* if sin is NULL something changed??, plan_a now */
 978         if (sin) {
 979                 return (sin->sin_addr);
 980         }
 981
 982         /*
 983          * plan_b: Look at the interface that we emit on
 984          *         and see if we can find an acceptable address.
 985          */
 986  bound_all_v4_plan_b:
 987         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
 988                 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
 989                 if (sin == NULL)
 990                         continue;
 991                 if (stcb) {
 992                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
 993                                 /* It is restricted for some reason.. probably
 994                                  * not yet added.
 995                                  */
 996                                 continue;
 997                         }
 998                 }
 999                 return (sin->sin_addr);
1000         }
1001         /*
1002          * plan_c: Look at all interfaces and find a prefered
1003          *         address. If we reache here we are in trouble I think.
1004          */
1005  bound_all_v4_plan_c:
1006         for (ifn = TAILQ_FIRST(&ifnet);
1007              ifn && (ifn != inp->next_ifn_touse);
1008              ifn=TAILQ_NEXT(ifn, if_list)) {
1009                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1010                         /* wrong base scope */
1011                         continue;
1012                 }
1013                 if (ifn == rt->rt_ifp)
1014                         /* already looked at this guy */
1015                         continue;
1016                 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1017                                                                     loopscope, ipv4_scope, &sin_loop, &sin_local);
1018 #ifdef SCTP_DEBUG
1019                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1020                         kprintf("Found ifn:%x %d prefered source addresses\n", (u_int)ifn, num_prefered);
1021                 }
1022 #endif
1023                 if (num_prefered == 0) {
1024                         /*
1025                          * None on this interface.
1026                          */
1027                         continue;
1028                 }
1029                 /* Ok we have num_eligible_addr set with how many we can use,
1030                  * this may vary from call to call due to addresses being deprecated etc..
1031                  */
1032                 if (cur_addr_num >= num_prefered) {
1033                         cur_addr_num = 0;
1034                 }
1035                 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1036                                                                           ipv4_scope, cur_addr_num);
1037                 if (sin == NULL)
1038                         continue;
1039                 return (sin->sin_addr);
1040
1041         }
1042
1043         /*
1044          * plan_d: We are in deep trouble. No prefered address on
1045          *         any interface. And the emit interface does not
1046          *         even have an acceptable address. Take anything
1047          *         we can get! If this does not work we are
1048          *         probably going to emit a packet that will
1049          *         illicit an ABORT, falling through.
1050          */
1051
1052         for (ifn = TAILQ_FIRST(&ifnet);
1053              ifn && (ifn != inp->next_ifn_touse);
1054              ifn=TAILQ_NEXT(ifn, if_list)) {
1055                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1056                         /* wrong base scope */
1057                         continue;
1058                 }
1059                 if (ifn == rt->rt_ifp)
1060                         /* already looked at this guy */
1061                         continue;
1062
1063                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1064                         sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1065                         if (sin == NULL)
1066                                 continue;
1067                         if (stcb) {
1068                                 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1069                                         /* It is restricted for some reason.. probably
1070                                          * not yet added.
1071                                          */
1072                                         continue;
1073                                 }
1074                         }
1075                         return (sin->sin_addr);
1076                 }
1077         }
1078         /*
1079          * Ok we can find NO address to source from that is
1080          * not on our negative list. It is either the special
1081          * ASCONF case where we are sourceing from a intf that
1082          * has been ifconfig'd to a different address (i.e.
1083          * it holds a ADD/DEL/SET-PRIM and the proper lookup
1084          * address. OR we are hosed, and this baby is going
1085          * to abort the association.
1086          */
1087         if (non_asoc_addr_ok) {
1088                 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1089         } else {
1090                 memset(&ans, 0, sizeof(ans));
1091                 return (ans);
1092         }
1093 }
1094
1095
1096
1097 /* tcb may be NULL */
1098 struct in_addr
1099 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1100     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1101     int non_asoc_addr_ok)
1102 {
1103         struct in_addr ans;
1104         struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1105         uint8_t ipv4_scope, loopscope;
1106         /*
1107          * Rules:
1108          * - Find the route if needed, cache if I can.
1109          * - Look at interface address in route, Is it
1110          *   in the bound list. If so we have the best source.
1111          * - If not we must rotate amongst the addresses.
1112          *
1113          * Cavets and issues
1114          *
1115          * Do we need to pay attention to scope. We can have
1116          * a private address or a global address we are sourcing
1117          * or sending to. So if we draw it out
1118          *      source     *      dest   *  result
1119          *  ------------------------------------------
1120          *  a   Private    *     Global  *  NAT?
1121          *  ------------------------------------------
1122          *  b   Private    *     Private *  No problem
1123          *  ------------------------------------------
1124          *  c   Global     *     Private *  Huh, How will this work?
1125          *  ------------------------------------------
1126          *  d   Global     *     Global  *  No Problem
1127          *  ------------------------------------------
1128          *
1129          * And then we add to that what happens if there are multiple
1130          * addresses assigned to an interface. Remember the ifa on a
1131          * ifn is a linked list of addresses. So one interface can
1132          * have more than one IPv4 address. What happens if we
1133          * have both a private and a global address? Do we then
1134          * use context of destination to sort out which one is
1135          * best? And what about NAT's sending P->G may get you
1136          * a NAT translation, or should you select the G thats
1137          * on the interface in preference.
1138          *
1139          * Decisions:
1140          *
1141          *  - count the number of addresses on the interface.
1142          *  - if its one, no problem except case <c>. For <a>
1143          *    we will assume a NAT out there.
1144          *  - if there are more than one, then we need to worry
1145          *    about scope P or G. We should prefer G -> G and
1146          *    P -> P if possible. Then as a secondary fall back
1147          *    to mixed types G->P being a last ditch one.
1148          *  - The above all works for bound all, but bound
1149          *    specific we need to use the same concept but instead
1150          *    only consider the bound addresses. If the bound set
1151          *    is NOT assigned to the interface then we must use
1152          *    rotation amongst them.
1153          *
1154          * Notes: For v4, we can always punt and let ip_output
1155          * decide by sending back a source of 0.0.0.0
1156          */
1157
1158         if (ro->ro_rt == NULL) {
1159                 /*
1160                  * Need a route to cache.
1161                  *
1162                  */
1163 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1164                 rtalloc_ign(ro, 0UL);
1165 #else
1166                 rtalloc(ro);
1167 #endif
1168         }
1169         if (ro->ro_rt == NULL) {
1170                 /* No route to host .. punt */
1171                 memset(&ans, 0, sizeof(ans));
1172                 return (ans);
1173         }
1174         /* Setup our scopes */
1175         if (stcb) {
1176                 ipv4_scope = stcb->asoc.ipv4_local_scope;
1177                 loopscope = stcb->asoc.loopback_scope;
1178         } else {
1179                 /* Scope based on outbound address */
1180                 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1181                         ipv4_scope = 1;
1182                         loopscope = 0;
1183                 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1184                         ipv4_scope = 1;
1185                         loopscope = 1;
1186                 } else {
1187                         ipv4_scope = 0;
1188                         loopscope = 0;
1189                 }
1190         }
1191 #ifdef SCTP_DEBUG
1192         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1193                 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1194                        loopscope, ipv4_scope);
1195         }
1196 #endif
1197         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1198                 /*
1199                  * When bound to all if the address list is set
1200                  * it is a negative list. Addresses being added
1201                  * by asconf.
1202                  */
1203                 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1204                     ipv4_scope, loopscope, non_asoc_addr_ok));
1205         }
1206         /*
1207          * Three possiblities here:
1208          *
1209          * a) stcb is NULL, which means we operate only from
1210          *    the list of addresses (ifa's) bound to the assoc and
1211          *    we care not about the list.
1212          * b) stcb is NOT-NULL, which means we have an assoc structure and
1213          *    auto-asconf is on. This means that the list of addresses is
1214          *    a NOT list. We use the list from the inp, but any listed address
1215          *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1216          *    set we CAN use an address NOT available (i.e. being added). Its
1217          *    a negative list.
1218          * c) stcb is NOT-NULL, which means we have an assoc structure and
1219          *    auto-asconf is off. This means that the list of addresses is
1220          *    the ONLY addresses I can use.. its positive.
1221          *
1222          *    Note we collapse b & c into the same function just like in
1223          *    the v6 address selection.
1224          */
1225         if (stcb) {
1226                 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1227                     ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1228         } else {
1229                 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1230                     ipv4_scope, loopscope));
1231         }
1232         /* this should not be reached */
1233         memset(&ans, 0, sizeof(ans));
1234         return (ans);
1235 }
1236
1237
1238
1239 static struct sockaddr_in6 *
1240 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1241 {
1242         struct in6_ifaddr *ifa6;
1243         struct sockaddr_in6 *sin6;
1244
1245         if (ifa->ifa_addr->sa_family != AF_INET6) {
1246                 /* forget non-v6 */
1247                 return (NULL);
1248         }
1249         ifa6 = (struct in6_ifaddr *)ifa;
1250         /* ok to use deprecated addresses? */
1251         if (!ip6_use_deprecated) {
1252                 if (IFA6_IS_DEPRECATED(ifa6)) {
1253                         /* can't use this type */
1254                         return (NULL);
1255                 }
1256         }
1257         /* are we ok, with the current state of this address? */
1258         if (ifa6->ia6_flags &
1259             (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1260                 /* Can't use these types */
1261                 return (NULL);
1262         }
1263         /* Ok the address may be ok */
1264         sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1265         *sin_local = *sin_loop = 0;
1266         if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1267             (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1268                 *sin_loop = 1;
1269         }
1270         if (!loopscope && *sin_loop) {
1271                 /* Its a loopback address and we don't have loop scope */
1272                 return (NULL);
1273         }
1274         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1275                 /* we skip unspecifed addresses */
1276                 return (NULL);
1277         }
1278
1279         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1280                 *sin_local = 1;
1281         }
1282         if (!loc_scope && *sin_local) {
1283                 /* Its a link local address, and we don't have link local scope */
1284                 return (NULL);
1285         }
1286         return (sin6);
1287 }
1288
1289
1290 static struct sockaddr_in6 *
1291 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1292                                   struct sctp_tcb *stcb,
1293                                   struct sctp_nets *net,
1294                                   struct rtentry *rt,
1295                                   uint8_t loc_scope,
1296                                   uint8_t loopscope,
1297                                   int non_asoc_addr_ok)
1298 {
1299         /*
1300          *   Each endpoint has a list of local addresses associated
1301          *   with it. The address list is either a "negative list" i.e.
1302          *   those addresses that are NOT allowed to be used as a source OR
1303          *   a "postive list" i.e. those addresses that CAN be used.
1304          *
1305          *   Its a negative list if asconf is allowed. What we do
1306          *   in this case is use the ep address list BUT we have
1307          *   to cross check it against the negative list.
1308          *
1309          *   In the case where NO asconf is allowed, we have just
1310          *   a straight association level list that we must use to
1311          *   find a source address.
1312          */
1313         struct sctp_laddr *laddr, *starting_point;
1314         struct sockaddr_in6 *sin6;
1315         int sin_loop, sin_local;
1316         int start_at_beginning=0;
1317         struct ifnet *ifn;
1318         struct ifaddr *ifa;
1319
1320         ifn = rt->rt_ifp;
1321         if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1322 #ifdef SCTP_DEBUG
1323                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1324                         kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1325                 }
1326 #endif
1327                 /* first question, is the ifn we will emit on
1328                  * in our list, if so, we want that one.
1329                  */
1330                 if (ifn) {
1331                         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1332                                 if (sctp_is_addr_in_ep(inp, ifa)) {
1333                                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1334                                         if (sin6 == NULL)
1335                                                 continue;
1336                                         if ((non_asoc_addr_ok == 0) &&
1337                                             (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1338                                                 /* on the no-no list */
1339                                                 continue;
1340                                         }
1341                                         return (sin6);
1342                                 }
1343                         }
1344                 }
1345                 starting_point = stcb->asoc.last_used_address;
1346                 /* First try for matching scope */
1347         sctp_from_the_top:
1348                 if (stcb->asoc.last_used_address == NULL) {
1349                         start_at_beginning=1;
1350                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1351                 }
1352                 /* search beginning with the last used address */
1353                 for (laddr = stcb->asoc.last_used_address; laddr;
1354                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1355                         if (laddr->ifa == NULL) {
1356                                 /* address has been removed */
1357                                 continue;
1358                         }
1359                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1360                         if (sin6 == NULL)
1361                                 continue;
1362                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1363                                 /* on the no-no list */
1364                                 continue;
1365                         }
1366                         /* is it of matching scope ? */
1367                         if ((loopscope == 0) &&
1368                             (loc_scope == 0) &&
1369                             (sin_loop == 0) &&
1370                             (sin_local == 0)) {
1371                                 /* all of global scope we are ok with it */
1372                                 return (sin6);
1373                         }
1374                         if (loopscope && sin_loop)
1375                                 /* both on the loopback, thats ok */
1376                                 return (sin6);
1377                         if (loc_scope && sin_local)
1378                                 /* both local scope */
1379                                 return (sin6);
1380
1381                 }
1382                 if (start_at_beginning == 0) {
1383                         stcb->asoc.last_used_address = NULL;
1384                         goto sctp_from_the_top;
1385                 }
1386                 /* now try for any higher scope than the destination */
1387                 stcb->asoc.last_used_address = starting_point;
1388                 start_at_beginning = 0;
1389         sctp_from_the_top2:
1390                 if (stcb->asoc.last_used_address == NULL) {
1391                         start_at_beginning=1;
1392                         stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1393                 }
1394                 /* search beginning with the last used address */
1395                 for (laddr = stcb->asoc.last_used_address; laddr;
1396                      laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1397                         if (laddr->ifa == NULL) {
1398                                 /* address has been removed */
1399                                 continue;
1400                         }
1401                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1402                         if (sin6 == NULL)
1403                                 continue;
1404                         if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1405                                 /* on the no-no list */
1406                                 continue;
1407                         }
1408                         return (sin6);
1409                 }
1410                 if (start_at_beginning == 0) {
1411                         stcb->asoc.last_used_address = NULL;
1412                         goto sctp_from_the_top2;
1413                 }
1414         } else {
1415 #ifdef SCTP_DEBUG
1416                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1417                         kprintf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
1418                 }
1419 #endif
1420                 /* First try for interface output match */
1421                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1422                              sctp_nxt_addr) {
1423                         if (laddr->ifa == NULL) {
1424                                 /* address has been removed */
1425                                 continue;
1426                         }
1427                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1428                         if (sin6 == NULL)
1429                                 continue;
1430                         /* first question, is laddr->ifa an address associated with the emit interface */
1431                         if (ifn) {
1432                                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1433                                         if (laddr->ifa == ifa) {
1434                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1435                                                 return (sin6);
1436                                         }
1437                                         if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1438                                                 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1439                                                 return (sin6);
1440                                         }
1441                                 }
1442                         }
1443                 }
1444                 /* Next try for matching scope */
1445                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1446                              sctp_nxt_addr) {
1447                         if (laddr->ifa == NULL) {
1448                                 /* address has been removed */
1449                                 continue;
1450                         }
1451                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1452                         if (sin6 == NULL)
1453                                 continue;
1454
1455                         if ((loopscope == 0) &&
1456                             (loc_scope == 0) &&
1457                             (sin_loop == 0) &&
1458                             (sin_local == 0)) {
1459                                 /* all of global scope we are ok with it */
1460                                 return (sin6);
1461                         }
1462                         if (loopscope && sin_loop)
1463                                 /* both on the loopback, thats ok */
1464                                 return (sin6);
1465                         if (loc_scope && sin_local)
1466                                 /* both local scope */
1467                                 return (sin6);
1468                 }
1469                 /* ok, now try for a higher scope in the source address */
1470                 /* First try for matching scope */
1471                 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1472                              sctp_nxt_addr) {
1473                         if (laddr->ifa == NULL) {
1474                                 /* address has been removed */
1475                                 continue;
1476                         }
1477                         sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1478                         if (sin6 == NULL)
1479                                 continue;
1480                         return (sin6);
1481                 }
1482         }
1483         return (NULL);
1484 }
1485
1486 static struct sockaddr_in6 *
1487 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1488                                  struct rtentry *rt,
1489                                  uint8_t loc_scope,
1490                                  uint8_t loopscope)
1491 {
1492         /*
1493          * Here we are bound specific and have only
1494          * an inp. We must find an address that is bound
1495          * that we can give out as a src address. We
1496          * prefer two addresses of same scope if we can
1497          * find them that way.
1498          */
1499         struct sctp_laddr *laddr;
1500         struct sockaddr_in6 *sin6;
1501         struct ifnet *ifn;
1502         struct ifaddr *ifa;
1503         int sin_loop, sin_local;
1504
1505         /* first question, is the ifn we will emit on
1506          * in our list, if so, we want that one.
1507          */
1508
1509         ifn = rt->rt_ifp;
1510         if (ifn) {
1511                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1512                         sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1513                         if (sin6 == NULL)
1514                                 continue;
1515                         if (sctp_is_addr_in_ep(inp, ifa)) {
1516                                 return (sin6);
1517                         }
1518                 }
1519         }
1520         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1521              laddr && (laddr != inp->next_addr_touse);
1522              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1523                 if (laddr->ifa == NULL) {
1524                         /* address has been removed */
1525                         continue;
1526                 }
1527                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1528                 if (sin6 == NULL)
1529                         continue;
1530
1531                 if ((loopscope == 0) &&
1532                     (loc_scope == 0) &&
1533                     (sin_loop == 0) &&
1534                     (sin_local == 0)) {
1535                         /* all of global scope we are ok with it */
1536                         return (sin6);
1537                 }
1538                 if (loopscope && sin_loop)
1539                         /* both on the loopback, thats ok */
1540                         return (sin6);
1541                 if (loc_scope && sin_local)
1542                         /* both local scope */
1543                         return (sin6);
1544
1545         }
1546         /* if we reach here, we could not find two addresses
1547          * of the same scope to give out. Lets look for any higher level
1548          * scope for a source address.
1549          */
1550         for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1551              laddr && (laddr != inp->next_addr_touse);
1552              laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1553                 if (laddr->ifa == NULL) {
1554                         /* address has been removed */
1555                         continue;
1556                 }
1557                 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1558                 if (sin6 == NULL)
1559                         continue;
1560                 return (sin6);
1561         }
1562         /* no address bound can be a source for the destination */
1563 #ifdef SCTP_DEBUG
1564         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1565                 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1566         }
1567 #endif
1568         return (NULL);
1569 }
1570
1571
1572 static struct sockaddr_in6 *
1573 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1574                                            uint8_t loc_scope, int cur_addr_num, int match_scope)
1575 {
1576         struct ifaddr *ifa;
1577         struct sockaddr_in6 *sin6;
1578         int sin_loop, sin_local;
1579         int num_eligible_addr = 0;
1580
1581         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1582                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1583                 if (sin6 == NULL)
1584                         continue;
1585                 if (stcb) {
1586                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1587                                 /* It is restricted for some reason.. probably
1588                                  * not yet added.
1589                                  */
1590                                 continue;
1591                         }
1592                 }
1593                 if (match_scope) {
1594                         /* Here we are asked to match scope if possible */
1595                         if (loopscope && sin_loop)
1596                                 /* src and destination are loopback scope */
1597                                 return (sin6);
1598                         if (loc_scope && sin_local)
1599                                 /* src and destination are local scope */
1600                                 return (sin6);
1601                         if ((loopscope == 0) &&
1602                             (loc_scope == 0)  &&
1603                             (sin_loop == 0) &&
1604                             (sin_local == 0)) {
1605                                 /* src and destination are global scope */
1606                                 return (sin6);
1607                         }
1608                         continue;
1609                 }
1610                 if (num_eligible_addr == cur_addr_num) {
1611                         /* this is it */
1612                         return (sin6);
1613                 }
1614                 num_eligible_addr++;
1615         }
1616         return (NULL);
1617 }
1618
1619
1620 static int
1621 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1622                                      int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1623 {
1624         struct ifaddr *ifa;
1625         struct sockaddr_in6 *sin6;
1626         int num_eligible_addr = 0;
1627         int sin_loop, sin_local;
1628
1629         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
1630                 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1631                 if (sin6 == NULL)
1632                         continue;
1633                 if (stcb) {
1634                         if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1635                                 /* It is restricted for some reason.. probably
1636                                  * not yet added.
1637                                  */
1638                                 continue;
1639                         }
1640                 }
1641                 num_eligible_addr++;
1642         }
1643         return (num_eligible_addr);
1644 }
1645
1646
1647 static struct sockaddr_in6 *
1648 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1649                         struct sctp_tcb *stcb,
1650                         struct sctp_nets *net,
1651                         struct rtentry *rt,
1652                         uint8_t loc_scope,
1653                         uint8_t loopscope,
1654                         int non_asoc_addr_ok)
1655 {
1656         /* Ok, we are bound all SO any address
1657          * is ok to use as long as it is NOT in the negative
1658          * list.
1659          */
1660         int num_eligible_addr;
1661         int cur_addr_num=0;
1662         int started_at_beginning=0;
1663         int match_scope_prefered;
1664         /* first question is, how many eligible addresses are
1665          * there for the destination ifn that we are using that
1666          * are within the proper scope?
1667          */
1668         struct ifnet *ifn;
1669         struct sockaddr_in6 *sin6;
1670
1671         ifn = rt->rt_ifp;
1672         if (net) {
1673                 cur_addr_num = net->indx_of_eligible_next_to_use;
1674         }
1675         if (cur_addr_num == 0) {
1676                 match_scope_prefered = 1;
1677         } else {
1678                 match_scope_prefered = 0;
1679         }
1680         num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1681 #ifdef SCTP_DEBUG
1682         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1683                 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1684         }
1685 #endif
1686         if (num_eligible_addr == 0) {
1687                 /* no eligible addresses, we must use some other
1688                  * interface address if we can find one.
1689                  */
1690                 goto bound_all_v6_plan_b;
1691         }
1692         /* Ok we have num_eligible_addr set with how many we can use,
1693          * this may vary from call to call due to addresses being deprecated etc..
1694          */
1695         if (cur_addr_num >= num_eligible_addr) {
1696                 cur_addr_num = 0;
1697         }
1698         /* select the nth address from the list (where cur_addr_num is the nth) and
1699          * 0 is the first one, 1 is the second one etc...
1700          */
1701 #ifdef SCTP_DEBUG
1702         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1703                 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1704                        cur_addr_num, match_scope_prefered);
1705         }
1706 #endif
1707         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1708                                                           loc_scope, cur_addr_num, match_scope_prefered);
1709         if (match_scope_prefered && (sin6 == NULL)) {
1710                 /* retry without the preference for matching scope */
1711 #ifdef SCTP_DEBUG
1712         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1713                 kprintf("retry with no match_scope_prefered\n");
1714         }
1715 #endif
1716                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1717                                                                   loc_scope, cur_addr_num, 0);
1718         }
1719         if (sin6) {
1720 #ifdef SCTP_DEBUG
1721                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1722                         kprintf("Selected address %d ifn:%x for the route\n", cur_addr_num, (u_int)ifn);
1723                 }
1724 #endif
1725                 if (net) {
1726                         /* store so we get the next one */
1727                         if (cur_addr_num < 255)
1728                                 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1729                         else
1730                                 net->indx_of_eligible_next_to_use = 0;
1731                 }
1732                 return (sin6);
1733         }
1734         num_eligible_addr = 0;
1735  bound_all_v6_plan_b:
1736         /* ok, if we reach here we either fell through
1737          * due to something changing during an interupt (unlikely)
1738          * or we have NO eligible source addresses for the ifn
1739          * of the route (most likely). We must look at all the other
1740          * interfaces EXCEPT rt->rt_ifp and do the same game.
1741          */
1742 #ifdef SCTP_DEBUG
1743         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1744                 kprintf("bound-all Plan B\n");
1745         }
1746 #endif
1747         if (inp->next_ifn_touse == NULL) {
1748                 started_at_beginning=1;
1749                 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1750 #ifdef SCTP_DEBUG
1751                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1752                         kprintf("Start at first IFN:%x\n", (u_int)inp->next_ifn_touse);
1753                 }
1754 #endif
1755         } else {
1756                 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1757 #ifdef SCTP_DEBUG
1758                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1759                         kprintf("Resume at IFN:%x\n", (u_int)inp->next_ifn_touse);
1760                 }
1761 #endif
1762                 if (inp->next_ifn_touse == NULL) {
1763 #ifdef SCTP_DEBUG
1764                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1765                                 kprintf("IFN Resets\n");
1766                         }
1767 #endif
1768                         started_at_beginning=1;
1769                         inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1770                 }
1771         }
1772         for (ifn = inp->next_ifn_touse; ifn;
1773              ifn = TAILQ_NEXT(ifn, if_list)) {
1774                 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1775                         /* wrong base scope */
1776                         continue;
1777                 }
1778                 if (loc_scope && (ifn->if_index != loc_scope)) {
1779                         /* by definition the scope (from to->sin6_scopeid)
1780                          * must match that of the interface. If not then
1781                          * we could pick a wrong scope for the address.
1782                          * Ususally we don't hit plan-b since the route
1783                          * handles this. However we can hit plan-b when
1784                          * we send to local-host so the route is the
1785                          * loopback interface, but the destination is a
1786                          * link local.
1787                          */
1788                         continue;
1789                 }
1790                 if (ifn == rt->rt_ifp) {
1791                         /* already looked at this guy */
1792                         continue;
1793                 }
1794                 /* Address rotation will only work when we are not
1795                  * rotating sourced interfaces and are using the interface
1796                  * of the route. We would need to have a per interface index
1797                  * in order to do proper rotation.
1798                  */
1799                 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1800 #ifdef SCTP_DEBUG
1801                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1802                         kprintf("IFN:%x has %d eligible\n", (u_int)ifn, num_eligible_addr);
1803                 }
1804 #endif
1805                 if (num_eligible_addr == 0) {
1806                         /* none we can use */
1807                         continue;
1808                 }
1809                 /* Ok we have num_eligible_addr set with how many we can use,
1810                  * this may vary from call to call due to addresses being deprecated etc..
1811                  */
1812                 inp->next_ifn_touse = ifn;
1813
1814                 /* select the first one we can find with perference for matching scope.
1815                  */
1816                 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1817                 if (sin6 == NULL) {
1818                         /* can't find one with matching scope how about a source with higher
1819                          * scope
1820                          */
1821                         sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1822                         if (sin6 == NULL)
1823                                 /* Hmm, can't find one in the interface now */
1824                                 continue;
1825                 }
1826 #ifdef SCTP_DEBUG
1827                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1828                         kprintf("Selected the %d'th address of ifn:%x\n",
1829                                cur_addr_num,
1830                                (u_int)ifn);
1831                 }
1832 #endif
1833                 return (sin6);
1834         }
1835         if (started_at_beginning == 0) {
1836                 /* we have not been through all of them yet, force
1837                  * us to go through them all.
1838                  */
1839 #ifdef SCTP_DEBUG
1840                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1841                         kprintf("Force a recycle\n");
1842                 }
1843 #endif
1844                 inp->next_ifn_touse = NULL;
1845                 goto bound_all_v6_plan_b;
1846         }
1847         return (NULL);
1848
1849 }
1850
1851 /* stcb and net may be NULL */
1852 struct in6_addr
1853 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1854     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1855     int non_asoc_addr_ok)
1856 {
1857         struct in6_addr ans;
1858         struct sockaddr_in6 *rt_addr;
1859         uint8_t loc_scope, loopscope;
1860         struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1861
1862         /*
1863          * This routine is tricky standard v6 src address
1864          * selection cannot take into account what we have
1865          * bound etc, so we can't use it.
1866          *
1867          * Instead here is what we must do:
1868          * 1) Make sure we have a route, if we
1869          *    don't have a route we can never reach the peer.
1870          * 2) Once we have a route, determine the scope of the
1871          *     route. Link local, loopback or global.
1872          * 3) Next we divide into three types. Either we
1873          *    are bound all.. which means we want to use
1874          *    one of the addresses of the interface we are
1875          *    going out. <or>
1876          * 4a) We have not stcb, which means we are using the
1877          *    specific addresses bound on an inp, in this
1878          *    case we are similar to the stcb case (4b below)
1879          *    accept the list is always a positive list.<or>
1880          * 4b) We are bound specific with a stcb, which means we have a
1881          *    list of bound addresses and we must see if the
1882          *    ifn of the route is actually one of the bound addresses.
1883          *    If not, then we must rotate addresses amongst properly
1884          *    scoped bound addresses, if so we use the address
1885          *    of the interface.
1886          * 5) Always, no matter which path we take through the above
1887          *    we must be sure the source address we use is allowed to
1888          *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1889          *    addresses cannot be used.
1890          * 6) Addresses that are deprecated MAY be used
1891          *              if (!ip6_use_deprecated) {
1892          *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1893          *                        skip the address
1894          *                    }
1895          *              }
1896          */
1897
1898         /*** 1> determine route, if not already done */
1899         if (ro->ro_rt == NULL) {
1900                 /*
1901                  * Need a route to cache.
1902                  */
1903 #ifndef SCOPEDROUTING
1904                 int scope_save;
1905                 scope_save = to->sin6_scope_id;
1906                 to->sin6_scope_id = 0;
1907 #endif
1908
1909 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1910                 rtalloc_ign(ro, 0UL);
1911 #else
1912                 rtalloc(ro);
1913 #endif
1914 #ifndef SCOPEDROUTING
1915                 to->sin6_scope_id = scope_save;
1916 #endif
1917         }
1918         if (ro->ro_rt == NULL) {
1919                 /*
1920                  * no route to host. this packet is going no-where.
1921                  * We probably should make sure we arrange to send back
1922                  * an error.
1923                  */
1924 #ifdef SCTP_DEBUG
1925                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1926                         kprintf("No route to host, this packet cannot be sent!\n");
1927                 }
1928 #endif
1929                 memset(&ans, 0, sizeof(ans));
1930                 return (ans);
1931         }
1932
1933         /*** 2a> determine scope for outbound address/route */
1934         loc_scope = loopscope = 0;
1935         /*
1936          * We base our scope on the outbound packet scope and route,
1937          * NOT the TCB (if there is one). This way in local scope we will only
1938          * use a local scope src address when we send to a local address.
1939          */
1940
1941         if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1942                 /* If the route goes to the loopback address OR
1943                  * the address is a loopback address, we are loopback
1944                  * scope.
1945                  */
1946 #ifdef SCTP_DEBUG
1947                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1948                         kprintf("Loopback scope is set\n");
1949                 }
1950 #endif
1951                 loc_scope = 0;
1952                 loopscope = 1;
1953                 if (net != NULL) {
1954                         /* mark it as local */
1955                         net->addr_is_local = 1;
1956                 }
1957
1958         } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
1959 #ifdef SCTP_DEBUG
1960                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1961                         kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
1962                 }
1963 #endif
1964                 if (to->sin6_scope_id)
1965                         loc_scope = to->sin6_scope_id;
1966                 else {
1967                         loc_scope = 1;
1968                 }
1969                 loopscope = 0;
1970         } else {
1971 #ifdef SCTP_DEBUG
1972                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1973                         kprintf("Global scope is set\n");
1974                 }
1975 #endif
1976         }
1977
1978         /* now, depending on which way we are bound we call the appropriate
1979          * routine to do steps 3-6
1980          */
1981 #ifdef SCTP_DEBUG
1982         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1983                 kprintf("Destination address:");
1984                 sctp_print_address((struct sockaddr *)to);
1985         }
1986 #endif
1987
1988         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1989 #ifdef SCTP_DEBUG
1990                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1991                         kprintf("Calling bound-all src addr selection for v6\n");
1992                 }
1993 #endif
1994                 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
1995         } else {
1996 #ifdef SCTP_DEBUG
1997                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1998                         kprintf("Calling bound-specific src addr selection for v6\n");
1999                 }
2000 #endif
2001                 if (stcb)
2002                         rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope,  non_asoc_addr_ok);
2003                 else
2004                         /* we can't have a non-asoc address since we have no association */
2005                         rt_addr = sctp_choose_v6_boundspecific_inp(inp,  ro->ro_rt, loc_scope, loopscope);
2006         }
2007         if (rt_addr == NULL) {
2008                 /* no suitable address? */
2009                 struct in6_addr in6;
2010 #ifdef SCTP_DEBUG
2011                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2012                         kprintf("V6 packet will reach dead-end no suitable src address\n");
2013                 }
2014 #endif
2015                 memset(&in6, 0, sizeof(in6));
2016                 return (in6);
2017         }
2018 #ifdef SCTP_DEBUG
2019         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2020                 kprintf("Source address selected is:");
2021                 sctp_print_address((struct sockaddr *)rt_addr);
2022         }
2023 #endif
2024         return (rt_addr->sin6_addr);
2025 }
2026
2027 static uint8_t
2028 sctp_get_ect(struct sctp_tcb *stcb,
2029              struct sctp_tmit_chunk *chk)
2030 {
2031         uint8_t this_random;
2032
2033         /* Huh? */
2034         if (sctp_ecn == 0)
2035                 return (0);
2036
2037         if (sctp_ecn_nonce == 0)
2038                 /* no nonce, always return ECT0 */
2039                 return (SCTP_ECT0_BIT);
2040
2041         if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2042                 /* Peer does NOT support it, so we send a ECT0 only */
2043                 return (SCTP_ECT0_BIT);
2044         }
2045
2046         if (chk == NULL)
2047            return (SCTP_ECT0_BIT);
2048
2049         if (((stcb->asoc.hb_random_idx == 3) &&
2050              (stcb->asoc.hb_ect_randombit > 7)) ||
2051              (stcb->asoc.hb_random_idx > 3)) {
2052                 uint32_t rndval;
2053                 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2054                 memcpy(stcb->asoc.hb_random_values, &rndval,
2055                        sizeof(stcb->asoc.hb_random_values));
2056                 this_random = stcb->asoc.hb_random_values[0];
2057                 stcb->asoc.hb_random_idx = 0;
2058                 stcb->asoc.hb_ect_randombit = 0;
2059         } else {
2060                 if (stcb->asoc.hb_ect_randombit > 7) {
2061                   stcb->asoc.hb_ect_randombit = 0;
2062                   stcb->asoc.hb_random_idx++;
2063                 }
2064                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2065         }
2066         if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2067                 if (chk != NULL)
2068                         /* ECN Nonce stuff */
2069                         chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2070                 stcb->asoc.hb_ect_randombit++;
2071                 return (SCTP_ECT1_BIT);
2072         } else {
2073                 stcb->asoc.hb_ect_randombit++;
2074                 return (SCTP_ECT0_BIT);
2075         }
2076 }
2077
2078 extern int sctp_no_csum_on_loopback;
2079
2080 static int
2081 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2082                            struct sctp_tcb *stcb,    /* may be NULL */
2083                            struct sctp_nets *net,
2084                            struct sockaddr *to,
2085                            struct mbuf *m,
2086                            int nofragment_flag,
2087                            int ecn_ok,
2088                            struct sctp_tmit_chunk *chk,
2089                            int out_of_asoc_ok)
2090         /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2091 {
2092         /*
2093          * Given a mbuf chain (via m_next) that holds a packet header
2094          * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2095          * - calculate SCTP checksum and fill in
2096          * - prepend a IP address header
2097          * - if boundall use INADDR_ANY
2098          * - if boundspecific do source address selection
2099          * - set fragmentation option for ipV4
2100          * - On return from IP output, check/adjust mtu size
2101          * - of output interface and smallest_mtu size as well.
2102          */
2103         struct sctphdr *sctphdr;
2104         int o_flgs;
2105         uint32_t csum;
2106         int ret;
2107         unsigned int have_mtu;
2108         struct route *ro;
2109
2110         if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2111                 sctp_m_freem(m);
2112                 return (EFAULT);
2113         }
2114         if ((m->m_flags & M_PKTHDR) == 0) {
2115 #ifdef SCTP_DEBUG
2116                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2117                         kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2118                 }
2119 #endif
2120                 sctp_m_freem(m);
2121                 return (EFAULT);
2122         }
2123         /* Calculate the csum and fill in the length of the packet */
2124         sctphdr = mtod(m, struct sctphdr *);
2125         have_mtu = 0;
2126         if (sctp_no_csum_on_loopback &&
2127              (stcb) &&
2128              (stcb->asoc.loopback_scope)) {
2129                 sctphdr->checksum = 0;
2130                 m->m_pkthdr.len = sctp_calculate_len(m);
2131         } else {
2132                 sctphdr->checksum = 0;
2133                 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2134                 sctphdr->checksum = csum;
2135         }
2136         if (to->sa_family == AF_INET) {
2137                 struct ip *ip;
2138                 struct route iproute;
2139                 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2140                 if (m == NULL) {
2141                         /* failed to prepend data, give up */
2142                         return (ENOMEM);
2143                 }
2144                 ip = mtod(m, struct ip *);
2145                 ip->ip_v = IPVERSION;
2146                 ip->ip_hl = (sizeof(struct ip) >> 2);
2147                 if (nofragment_flag) {
2148 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2149 #if defined( __OpenBSD__) || defined(__NetBSD__)
2150                         /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2151                         ip->ip_off = htons(IP_DF);
2152 #else
2153                         ip->ip_off = IP_DF;
2154 #endif
2155 #else
2156                         ip->ip_off = htons(IP_DF);
2157 #endif
2158                 } else
2159                         ip->ip_off = 0;
2160
2161 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2162 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2163                 ip->ip_id = htons(ip_randomid());
2164 #else
2165                 ip->ip_id = htons(ip_id++);
2166 #endif
2167
2168 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2169                 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2170 #else
2171                 ip->ip_ttl = inp->inp_ip_ttl;
2172 #endif
2173 #if defined(__OpenBSD__) || defined(__NetBSD__)
2174                 ip->ip_len = htons(m->m_pkthdr.len);
2175 #else
2176                 ip->ip_len = m->m_pkthdr.len;
2177 #endif
2178                 if (stcb) {
2179                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2180                                 /* Enable ECN */
2181 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2182                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2183                                                       sctp_get_ect(stcb, chk));
2184 #elif defined(__NetBSD__)
2185                                 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2186                                                       sctp_get_ect(stcb, chk));
2187 #else
2188                                 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2189                                                       sctp_get_ect(stcb, chk));
2190 #endif
2191                         } else {
2192                                 /* No ECN */
2193 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2194                                 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2195 #elif defined(__NetBSD__)
2196                                 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2197 #else
2198                                 ip->ip_tos = inp->inp_ip_tos;
2199 #endif
2200                         }
2201                 } else {
2202                         /* no association at all */
2203 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2204                         ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2205 #else
2206                         ip->ip_tos = inp->inp_ip_tos;
2207 #endif
2208                 }
2209                 ip->ip_p = IPPROTO_SCTP;
2210                 ip->ip_sum = 0;
2211                 if (net == NULL) {
2212                         ro = &iproute;
2213                         memset(&iproute, 0, sizeof(iproute));
2214                         memcpy(&ro->ro_dst, to, to->sa_len);
2215                 } else {
2216                         ro = (struct route *)&net->ro;
2217                 }
2218                 /* Now the address selection part */
2219                 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2220
2221                 /* call the routine to select the src address */
2222                 if (net) {
2223                         if (net->src_addr_selected == 0) {
2224                                 /* Cache the source address */
2225                                 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2226                                     stcb,
2227                                     ro, net, out_of_asoc_ok);
2228                                 if (ro->ro_rt)
2229                                         net->src_addr_selected = 1;
2230                         }
2231                         ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2232                 } else {
2233                         ip->ip_src = sctp_ipv4_source_address_selection(inp,
2234                             stcb, ro, net, out_of_asoc_ok);
2235                 }
2236                 /*
2237                  * If source address selection fails and we find no route then
2238                  * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2239                  * type error. We probably should catch that somewhere and
2240                  * abort the association right away (assuming this is an INIT
2241                  * being sent).
2242                  */
2243                 if ((ro->ro_rt == NULL)) {
2244                         /*
2245                          * src addr selection failed to find a route (or valid
2246                          * source addr), so we can't get there from here!
2247                          */
2248 #ifdef SCTP_DEBUG
2249                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2250                                 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2251                                 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2252                         }
2253 #endif /* SCTP_DEBUG */
2254                         if (net) {
2255                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2256                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2257                                                         stcb,
2258                                                         SCTP_FAILED_THRESHOLD,
2259                                                         (void *)net);
2260                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2261                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2262                                 if (stcb) {
2263                                         if (net == stcb->asoc.primary_destination) {
2264                                                 /* need a new primary */
2265                                                 struct sctp_nets *alt;
2266                                                 alt = sctp_find_alternate_net(stcb, net);
2267                                                 if (alt != net) {
2268                                                         if (sctp_set_primary_addr(stcb,
2269                                                                               (struct sockaddr *)NULL,
2270                                                                                  alt) == 0) {
2271                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2272                                                                 net->src_addr_selected = 0;
2273                                                         }
2274                                                 }
2275                                         }
2276                                 }
2277                         }
2278                         sctp_m_freem(m);
2279                         return (EHOSTUNREACH);
2280                 } else {
2281                         have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2282                 }
2283
2284                 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2285 #ifdef SCTP_DEBUG
2286                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2287                         kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2288                                (u_int)(ntohl(ip->ip_src.s_addr)));
2289                         kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2290                         kprintf("RTP route is %p through\n", ro->ro_rt);
2291                 }
2292 #endif
2293                 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2294                         ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2295                 }
2296                 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2297                                 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2298 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2299     || defined(__DragonFly__)
2300                                 , (struct inpcb *)NULL
2301 #endif
2302 #if defined(__NetBSD__)
2303                                 ,(struct socket *)inp->sctp_socket
2304 #endif
2305
2306 );
2307                 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2308                         ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2309                 }
2310                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2311 #ifdef SCTP_DEBUG
2312                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2313                         kprintf("Ip output returns %d\n", ret);
2314                 }
2315 #endif
2316                 if (net == NULL) {
2317                         /* free tempy routes */
2318                         if (ro->ro_rt)
2319                                 RTFREE(ro->ro_rt);
2320                 } else {
2321                         /* PMTU check versus smallest asoc MTU goes here */
2322                         if (ro->ro_rt != NULL) {
2323                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2324                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2325                                         sctp_mtu_size_reset(inp, &stcb->asoc,
2326                                             ro->ro_rt->rt_rmx.rmx_mtu);
2327                                 }
2328                         } else {
2329                                 /* route was freed */
2330                                 net->src_addr_selected = 0;
2331                         }
2332                 }
2333                 return (ret);
2334         }
2335 #ifdef INET6
2336         else if (to->sa_family == AF_INET6) {
2337                 struct ip6_hdr *ip6h;
2338 #ifdef NEW_STRUCT_ROUTE
2339                 struct route ip6route;
2340 #else
2341                 struct route_in6 ip6route;
2342 #endif
2343                 struct ifnet *ifp;
2344                 u_char flowTop;
2345                 uint16_t flowBottom;
2346                 u_char tosBottom, tosTop;
2347                 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2348                 struct sockaddr_in6 lsa6_storage;
2349                 int prev_scope=0;
2350                 int error;
2351                 u_short prev_port=0;
2352
2353                 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2354                 if (m == NULL) {
2355                         /* failed to prepend data, give up */
2356                         return (ENOMEM);
2357                 }
2358                 ip6h = mtod(m, struct ip6_hdr *);
2359
2360                 /*
2361                  * We assume here that inp_flow is in host byte order within
2362                  * the TCB!
2363                  */
2364                 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2365                 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2366
2367                 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2368
2369                 /* protect *sin6 from overwrite */
2370                 sin6 = (struct sockaddr_in6 *)to;
2371                 tmp = *sin6;
2372                 sin6 = &tmp;
2373
2374                 /* KAME hack: embed scopeid */
2375 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2376                 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2377 #else
2378                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2379 #endif
2380                         return (EINVAL);
2381                 if (net == NULL) {
2382                         memset(&ip6route, 0, sizeof(ip6route));
2383                         ro = (struct route *)&ip6route;
2384                         memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2385                 } else {
2386                         ro = (struct route *)&net->ro;
2387                 }
2388                 if (stcb != NULL) {
2389                         if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2390                                 /* Enable ECN */
2391                                 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2392                         } else {
2393                                 /* No ECN */
2394                                 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2395                         }
2396                 } else {
2397                         /* we could get no asoc if it is a O-O-T-B packet */
2398                         tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2399                 }
2400                 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2401                 ip6h->ip6_nxt = IPPROTO_SCTP;
2402                 ip6h->ip6_plen = m->m_pkthdr.len;
2403                 ip6h->ip6_dst = sin6->sin6_addr;
2404
2405                 /*
2406                  * Add SRC address selection here:
2407                  * we can only reuse to a limited degree the kame src-addr-sel,
2408                  * since we can try their selection but it may not be bound.
2409                  */
2410                 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2411                 lsa6_tmp.sin6_family = AF_INET6;
2412                 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2413                 lsa6 = &lsa6_tmp;
2414                 if (net) {
2415                         if (net->src_addr_selected == 0) {
2416                                 /* Cache the source address */
2417                                 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2418                                     stcb, ro, net, out_of_asoc_ok);
2419
2420                                 if (ro->ro_rt)
2421                                         net->src_addr_selected = 1;
2422                         }
2423                         lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2424                 } else {
2425                         lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2426                             inp, stcb, ro, net, out_of_asoc_ok);
2427                 }
2428                 lsa6->sin6_port = inp->sctp_lport;
2429
2430                 if ((ro->ro_rt ==  NULL)) {
2431                         /*
2432                          * src addr selection failed to find a route (or valid
2433                          * source addr), so we can't get there from here!
2434                          */
2435 #ifdef SCTP_DEBUG
2436                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2437                                 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2438                         }
2439 #endif
2440                         sctp_m_freem(m);
2441                         if (net) {
2442                                 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2443                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2444                                                         stcb,
2445                                                         SCTP_FAILED_THRESHOLD,
2446                                                         (void *)net);
2447                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2448                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2449                                 if (stcb) {
2450                                         if (net == stcb->asoc.primary_destination) {
2451                                                 /* need a new primary */
2452                                                 struct sctp_nets *alt;
2453                                                 alt = sctp_find_alternate_net(stcb, net);
2454                                                 if (alt != net) {
2455                                                         if (sctp_set_primary_addr(stcb,
2456                                                                               (struct sockaddr *)NULL,
2457                                                                                  alt) == 0) {
2458                                                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2459                                                                 net->src_addr_selected = 0;
2460                                                         }
2461                                                 }
2462                                         }
2463                                 }
2464                         }
2465                         return (EHOSTUNREACH);
2466                 }
2467
2468 #ifndef SCOPEDROUTING
2469                 /*
2470                  * XXX: sa6 may not have a valid sin6_scope_id in
2471                  * the non-SCOPEDROUTING case.
2472                  */
2473                 bzero(&lsa6_storage, sizeof(lsa6_storage));
2474                 lsa6_storage.sin6_family = AF_INET6;
2475                 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2476                 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2477                                               NULL)) != 0) {
2478                         sctp_m_freem(m);
2479                         return (error);
2480                 }
2481                 /* XXX */
2482                 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2483                 lsa6_storage.sin6_port = inp->sctp_lport;
2484                 lsa6 = &lsa6_storage;
2485 #endif /* SCOPEDROUTING */
2486                 ip6h->ip6_src = lsa6->sin6_addr;
2487
2488                 /*
2489                  * We set the hop limit now since there is a good chance that
2490                  * our ro pointer is now filled
2491                  */
2492                 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2493                                                 (ro ?
2494                                                  (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2495                                                  (NULL)));
2496                 o_flgs = 0;
2497                 ifp = ro->ro_rt->rt_ifp;
2498 #ifdef SCTP_DEBUG
2499                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2500                         /* Copy to be sure something bad is not happening */
2501                         sin6->sin6_addr = ip6h->ip6_dst;
2502                         lsa6->sin6_addr = ip6h->ip6_src;
2503
2504                         kprintf("Calling ipv6 output routine from low level\n");
2505                         kprintf("src: ");
2506                         sctp_print_address((struct sockaddr *)lsa6);
2507                         kprintf("dst: ");
2508                         sctp_print_address((struct sockaddr *)sin6);
2509                 }
2510 #endif /* SCTP_DEBUG */
2511                 if (net) {
2512                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2513                         /* preserve the port and scope for link local send */
2514                         prev_scope = sin6->sin6_scope_id;
2515                         prev_port = sin6->sin6_port;
2516                 }
2517                 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2518 #ifdef NEW_STRUCT_ROUTE
2519                                  ro,
2520 #else
2521                                  (struct route_in6 *)ro,
2522 #endif
2523                                  o_flgs,
2524                                  ((struct in6pcb *)inp)->in6p_moptions,
2525 #if defined(__NetBSD__)
2526                                  (struct socket *)inp->sctp_socket,
2527 #endif
2528                                  &ifp
2529 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2530                     , NULL
2531 #endif
2532                         );
2533                 if (net) {
2534                         /* for link local this must be done */
2535                         sin6->sin6_scope_id = prev_scope;
2536                         sin6->sin6_port = prev_port;
2537                 }
2538 #ifdef SCTP_DEBUG
2539                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2540                         kprintf("return from send is %d\n", ret);
2541                 }
2542 #endif /* SCTP_DEBUG_OUTPUT */
2543                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2544                 if (net == NULL) {
2545                         /* Now if we had a temp route free it */
2546                         if (ro->ro_rt) {
2547                                 RTFREE(ro->ro_rt);
2548                         }
2549                 } else {
2550                         /* PMTU check versus smallest asoc MTU goes here */
2551                         if (ro->ro_rt == NULL) {
2552                                 /* Route was freed */
2553                                 net->src_addr_selected = 0;
2554                         }
2555                         if (ro->ro_rt != NULL) {
2556                                 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2557                                     (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2558                                         sctp_mtu_size_reset(inp,
2559                                                             &stcb->asoc,
2560                                                             ro->ro_rt->rt_rmx.rmx_mtu);
2561                                 }
2562                         } else if (ifp) {
2563 #if (defined(SCTP_BASE_FREEBSD) &&  __FreeBSD_version < 500000) || defined(__APPLE__)
2564 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2565 #endif /* SCTP_BASE_FREEBSD */
2566                                 if (ND_IFINFO(ifp)->linkmtu &&
2567                                     (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2568                                         sctp_mtu_size_reset(inp,
2569                                                             &stcb->asoc,
2570                                                             ND_IFINFO(ifp)->linkmtu);
2571                                 }
2572                         }
2573                 }
2574                 return (ret);
2575         }
2576 #endif
2577         else {
2578 #ifdef SCTP_DEBUG
2579                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2580                         kprintf("Unknown protocol (TSNH) type %d\n", ((struct sockaddr *)to)->sa_family);
2581                 }
2582 #endif
2583                 sctp_m_freem(m);
2584                 return (EFAULT);
2585         }
2586 }
2587
2588 static int
2589 sctp_is_address_in_scope(struct ifaddr *ifa,
2590                          int ipv4_addr_legal,
2591                          int ipv6_addr_legal,
2592                          int loopback_scope,
2593                          int ipv4_local_scope,
2594                          int local_scope,
2595                          int site_scope)
2596 {
2597         if ((loopback_scope == 0) &&
2598             (ifa->ifa_ifp) &&
2599             (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2600                 /* skip loopback if not in scope *
2601                  */
2602                 return (0);
2603         }
2604         if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2605                 struct sockaddr_in *sin;
2606                 sin = (struct sockaddr_in *)ifa->ifa_addr;
2607                 if (sin->sin_addr.s_addr == 0) {
2608                         /* not in scope , unspecified */
2609                         return (0);
2610                 }
2611                 if ((ipv4_local_scope == 0) &&
2612                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2613                         /* private address not in scope */
2614                         return (0);
2615                 }
2616         } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2617                 struct sockaddr_in6 *sin6;
2618                 struct in6_ifaddr *ifa6;
2619
2620                 ifa6 = (struct in6_ifaddr *)ifa;
2621                 /* ok to use deprecated addresses? */
2622                 if (!ip6_use_deprecated) {
2623                         if (ifa6->ia6_flags &
2624                             IN6_IFF_DEPRECATED) {
2625                                 return (0);
2626                         }
2627                 }
2628                 if (ifa6->ia6_flags &
2629                     (IN6_IFF_DETACHED |
2630                      IN6_IFF_ANYCAST |
2631                      IN6_IFF_NOTREADY)) {
2632                         return (0);
2633                 }
2634                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2635                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2636                         /* skip unspecifed addresses */
2637                         return (0);
2638                 }
2639                 if (/*(local_scope == 0) && */
2640                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2641                         return (0);
2642                 }
2643                 if ((site_scope == 0) &&
2644                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2645                         return (0);
2646                 }
2647         } else {
2648                 return (0);
2649         }
2650         return (1);
2651 }
2652
2653
2654 void
2655 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2656 {
2657         struct mbuf *m, *m_at, *m_last;
2658         struct sctp_nets *net;
2659         struct sctp_init_msg *initm;
2660         struct sctp_supported_addr_param *sup_addr;
2661         struct sctp_ecn_supported_param *ecn;
2662         struct sctp_prsctp_supported_param *prsctp;
2663         struct sctp_ecn_nonce_supported_param *ecn_nonce;
2664         struct sctp_supported_chunk_types_param *pr_supported;
2665         int cnt_inits_to=0;
2666         int padval, ret;
2667
2668         /* INIT's always go to the primary (and usually ONLY address) */
2669         m_last = NULL;
2670         net = stcb->asoc.primary_destination;
2671         if (net == NULL) {
2672                 net = TAILQ_FIRST(&stcb->asoc.nets);
2673                 if (net == NULL) {
2674                         /* TSNH */
2675                         return;
2676                 }
2677                 /* we confirm any address we send an INIT to */
2678                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2679                 sctp_set_primary_addr(stcb, NULL, net);
2680         } else {
2681                 /* we confirm any address we send an INIT to */
2682                 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2683         }
2684 #ifdef SCTP_DEBUG
2685         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2686                 kprintf("Sending INIT to ");
2687                 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2688         }
2689 #endif
2690         if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2691                 /* special hook, if we are sending to link local
2692                  * it will not show up in our private address count.
2693                  */
2694                 struct sockaddr_in6 *sin6l;
2695                 sin6l = &net->ro._l_addr.sin6;
2696                 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2697                         cnt_inits_to = 1;
2698         }
2699         if (callout_pending(&net->rxt_timer.timer)) {
2700                 /* This case should not happen */
2701                 return;
2702         }
2703         /* start the INIT timer */
2704         if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2705                 /* we are hosed since I can't start the INIT timer? */
2706                 return;
2707         }
2708         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2709         if (m == NULL) {
2710                 /* No memory, INIT timer will re-attempt. */
2711                 return;
2712         }
2713         /* make it into a M_EXT */
2714         MCLGET(m, MB_DONTWAIT);
2715         if ((m->m_flags & M_EXT) != M_EXT) {
2716                 /* Failed to get cluster buffer */
2717                 sctp_m_freem(m);
2718                 return;
2719         }
2720         m->m_data += SCTP_MIN_OVERHEAD;
2721         m->m_len = sizeof(struct sctp_init_msg);
2722         /* Now lets put the SCTP header in place */
2723         initm = mtod(m, struct sctp_init_msg *);
2724         initm->sh.src_port = inp->sctp_lport;
2725         initm->sh.dest_port = stcb->rport;
2726         initm->sh.v_tag = 0;
2727         initm->sh.checksum = 0; /* calculate later */
2728         /* now the chunk header */
2729         initm->msg.ch.chunk_type = SCTP_INITIATION;
2730         initm->msg.ch.chunk_flags = 0;
2731         /* fill in later from mbuf we build */
2732         initm->msg.ch.chunk_length = 0;
2733         /* place in my tag */
2734         initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2735         /* set up some of the credits. */
2736         initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2737             SCTP_MINIMAL_RWND));
2738
2739         initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2740         initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2741         initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2742         /* now the address restriction */
2743         sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2744             sizeof(*initm));
2745         sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2746         /* we support 2 types IPv6/IPv4 */
2747         sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2748                                           sizeof(uint16_t));
2749         sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2750         sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2751         m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2752
2753 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2754         if (inp->sctp_ep.adaption_layer_indicator) {
2755                 struct sctp_adaption_layer_indication *ali;
2756                 ali = (struct sctp_adaption_layer_indication *)(
2757                     (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2758                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2759                 ali->ph.param_length = htons(sizeof(*ali));
2760                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2761                 m->m_len += sizeof(*ali);
2762                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2763                     sizeof(*ali));
2764         } else {
2765                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2766                     sizeof(*sup_addr) + sizeof(uint16_t));
2767         }
2768
2769         /* now any cookie time extensions */
2770         if (stcb->asoc.cookie_preserve_req) {
2771                 struct sctp_cookie_perserve_param *cookie_preserve;
2772                 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2773                 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2774                 cookie_preserve->ph.param_length = htons(
2775                     sizeof(*cookie_preserve));
2776                 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2777                 m->m_len += sizeof(*cookie_preserve);
2778                 ecn = (struct sctp_ecn_supported_param *)(
2779                     (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2780                 stcb->asoc.cookie_preserve_req = 0;
2781         }
2782
2783         /* ECN parameter */
2784         if (sctp_ecn == 1) {
2785                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2786                 ecn->ph.param_length = htons(sizeof(*ecn));
2787                 m->m_len += sizeof(*ecn);
2788                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2789                     sizeof(*ecn));
2790         } else {
2791                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2792         }
2793         /* And now tell the peer we do pr-sctp */
2794         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2795         prsctp->ph.param_length = htons(sizeof(*prsctp));
2796         m->m_len += sizeof(*prsctp);
2797
2798
2799         /* And now tell the peer we do all the extensions */
2800         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2801            sizeof(*prsctp));
2802
2803         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2804         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2805         pr_supported->chunk_types[0] = SCTP_ASCONF;
2806         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2807         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2808         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2809         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2810         pr_supported->chunk_types[5] = 0; /* pad */
2811         pr_supported->chunk_types[6] = 0; /* pad */
2812         pr_supported->chunk_types[7] = 0; /* pad */
2813
2814         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2815         /* ECN nonce: And now tell the peer we support ECN nonce */
2816
2817         if (sctp_ecn_nonce) {
2818                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2819                     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2820                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2821                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2822                 m->m_len += sizeof(*ecn_nonce);
2823         }
2824
2825         m_at = m;
2826         /* now the addresses */
2827         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2828                 struct ifnet *ifn;
2829                 struct ifaddr *ifa;
2830                 int cnt;
2831
2832                 cnt = cnt_inits_to;
2833                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2834                         if ((stcb->asoc.loopback_scope == 0) &&
2835                             (ifn->if_type == IFT_LOOP)) {
2836                                 /*
2837                                  * Skip loopback devices if loopback_scope
2838                                  * not set
2839                                  */
2840                                 continue;
2841                         }
2842                         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
2843                                 if (sctp_is_address_in_scope(ifa,
2844                                     stcb->asoc.ipv4_addr_legal,
2845                                     stcb->asoc.ipv6_addr_legal,
2846                                     stcb->asoc.loopback_scope,
2847                                     stcb->asoc.ipv4_local_scope,
2848                                     stcb->asoc.local_scope,
2849                                     stcb->asoc.site_scope) == 0) {
2850                                         continue;
2851                                 }
2852                                 cnt++;
2853                         }
2854                 }
2855                 if (cnt > 1) {
2856                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2857                                 if ((stcb->asoc.loopback_scope == 0) &&
2858                                     (ifn->if_type == IFT_LOOP)) {
2859                                         /*
2860                                          * Skip loopback devices if loopback_scope
2861                                          * not set
2862                                          */
2863                                         continue;
2864                                 }
2865                                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
2866                                         if (sctp_is_address_in_scope(ifa,
2867                                             stcb->asoc.ipv4_addr_legal,
2868                                             stcb->asoc.ipv6_addr_legal,
2869                                             stcb->asoc.loopback_scope,
2870                                             stcb->asoc.ipv4_local_scope,
2871                                             stcb->asoc.local_scope,
2872                                             stcb->asoc.site_scope) == 0) {
2873                                                 continue;
2874                                         }
2875                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2876                                 }
2877                         }
2878                 }
2879         } else {
2880                 struct sctp_laddr *laddr;
2881                 int cnt;
2882                 cnt = cnt_inits_to;
2883                 /* First, how many ? */
2884                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2885                         if (laddr->ifa == NULL) {
2886                                 continue;
2887                         }
2888                         if (laddr->ifa->ifa_addr == NULL)
2889                                 continue;
2890                         if (sctp_is_address_in_scope(laddr->ifa,
2891                             stcb->asoc.ipv4_addr_legal,
2892                             stcb->asoc.ipv6_addr_legal,
2893                             stcb->asoc.loopback_scope,
2894                             stcb->asoc.ipv4_local_scope,
2895                             stcb->asoc.local_scope,
2896                             stcb->asoc.site_scope) == 0) {
2897                                 continue;
2898                         }
2899                         cnt++;
2900                 }
2901                 /* To get through a NAT we only list addresses if
2902                  * we have more than one. That way if you just
2903                  * bind a single address we let the source of the init
2904                  * dictate our address.
2905                  */
2906                 if (cnt > 1) {
2907                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2908                                 if (laddr->ifa == NULL) {
2909                                         continue;
2910                                 }
2911                                 if (laddr->ifa->ifa_addr == NULL) {
2912                                         continue;
2913                                 }
2914
2915                                 if (sctp_is_address_in_scope(laddr->ifa,
2916                                     stcb->asoc.ipv4_addr_legal,
2917                                     stcb->asoc.ipv6_addr_legal,
2918                                     stcb->asoc.loopback_scope,
2919                                     stcb->asoc.ipv4_local_scope,
2920                                     stcb->asoc.local_scope,
2921                                     stcb->asoc.site_scope) == 0) {
2922                                         continue;
2923                                 }
2924                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2925                         }
2926                 }
2927         }
2928         /* calulate the size and update pkt header and chunk header */
2929         m->m_pkthdr.len = 0;
2930         for (m_at = m; m_at; m_at = m_at->m_next) {
2931                 if (m_at->m_next == NULL)
2932                         m_last = m_at;
2933                 m->m_pkthdr.len += m_at->m_len;
2934         }
2935         initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2936             sizeof(struct sctphdr)));
2937         /* We pass 0 here to NOT set IP_DF if its IPv4, we
2938          * ignore the return here since the timer will drive
2939          * a retranmission.
2940          */
2941
2942         /* I don't expect this to execute but we will be safe here */
2943         padval = m->m_pkthdr.len % 4;
2944         if ((padval) && (m_last)) {
2945                 /* The compiler worries that m_last may not be
2946                  * set even though I think it is impossible :->
2947                  * however we add m_last here just in case.
2948                  */
2949                 int ret;
2950                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2951                 if (ret) {
2952                         /* Houston we have a problem, no space */
2953                         sctp_m_freem(m);
2954                         return;
2955                 }
2956                 m->m_pkthdr.len += padval;
2957         }
2958 #ifdef SCTP_DEBUG
2959         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2960                 kprintf("Calling lowlevel output stcb:%x net:%x\n",
2961                        (u_int)stcb, (u_int)net);
2962         }
2963 #endif
2964         ret = sctp_lowlevel_chunk_output(inp, stcb, net,
2965                   (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
2966 #ifdef SCTP_DEBUG
2967         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2968                 kprintf("Low level output returns %d\n", ret);
2969         }
2970 #endif
2971         sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
2972         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
2973 }
2974
2975 struct mbuf *
2976 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
2977     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
2978 {
2979         /* Given a mbuf containing an INIT or INIT-ACK
2980          * with the param_offset being equal to the
2981          * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
2982          * parse through the parameters to the end of the mbuf verifying
2983          * that all parameters are known.
2984          *
2985          * For unknown parameters build and return a mbuf with
2986          * UNRECOGNIZED_PARAMETER errors. If the flags indicate
2987          * to stop processing this chunk stop, and set *abort_processing
2988          * to 1.
2989          *
2990          * By having param_offset be pre-set to where parameters begin
2991          * it is hoped that this routine may be reused in the future
2992          * by new features.
2993          */
2994         struct sctp_paramhdr *phdr, params;
2995
2996         struct mbuf *mat, *op_err;
2997         char tempbuf[2048];
2998         int at, limit, pad_needed;
2999         uint16_t ptype, plen;
3000         int err_at;
3001
3002         *abort_processing = 0;
3003         mat = in_initpkt;
3004         err_at = 0;
3005         limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3006 #ifdef SCTP_DEBUG
3007         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3008                 kprintf("Limit is %d bytes\n", limit);
3009         }
3010 #endif
3011         at = param_offset;
3012         op_err = NULL;
3013
3014         phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3015         while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3016                 ptype = ntohs(phdr->param_type);
3017                 plen = ntohs(phdr->param_length);
3018                 limit -= SCTP_SIZE32(plen);
3019                 if (plen < sizeof(struct sctp_paramhdr)) {
3020 #ifdef SCTP_DEBUG
3021         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3022                         kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3023         }
3024 #endif
3025                         *abort_processing = 1;
3026                         break;
3027                 }
3028                 /* All parameters for all chunks that we
3029                  * know/understand are listed here. We process
3030                  * them other places and make appropriate
3031                  * stop actions per the upper bits. However
3032                  * this is the generic routine processor's can
3033                  * call to get back an operr.. to either incorporate (init-ack)
3034                  * or send.
3035                  */
3036                 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3037                     (ptype == SCTP_IPV4_ADDRESS) ||
3038                     (ptype == SCTP_IPV6_ADDRESS) ||
3039                     (ptype == SCTP_STATE_COOKIE) ||
3040                     (ptype == SCTP_UNRECOG_PARAM) ||
3041                     (ptype == SCTP_COOKIE_PRESERVE) ||
3042                     (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3043                     (ptype == SCTP_PRSCTP_SUPPORTED) ||
3044                     (ptype == SCTP_ADD_IP_ADDRESS) ||
3045                     (ptype == SCTP_DEL_IP_ADDRESS) ||
3046                     (ptype == SCTP_ECN_CAPABLE) ||
3047                     (ptype == SCTP_ULP_ADAPTION) ||
3048                     (ptype == SCTP_ERROR_CAUSE_IND) ||
3049                     (ptype == SCTP_SET_PRIM_ADDR) ||
3050                     (ptype == SCTP_SUCCESS_REPORT) ||
3051                     (ptype == SCTP_ULP_ADAPTION) ||
3052                     (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3053                     (ptype == SCTP_ECN_NONCE_SUPPORTED)
3054                         ) {
3055                         /* no skip it */
3056                         at += SCTP_SIZE32(plen);
3057                 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3058                         /* We can NOT handle HOST NAME addresses!! */
3059 #ifdef SCTP_DEBUG
3060         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3061                 kprintf("Can't handle hostname addresses.. abort processing\n");
3062         }
3063 #endif
3064                         *abort_processing = 1;
3065                         if (op_err == NULL) {
3066                                 /* Ok need to try to get a mbuf */
3067                                 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3068                                 if (op_err) {
3069                                         op_err->m_len = 0;
3070                                         op_err->m_pkthdr.len = 0;
3071                                         /* pre-reserve space for ip and sctp header  and chunk hdr*/
3072                                         op_err->m_data += sizeof(struct ip6_hdr);
3073                                         op_err->m_data += sizeof(struct sctphdr);
3074                                         op_err->m_data += sizeof(struct sctp_chunkhdr);
3075                                 }
3076                         }
3077                         if (op_err) {
3078                                 /* If we have space */
3079                                 struct sctp_paramhdr s;
3080                                 if (err_at % 4) {
3081                                         u_int32_t cpthis=0;
3082                                         pad_needed = 4 - (err_at % 4);
3083                                         m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3084                                         err_at += pad_needed;
3085                                 }
3086                                 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3087                                 s.param_length = htons(sizeof(s) + plen);
3088                                 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3089                                 err_at += sizeof(s);
3090                                 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3091                                 if (phdr == NULL) {
3092                                         sctp_m_freem(op_err);
3093                                         /* we are out of memory but we
3094                                          * still need to have a look at what to
3095                                          * do (the system is in trouble though).
3096                                          */
3097                                         return (NULL);
3098                                 }
3099                                 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3100                                 err_at += plen;
3101                         }
3102                         return (op_err);
3103                 } else {
3104                         /* we do not recognize the parameter
3105                          * figure out what we do.
3106                          */
3107 #ifdef SCTP_DEBUG
3108                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3109                                 kprintf("Got parameter type %x - unknown\n",
3110                                        (u_int)ptype);
3111                         }
3112 #endif
3113                         if ((ptype & 0x4000) == 0x4000) {
3114                                 /* Report bit is set?? */
3115 #ifdef SCTP_DEBUG
3116                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3117                                         kprintf("Report bit is set\n");
3118                                 }
3119 #endif
3120                                 if (op_err == NULL) {
3121                                         /* Ok need to try to get an mbuf */
3122                                         MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3123                                         if (op_err) {
3124                                                 op_err->m_len = 0;
3125                                                 op_err->m_pkthdr.len = 0;
3126                                                 op_err->m_data += sizeof(struct ip6_hdr);
3127                                                 op_err->m_data += sizeof(struct sctphdr);
3128                                                 op_err->m_data += sizeof(struct sctp_chunkhdr);
3129                                         }
3130                                 }
3131                                 if (op_err) {
3132                                         /* If we have space */
3133                                         struct sctp_paramhdr s;
3134                                         if (err_at % 4) {
3135                                                 u_int32_t cpthis=0;
3136                                                 pad_needed = 4 - (err_at % 4);
3137                                                 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3138                                                 err_at += pad_needed;
3139                                         }
3140                                         s.param_type = htons(SCTP_UNRECOG_PARAM);
3141                                         s.param_length = htons(sizeof(s) + plen);
3142                                         m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3143                                         err_at += sizeof(s);
3144                                         if (plen > sizeof(tempbuf)) {
3145                                                 plen = sizeof(tempbuf);
3146                                         }
3147                                         phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3148                                         if (phdr == NULL) {
3149                                                 sctp_m_freem(op_err);
3150                                                 /* we are out of memory but we
3151                                                  * still need to have a look at what to
3152                                                  * do (the system is in trouble though).
3153                                                  */
3154                                                 goto more_processing;
3155                                         }
3156                                         m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3157                                         err_at += plen;
3158                                 }
3159                         }
3160                 more_processing:
3161                         if ((ptype & 0x8000) == 0x0000) {
3162 #ifdef SCTP_DEBUG
3163                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3164                                         kprintf("Abort bit is now setting1\n");
3165                                 }
3166 #endif
3167                                 return (op_err);
3168                         } else {
3169                                 /* skip this chunk and continue processing */
3170                                 at += SCTP_SIZE32(plen);
3171                         }
3172
3173                 }
3174                 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3175         }
3176         return (op_err);
3177 }
3178
3179 static int
3180 sctp_are_there_new_addresses(struct sctp_association *asoc,
3181     struct mbuf *in_initpkt, int iphlen, int offset)
3182 {
3183         /*
3184          * Given a INIT packet, look through the packet to verify that
3185          * there are NO new addresses. As we go through the parameters
3186          * add reports of any un-understood parameters that require an
3187          * error.  Also we must return (1) to drop the packet if we see
3188          * a un-understood parameter that tells us to drop the chunk.
3189          */
3190         struct sockaddr_in sin4, *sa4;
3191         struct sockaddr_in6 sin6, *sa6;
3192         struct sockaddr *sa_touse;
3193         struct sockaddr *sa;
3194         struct sctp_paramhdr *phdr, params;
3195         struct ip *iph;
3196         struct mbuf *mat;
3197         uint16_t ptype, plen;
3198         int err_at;
3199         uint8_t fnd;
3200         struct sctp_nets *net;
3201
3202         memset(&sin4, 0, sizeof(sin4));
3203         memset(&sin6, 0, sizeof(sin6));
3204         sin4.sin_family = AF_INET;
3205         sin4.sin_len = sizeof(sin4);
3206         sin6.sin6_family = AF_INET6;
3207         sin6.sin6_len = sizeof(sin6);
3208
3209         sa_touse = NULL;
3210         /* First what about the src address of the pkt ? */
3211         iph = mtod(in_initpkt, struct ip *);
3212         if (iph->ip_v == IPVERSION) {
3213                 /* source addr is IPv4 */
3214                 sin4.sin_addr = iph->ip_src;
3215                 sa_touse = (struct sockaddr *)&sin4;
3216         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3217                 /* source addr is IPv6 */
3218                 struct ip6_hdr *ip6h;
3219                 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3220                 sin6.sin6_addr = ip6h->ip6_src;
3221                 sa_touse = (struct sockaddr *)&sin6;
3222         } else {
3223                 return (1);
3224         }
3225
3226         fnd = 0;
3227         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3228                 sa = (struct sockaddr *)&net->ro._l_addr;
3229                 if (sa->sa_family == sa_touse->sa_family) {
3230                         if (sa->sa_family == AF_INET) {
3231                             sa4 = (struct sockaddr_in *)sa;
3232                                 if (sa4->sin_addr.s_addr ==
3233                                     sin4.sin_addr.s_addr) {
3234                                         fnd = 1;
3235                                         break;
3236                                 }
3237                         } else if (sa->sa_family == AF_INET6) {
3238                                 sa6 = (struct sockaddr_in6 *)sa;
3239                                 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3240                                     &sin6.sin6_addr)) {
3241                                         fnd = 1;
3242                                         break;
3243                                 }
3244                         }
3245                 }
3246         }
3247         if (fnd == 0) {
3248                 /* New address added! no need to look futher. */
3249                 return (1);
3250         }
3251         /* Ok so far lets munge through the rest of the packet */
3252         mat = in_initpkt;
3253         err_at = 0;
3254         sa_touse = NULL;
3255         offset += sizeof(struct sctp_init_chunk);
3256         phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3257         while (phdr) {
3258                 ptype = ntohs(phdr->param_type);
3259                 plen = ntohs(phdr->param_length);
3260                 if (ptype == SCTP_IPV4_ADDRESS) {
3261                         struct sctp_ipv4addr_param *p4, p4_buf;
3262
3263                         phdr = sctp_get_next_param(mat, offset,
3264                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3265                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
3266                             phdr == NULL) {
3267                                 return (1);
3268                         }
3269                         p4 = (struct sctp_ipv4addr_param *)phdr;
3270                         sin4.sin_addr.s_addr = p4->addr;
3271                         sa_touse = (struct sockaddr *)&sin4;
3272                 } else if (ptype == SCTP_IPV6_ADDRESS) {
3273                         struct sctp_ipv6addr_param *p6, p6_buf;
3274
3275                         phdr = sctp_get_next_param(mat, offset,
3276                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3277                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
3278                             phdr == NULL) {
3279                                 return (1);
3280                         }
3281                         p6 = (struct sctp_ipv6addr_param *)phdr;
3282                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3283                             sizeof(p6->addr));
3284                         sa_touse = (struct sockaddr *)&sin4;
3285                 }
3286
3287                 if (sa_touse) {
3288                         /* ok, sa_touse points to one to check */
3289                         fnd = 0;
3290                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3291                                 sa = (struct sockaddr *)&net->ro._l_addr;
3292                                 if (sa->sa_family != sa_touse->sa_family) {
3293                                         continue;
3294                                 }
3295                                 if (sa->sa_family == AF_INET) {
3296                                         sa4 = (struct sockaddr_in *)sa;
3297                                         if (sa4->sin_addr.s_addr ==
3298                                             sin4.sin_addr.s_addr) {
3299                                                 fnd = 1;
3300                                                 break;
3301                                         }
3302                                 } else if (sa->sa_family == AF_INET6) {
3303                                         sa6 = (struct sockaddr_in6 *)sa;
3304                                         if (SCTP6_ARE_ADDR_EQUAL(
3305                                             &sa6->sin6_addr, &sin6.sin6_addr)) {
3306                                                 fnd = 1;
3307                                                 break;
3308                                         }
3309                                 }
3310                         }
3311                         if (!fnd) {
3312                                 /* New addr added! no need to look further */
3313                                 return (1);
3314                         }
3315                 }
3316                 offset += SCTP_SIZE32(plen);
3317                 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3318         }
3319         return (0);
3320 }
3321
3322 /*
3323  * Given a MBUF chain that was sent into us containing an
3324  * INIT. Build a INIT-ACK with COOKIE and send back.
3325  * We assume that the in_initpkt has done a pullup to
3326  * include IPv6/4header, SCTP header and initial part of
3327  * INIT message (i.e. the struct sctp_init_msg).
3328  */
3329 void
3330 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3331     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3332     struct sctp_init_chunk *init_chk)
3333 {
3334         struct sctp_association *asoc;
3335         struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3336         struct sctp_init_msg *initackm_out;
3337         struct sctp_ecn_supported_param *ecn;
3338         struct sctp_prsctp_supported_param *prsctp;
3339         struct sctp_ecn_nonce_supported_param *ecn_nonce;
3340         struct sctp_supported_chunk_types_param *pr_supported;
3341         struct sockaddr_storage store;
3342         struct sockaddr_in *sin;
3343         struct sockaddr_in6 *sin6;
3344         struct route *ro;
3345         struct ip *iph;
3346         struct ip6_hdr *ip6;
3347         struct sockaddr *to;
3348         struct sctp_state_cookie stc;
3349         struct sctp_nets *net=NULL;
3350         int cnt_inits_to=0;
3351         uint16_t his_limit, i_want;
3352         int abort_flag, padval, sz_of;
3353
3354         if (stcb) {
3355                 asoc = &stcb->asoc;
3356         } else {
3357                 asoc = NULL;
3358         }
3359         m_last = NULL;
3360         if ((asoc != NULL) &&
3361             (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3362             (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3363                 /* new addresses, out of here in non-cookie-wait states */
3364                 /*
3365                  * Send a ABORT, we don't add the new address error clause though
3366                  * we even set the T bit and copy in the 0 tag.. this looks no
3367                  * different than if no listner was present.
3368                  */
3369                 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3370                 return;
3371         }
3372         abort_flag = 0;
3373         op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3374             (offset+sizeof(struct sctp_init_chunk)),
3375             &abort_flag, (struct sctp_chunkhdr *)init_chk);
3376         if (abort_flag) {
3377                 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3378                 return;
3379         }
3380         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3381         if (m == NULL) {
3382                 /* No memory, INIT timer will re-attempt. */
3383                 if (op_err)
3384                         sctp_m_freem(op_err);
3385                 return;
3386         }
3387         MCLGET(m, MB_DONTWAIT);
3388         if ((m->m_flags & M_EXT) != M_EXT) {
3389                 /* Failed to get cluster buffer */
3390                 if (op_err)
3391                         sctp_m_freem(op_err);
3392                 sctp_m_freem(m);
3393                 return;
3394         }
3395         m->m_data += SCTP_MIN_OVERHEAD;
3396         m->m_pkthdr.rcvif = 0;
3397         m->m_len = sizeof(struct sctp_init_msg);
3398
3399         /* the time I built cookie */
3400         SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3401
3402         /* populate any tie tags */
3403         if (asoc != NULL) {
3404                 /* unlock before tag selections */
3405                 SCTP_TCB_UNLOCK(stcb);
3406                 if (asoc->my_vtag_nonce == 0)
3407                         asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3408                 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3409
3410                 if (asoc->peer_vtag_nonce == 0)
3411                         asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3412                 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3413
3414                 stc.cookie_life = asoc->cookie_life;
3415                 net = asoc->primary_destination;
3416                 /* now we must relock */
3417                 SCTP_INP_RLOCK(inp);
3418                 /* we may be in trouble here if the inp got freed
3419                  * most likely this set of tests will protect
3420                  * us but there is a chance not.
3421                  */
3422                 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3423                         if (op_err)
3424                                 sctp_m_freem(op_err);
3425                         sctp_m_freem(m);
3426                         sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3427                         return;
3428                 }
3429                 SCTP_TCB_LOCK(stcb);
3430                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3431         } else {
3432                 stc.tie_tag_my_vtag = 0;
3433                 stc.tie_tag_peer_vtag = 0;
3434                 /* life I will award this cookie */
3435                 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3436         }
3437
3438         /* copy in the ports for later check */
3439         stc.myport = sh->dest_port;
3440         stc.peerport = sh->src_port;
3441
3442         /*
3443          * If we wanted to honor cookie life extentions, we would add
3444          * to stc.cookie_life. For now we should NOT honor any extension
3445          */
3446         stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3447         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3448                 struct inpcb *in_inp;
3449                 /* Its a V6 socket */
3450                 in_inp = (struct inpcb *)inp;
3451                 stc.ipv6_addr_legal = 1;
3452                 /* Now look at the binding flag to see if V4 will be legal */
3453                 if (
3454 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
3455                     (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3456 #elif defined(__OpenBSD__)
3457                     (0) /* For openbsd we do dual bind only */
3458 #else
3459                     (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3460 #endif
3461                     == 0) {
3462                         stc.ipv4_addr_legal = 1;
3463                 } else {
3464                         /* V4 addresses are NOT legal on the association */
3465                         stc.ipv4_addr_legal = 0;
3466                 }
3467         } else {
3468                 /* Its a V4 socket, no - V6 */
3469                 stc.ipv4_addr_legal = 1;
3470                 stc.ipv6_addr_legal = 0;
3471         }
3472
3473 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3474         stc.ipv4_scope = 1;
3475 #else
3476         stc.ipv4_scope = 0;
3477 #endif
3478         /* now for scope setup */
3479         memset((caddr_t)&store, 0, sizeof(store));
3480         sin = (struct sockaddr_in *)&store;
3481         sin6 = (struct sockaddr_in6 *)&store;
3482         if (net == NULL) {
3483                 to = (struct sockaddr *)&store;
3484                 iph = mtod(init_pkt, struct ip *);
3485                 if (iph->ip_v == IPVERSION) {
3486                         struct in_addr addr;
3487                         struct route iproute;
3488
3489                         sin->sin_family = AF_INET;
3490                         sin->sin_len = sizeof(struct sockaddr_in);
3491                         sin->sin_port = sh->src_port;
3492                         sin->sin_addr = iph->ip_src;
3493                         /* lookup address */
3494                         stc.address[0] = sin->sin_addr.s_addr;
3495                         stc.address[1] = 0;
3496                         stc.address[2] = 0;
3497                         stc.address[3] = 0;
3498                         stc.addr_type = SCTP_IPV4_ADDRESS;
3499                         /* local from address */
3500                         memset(&iproute, 0, sizeof(iproute));
3501                         ro = &iproute;
3502                         memcpy(&ro->ro_dst, sin, sizeof(*sin));
3503                         addr = sctp_ipv4_source_address_selection(inp, NULL,
3504                             ro, NULL, 0);
3505                         if (ro->ro_rt) {
3506                                 RTFREE(ro->ro_rt);
3507                         }
3508                         stc.laddress[0] = addr.s_addr;
3509                         stc.laddress[1] = 0;
3510                         stc.laddress[2] = 0;
3511                         stc.laddress[3] = 0;
3512                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3513                         /* scope_id is only for v6 */
3514                         stc.scope_id = 0;
3515 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3516                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3517                                 stc.ipv4_scope = 1;
3518                         }
3519 #else
3520                         stc.ipv4_scope = 1;
3521 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3522                         /* Must use the address in this case */
3523                         if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3524                                 stc.loopback_scope = 1;
3525                                 stc.ipv4_scope = 1;
3526                                 stc.site_scope = 1;
3527                                 stc.local_scope = 1;
3528                         }
3529                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3530                         struct in6_addr addr;
3531 #ifdef NEW_STRUCT_ROUTE
3532                         struct route iproute6;
3533 #else
3534                         struct route_in6 iproute6;
3535 #endif
3536                         ip6 = mtod(init_pkt, struct ip6_hdr *);
3537                         sin6->sin6_family = AF_INET6;
3538                         sin6->sin6_len = sizeof(struct sockaddr_in6);
3539                         sin6->sin6_port = sh->src_port;
3540                         sin6->sin6_addr = ip6->ip6_src;
3541                         /* lookup address */
3542                         memcpy(&stc.address, &sin6->sin6_addr,
3543                             sizeof(struct in6_addr));
3544                         sin6->sin6_scope_id = 0;
3545                         stc.addr_type = SCTP_IPV6_ADDRESS;
3546                         stc.scope_id = 0;
3547                         if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3548                                 stc.loopback_scope = 1;
3549                                 stc.local_scope = 1;
3550                                 stc.site_scope = 1;
3551                                 stc.ipv4_scope = 1;
3552                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3553                                 /*
3554                                  * If the new destination is a LINK_LOCAL
3555                                  * we must have common both site and local
3556                                  * scope. Don't set local scope though since
3557                                  * we must depend on the source to be added
3558                                  * implicitly. We cannot assure just because
3559                                  * we share one link that all links are common.
3560                                  */
3561                                 stc.local_scope = 0;
3562                                 stc.site_scope = 1;
3563                                 stc.ipv4_scope = 1;
3564                                 /* we start counting for the private
3565                                  * address stuff at 1. since the link
3566                                  * local we source from won't show
3567                                  * up in our scoped cou8nt.
3568                                  */
3569                                 cnt_inits_to=1;
3570                                 /* pull out the scope_id from incoming pkt */
3571                                 in6_recoverscope(sin6, &ip6->ip6_src,
3572                                     init_pkt->m_pkthdr.rcvif);
3573 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
3574                                 in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3575                                     NULL);
3576 #else
3577                                 in6_embedscope(&sin6->sin6_addr, sin6);
3578 #endif
3579                                 stc.scope_id = sin6->sin6_scope_id;
3580                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3581                                 /*
3582                                  * If the new destination is SITE_LOCAL
3583                                  * then we must have site scope in common.
3584                                  */
3585                                 stc.site_scope = 1;
3586                         }
3587                         /* local from address */
3588                         memset(&iproute6, 0, sizeof(iproute6));
3589                         ro = (struct route *)&iproute6;
3590                         memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
3591                         addr = sctp_ipv6_source_address_selection(inp, NULL,
3592                             ro, NULL, 0);
3593                         if (ro->ro_rt) {
3594                                 RTFREE(ro->ro_rt);
3595                         }
3596                         memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3597                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3598                 }
3599         } else {
3600                 /* set the scope per the existing tcb */
3601                 struct sctp_nets *lnet;
3602
3603                 stc.loopback_scope = asoc->loopback_scope;
3604                 stc.ipv4_scope = asoc->ipv4_local_scope;
3605                 stc.site_scope = asoc->site_scope;
3606                 stc.local_scope = asoc->local_scope;
3607                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3608                         if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
3609                                 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
3610                                         /* if we have a LL address, start counting
3611                                          * at 1.
3612                                          */
3613                                         cnt_inits_to = 1;
3614                                 }
3615                         }
3616                 }
3617
3618                 /* use the net pointer */
3619                 to = (struct sockaddr *)&net->ro._l_addr;
3620                 if (to->sa_family == AF_INET) {
3621                         sin = (struct sockaddr_in *)to;
3622                         stc.address[0] = sin->sin_addr.s_addr;
3623                         stc.address[1] = 0;
3624                         stc.address[2] = 0;
3625                         stc.address[3] = 0;
3626                         stc.addr_type = SCTP_IPV4_ADDRESS;
3627                         if (net->src_addr_selected == 0) {
3628                                 /* strange case here, the INIT
3629                                  * should have did the selection.
3630                                  */
3631                                 net->ro._s_addr.sin.sin_addr =
3632                                     sctp_ipv4_source_address_selection(inp,
3633                                     stcb, (struct route *)&net->ro, net, 0);
3634                                 net->src_addr_selected = 1;
3635
3636                         }
3637
3638                         stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr;
3639                         stc.laddress[1] = 0;
3640                         stc.laddress[2] = 0;
3641                         stc.laddress[3] = 0;
3642                         stc.laddr_type = SCTP_IPV4_ADDRESS;
3643                 } else if (to->sa_family == AF_INET6) {
3644                         sin6 = (struct sockaddr_in6 *)to;
3645                         memcpy(&stc.address, &sin6->sin6_addr,
3646                             sizeof(struct in6_addr));
3647                         stc.addr_type = SCTP_IPV6_ADDRESS;
3648                         if (net->src_addr_selected == 0) {
3649                                 /* strange case here, the INIT
3650                                  * should have did the selection.
3651                                  */
3652                                 net->ro._s_addr.sin6.sin6_addr =
3653                                     sctp_ipv6_source_address_selection(inp,
3654                                     stcb, (struct route *)&net->ro, net, 0);
3655                                 net->src_addr_selected = 1;
3656                         }
3657                         memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr,
3658                             sizeof(struct in6_addr));
3659                         stc.laddr_type = SCTP_IPV6_ADDRESS;
3660                 }
3661         }
3662         /* Now lets put the SCTP header in place */
3663         initackm_out = mtod(m, struct sctp_init_msg *);
3664         initackm_out->sh.src_port = inp->sctp_lport;
3665         initackm_out->sh.dest_port = sh->src_port;
3666         initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3667         /* Save it off for quick ref */
3668         stc.peers_vtag = init_chk->init.initiate_tag;
3669         initackm_out->sh.checksum = 0;  /* calculate later */
3670         /* who are we */
3671         strncpy(stc.identification, SCTP_VERSION_STRING,
3672            min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3673         /* now the chunk header */
3674         initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3675         initackm_out->msg.ch.chunk_flags = 0;
3676         /* fill in later from mbuf we build */
3677         initackm_out->msg.ch.chunk_length = 0;
3678         /* place in my tag */
3679         if ((asoc != NULL) &&
3680             ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3681              (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3682                 /* re-use the v-tags and init-seq here */
3683                 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3684                 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3685         } else {
3686                 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3687                 /* get a TSN to use too */
3688                 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3689         }
3690         /* save away my tag to */
3691         stc.my_vtag = initackm_out->msg.init.initiate_tag;
3692
3693         /* set up some of the credits. */
3694         initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND));
3695         /* set what I want */
3696         his_limit = ntohs(init_chk->init.num_inbound_streams);
3697         /* choose what I want */
3698         if (asoc != NULL) {
3699                 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3700                         i_want = asoc->streamoutcnt;
3701                 } else {
3702                         i_want = inp->sctp_ep.pre_open_stream_count;
3703                 }
3704         } else {
3705                 i_want = inp->sctp_ep.pre_open_stream_count;
3706         }
3707         if (his_limit < i_want) {
3708                 /* I Want more :< */
3709                 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3710         } else {
3711                 /* I can have what I want :> */
3712                 initackm_out->msg.init.num_outbound_streams = htons(i_want);
3713         }
3714         /* tell him his limt. */
3715         initackm_out->msg.init.num_inbound_streams =
3716             htons(inp->sctp_ep.max_open_streams_intome);
3717         /* setup the ECN pointer */
3718
3719 /*      if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3720         if (inp->sctp_ep.adaption_layer_indicator) {
3721                 struct sctp_adaption_layer_indication *ali;
3722                 ali = (struct sctp_adaption_layer_indication *)(
3723                     (caddr_t)initackm_out + sizeof(*initackm_out));
3724                 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3725                 ali->ph.param_length = htons(sizeof(*ali));
3726                 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3727                 m->m_len += sizeof(*ali);
3728                 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3729                     sizeof(*ali));
3730         } else {
3731                 ecn = (struct sctp_ecn_supported_param*)(
3732                     (caddr_t)initackm_out + sizeof(*initackm_out));
3733         }
3734
3735         /* ECN parameter */
3736         if (sctp_ecn == 1) {
3737                 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3738                 ecn->ph.param_length = htons(sizeof(*ecn));
3739                 m->m_len += sizeof(*ecn);
3740
3741                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
3742                     sizeof(*ecn));
3743         } else {
3744                 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
3745         }
3746         /* And now tell the peer we do  pr-sctp */
3747         prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3748         prsctp->ph.param_length = htons(sizeof(*prsctp));
3749         m->m_len += sizeof(*prsctp);
3750
3751
3752         /* And now tell the peer we do all the extensions */
3753         pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
3754            sizeof(*prsctp));
3755
3756         pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3757         pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3758         pr_supported->chunk_types[0] = SCTP_ASCONF;
3759         pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3760         pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3761         pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3762         pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3763         pr_supported->chunk_types[5] = 0; /* pad */
3764         pr_supported->chunk_types[6] = 0; /* pad */
3765         pr_supported->chunk_types[7] = 0; /* pad */
3766
3767         m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3768         if (sctp_ecn_nonce) {
3769                 /* ECN nonce: And now tell the peer we support ECN nonce */
3770                 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
3771                      sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3772                 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3773                 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3774                 m->m_len += sizeof(*ecn_nonce);
3775         }
3776
3777         m_at = m;
3778         /* now the addresses */
3779         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3780                 struct ifnet *ifn;
3781                 struct ifaddr *ifa;
3782                 int cnt = cnt_inits_to;
3783
3784                 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3785                         if ((stc.loopback_scope == 0) &&
3786                             (ifn->if_type == IFT_LOOP)) {
3787                                 /*
3788                                  * Skip loopback devices if loopback_scope
3789                                  * not set
3790                                  */
3791                                 continue;
3792                         }
3793                         TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
3794                                 if (sctp_is_address_in_scope(ifa,
3795                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3796                                     stc.loopback_scope, stc.ipv4_scope,
3797                                     stc.local_scope, stc.site_scope) == 0) {
3798                                         continue;
3799                                 }
3800                                 cnt++;
3801                         }
3802                 }
3803                 if (cnt > 1) {
3804                         TAILQ_FOREACH(ifn, &ifnet, if_list) {
3805                                 if ((stc.loopback_scope == 0) &&
3806                                     (ifn->if_type == IFT_LOOP)) {
3807                                         /*
3808                                          * Skip loopback devices if
3809                                          * loopback_scope not set
3810                                          */
3811                                         continue;
3812                                 }
3813                                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
3814                                         if (sctp_is_address_in_scope(ifa,
3815                                             stc.ipv4_addr_legal,
3816                                             stc.ipv6_addr_legal,
3817                                             stc.loopback_scope, stc.ipv4_scope,
3818                                             stc.local_scope, stc.site_scope) == 0) {
3819                                                 continue;
3820                                         }
3821                                         m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3822                                 }
3823                         }
3824                 }
3825         } else {
3826                 struct sctp_laddr *laddr;
3827                 int cnt;
3828                 cnt = cnt_inits_to;
3829                 /* First, how many ? */
3830                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3831                         if (laddr->ifa == NULL) {
3832                                 continue;
3833                         }
3834                         if (laddr->ifa->ifa_addr == NULL)
3835                                 continue;
3836                         if (sctp_is_address_in_scope(laddr->ifa,
3837                             stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3838                             stc.loopback_scope, stc.ipv4_scope,
3839                             stc.local_scope, stc.site_scope) == 0) {
3840                                 continue;
3841                         }
3842                         cnt++;
3843                 }
3844                 /* If we bind a single address only we won't list
3845                  * any. This way you can get through a NAT
3846                  */
3847                 if (cnt > 1) {
3848                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3849                                 if (laddr->ifa == NULL) {
3850 #ifdef SCTP_DEBUG
3851                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3852                                                 kprintf("Help I have fallen and I can't get up!\n");
3853                                         }
3854 #endif
3855                                         continue;
3856                                 }
3857                                 if (laddr->ifa->ifa_addr == NULL)
3858                                         continue;
3859                                 if (sctp_is_address_in_scope(laddr->ifa,
3860                                     stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3861                                     stc.loopback_scope, stc.ipv4_scope,
3862                                     stc.local_scope, stc.site_scope) == 0) {
3863                                         continue;
3864                                 }
3865                                 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3866                         }
3867                 }
3868         }
3869
3870         /* tack on the operational error if present */
3871         if (op_err) {
3872                 if (op_err->m_pkthdr.len % 4) {
3873                         /* must add a pad to the param */
3874                         u_int32_t cpthis=0;
3875                         int padlen;
3876                         padlen = 4 - (op_err->m_pkthdr.len % 4);
3877                         m_copyback(op_err, op_err->m_pkthdr.len, padlen, (caddr_t)&cpthis);
3878                 }
3879                 while (m_at->m_next != NULL) {
3880                         m_at = m_at->m_next;
3881                 }
3882                 m_at->m_next = op_err;
3883                 while (m_at->m_next != NULL) {
3884                         m_at = m_at->m_next;
3885                 }
3886         }
3887         /* Get total size of init packet */
3888         sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3889         /* pre-calulate the size and update pkt header and chunk header */
3890         m->m_pkthdr.len = 0;
3891         for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3892                 m->m_pkthdr.len += m_tmp->m_len;
3893                 if (m_tmp->m_next == NULL) {
3894                         /* m_tmp should now point to last one */
3895                         break;
3896                 }
3897         }
3898         /*
3899          * Figure now the size of the cookie. We know the size of the
3900          * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3901          * COOKIE-STRUCTURE and SIGNATURE.
3902          */
3903
3904         /*
3905          * take our earlier INIT calc and add in the sz we just calculated
3906          * minus the size of the sctphdr (its not included in chunk size
3907          */
3908
3909         /* add once for the INIT-ACK */
3910         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3911
3912         /* add a second time for the INIT-ACK in the cookie */
3913         sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3914
3915         /* Now add the cookie header and cookie message struct */
3916         sz_of += sizeof(struct sctp_state_cookie_param);
3917         /* ...and add the size of our signature */
3918         sz_of += SCTP_SIGNATURE_SIZE;
3919         initackm_out->msg.ch.chunk_length = htons(sz_of);
3920
3921         /* Now we must build a cookie */
3922         m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3923             sizeof(struct sctphdr), &stc);
3924         if (m_cookie == NULL) {
3925                 /* memory problem */
3926                 sctp_m_freem(m);
3927                 return;
3928         }
3929         /* Now append the cookie to the end and update the space/size */
3930         m_tmp->m_next = m_cookie;
3931
3932         /*
3933          * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3934          * return here since the timer will drive a retranmission.
3935          */
3936         padval = m->m_pkthdr.len % 4;
3937         if ((padval) && (m_last)) {
3938                 /* see my previous comments on m_last */
3939                 int ret;
3940                 ret = sctp_add_pad_tombuf(m_last, (4-padval));
3941                 if (ret) {
3942                         /* Houston we have a problem, no space */
3943                         sctp_m_freem(m);
3944                         return;
3945                 }
3946                 m->m_pkthdr.len += padval;
3947         }
3948         sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
3949 }
3950
3951
3952 static void
3953 sctp_insert_on_wheel(struct sctp_association *asoc,
3954                      struct sctp_stream_out *strq)
3955 {
3956         struct sctp_stream_out *stre, *strn;
3957         stre = TAILQ_FIRST(&asoc->out_wheel);
3958         if (stre == NULL) {
3959                 /* only one on wheel */
3960                 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
3961                 return;
3962         }
3963         for (; stre; stre = strn) {
3964                 strn = TAILQ_NEXT(stre, next_spoke);
3965                 if (stre->stream_no > strq->stream_no) {
3966                         TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
3967                         return;
3968                 } else if (stre->stream_no == strq->stream_no) {
3969                         /* huh, should not happen */
3970                         return;
3971                 } else if (strn == NULL) {
3972                         /* next one is null */
3973                         TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
3974                                            next_spoke);
3975                 }
3976         }
3977 }
3978
3979 static void
3980 sctp_remove_from_wheel(struct sctp_association *asoc,
3981                        struct sctp_stream_out *strq)
3982 {
3983         /* take off and then setup so we know it is not on the wheel */
3984         TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
3985         strq->next_spoke.tqe_next = NULL;
3986         strq->next_spoke.tqe_prev = NULL;
3987 }
3988
3989
3990 static void
3991 sctp_prune_prsctp(struct sctp_tcb *stcb,
3992                   struct sctp_association *asoc,
3993                   struct sctp_sndrcvinfo *srcv,
3994                   int dataout
3995         )
3996 {
3997         int freed_spc=0;
3998         struct sctp_tmit_chunk *chk, *nchk;
3999         if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
4000                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4001                         /*
4002                          * Look for chunks marked with the PR_SCTP
4003                          * flag AND the buffer space flag. If the one
4004                          * being sent is equal or greater priority then
4005                          * purge the old one and free some space.
4006                          */
4007                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4008                                            SCTP_PR_SCTP_BUFFER)) ==
4009                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4010                                 /*
4011                                  * This one is PR-SCTP AND buffer space
4012                                  * limited type
4013                                  */
4014                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4015                                         /* Lower numbers equates to
4016                                          * higher priority so if the
4017                                          * one we are looking at has a
4018                                          * larger or equal priority we
4019                                          * want to drop the data and
4020                                          * NOT retransmit it.
4021                                          */
4022                                         if (chk->data) {
4023                                                 /* We release the
4024                                                  * book_size if the
4025                                                  * mbuf is here
4026                                                  */
4027                                                 int ret_spc;
4028                                                 int cause;
4029                                                 if (chk->sent > SCTP_DATAGRAM_UNSENT)
4030                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
4031                                                 else
4032                                                         cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
4033                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4034                                                                                       cause,
4035                                                                                       &asoc->sent_queue);
4036                                                 freed_spc += ret_spc;
4037                                                 if (freed_spc >= dataout) {
4038                                                         return;
4039                                                 }
4040                                         } /* if chunk was present */
4041                                 } /* if of sufficent priority */
4042                         } /* if chunk has enabled */
4043                 } /* tailqforeach */
4044
4045                 chk = TAILQ_FIRST(&asoc->send_queue);
4046                 while (chk) {
4047                         nchk = TAILQ_NEXT(chk, sctp_next);
4048                         /* Here we must move to the sent queue and mark */
4049                         if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4050                                            SCTP_PR_SCTP_BUFFER)) ==
4051                             (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4052                                 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4053                                         if (chk->data) {
4054                                                 /* We release the
4055                                                  * book_size if the
4056                                                  * mbuf is here
4057                                                  */
4058                                                 int ret_spc;
4059                                                 ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
4060                                                     SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
4061                                                     &asoc->send_queue);
4062
4063                                                 freed_spc += ret_spc;
4064                                                 if (freed_spc >= dataout) {
4065                                                         return;
4066                                                 }
4067                                         } /* end if chk->data */
4068                                 } /* end if right class */
4069                         } /* end if chk pr-sctp */
4070                         chk = nchk;
4071                 } /* end while (chk) */
4072         } /* if enabled in asoc */
4073 }
4074
4075 static void
4076 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4077                    struct sctp_tcb *stcb,
4078                    struct sctp_sndrcvinfo *srcv,
4079                    struct sctp_stream_out *strq,
4080                    struct sctp_nets *net)
4081 {
4082         bzero(template, sizeof(struct sctp_tmit_chunk));
4083         template->sent = SCTP_DATAGRAM_UNSENT;
4084         if ((stcb->asoc.peer_supports_prsctp) &&
4085             (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4086             (srcv->sinfo_timetolive > 0)
4087                 ) {
4088                 /* If:
4089                  *  Peer supports PR-SCTP
4090                  *  The flags is set against this send for PR-SCTP
4091                  *  And timetolive is a postive value, zero is reserved
4092                  *     to mean a reliable send for both buffer/time
4093                  *     related one.
4094                  */
4095                 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4096                         /*
4097                          * Time to live is a priority stored in tv_sec
4098                          * when doing the buffer drop thing.
4099                          */
4100                         template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4101                 } else {
4102                         struct timeval tv;
4103
4104                         SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4105                         tv.tv_sec = srcv->sinfo_timetolive / 1000;
4106                         tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4107 #ifndef __FreeBSD__
4108                         timeradd(&template->rec.data.timetodrop, &tv,
4109                             &template->rec.data.timetodrop);
4110 #else
4111                         timevaladd(&template->rec.data.timetodrop, &tv);
4112 #endif
4113                 }
4114         }
4115         if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4116                 template->rec.data.stream_seq = strq->next_sequence_sent;
4117         } else {
4118                 template->rec.data.stream_seq = 0;
4119         }
4120         template->rec.data.TSN_seq = 0; /* not yet assigned */
4121
4122         template->rec.data.stream_number = srcv->sinfo_stream;
4123         template->rec.data.payloadtype = srcv->sinfo_ppid;
4124         template->rec.data.context = srcv->sinfo_context;
4125         template->rec.data.doing_fast_retransmit = 0;
4126         template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4127
4128         if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4129                 template->whoTo = net;
4130         } else {
4131                 if (stcb->asoc.primary_destination)
4132                         template->whoTo = stcb->asoc.primary_destination;
4133                 else {
4134                         /* TSNH */
4135                         template->whoTo = net;
4136                 }
4137         }
4138         /* the actual chunk flags */
4139         if (srcv->sinfo_flags & MSG_UNORDERED) {
4140                 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4141         } else {
4142                 template->rec.data.rcv_flags = 0;
4143         }
4144         /* no flags yet, FRAGMENT_OK goes here */
4145         template->flags = 0;
4146         /* PR sctp flags */
4147         if (stcb->asoc.peer_supports_prsctp) {
4148                 if (srcv->sinfo_timetolive > 0) {
4149                         /*
4150                          * We only set the flag if timetolive (or
4151                          * priority) was set to a positive number.
4152                          * Zero is reserved specifically to be
4153                          * EXCLUDED and sent reliable.
4154                          */
4155                         if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4156                                 template->flags |= SCTP_PR_SCTP_ENABLED;
4157                         }
4158                         if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4159                                 template->flags |= SCTP_PR_SCTP_BUFFER;
4160                         }
4161                 }
4162         }
4163         template->asoc = &stcb->asoc;
4164 }
4165
4166
4167 int
4168 sctp_get_frag_point(struct sctp_tcb *stcb,
4169                     struct sctp_association *asoc)
4170 {
4171         int siz, ovh;
4172
4173         /* For endpoints that have both 6 and 4 addresses
4174          * we must reserver room for the 6 ip header, for
4175          * those that are only dealing with V4 we use
4176          * a larger frag point.
4177          */
4178         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4179                 ovh = SCTP_MED_OVERHEAD;
4180         } else {
4181                 ovh = SCTP_MED_V4_OVERHEAD;
4182         }
4183
4184         if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4185                 siz = asoc->smallest_mtu - ovh;
4186         else
4187                 siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4188 /*
4189   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4190                 /* A data chunk MUST fit in a cluster */
4191 /*              siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4192 /*      }*/
4193
4194         if (siz % 4) {
4195                 /* make it an even word boundary please */
4196                 siz -= (siz % 4);
4197         }
4198         return (siz);
4199 }
4200 extern unsigned int sctp_max_chunks_on_queue;
4201
4202 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4203
4204 static int
4205 sctp_msg_append(struct sctp_tcb *stcb,
4206                 struct sctp_nets *net,
4207                 struct mbuf *m,
4208                 struct sctp_sndrcvinfo *srcv,
4209                 int flags)
4210 {
4211         struct socket *so;
4212         struct sctp_association *asoc;
4213         struct sctp_stream_out *strq;
4214         struct sctp_tmit_chunk *chk;
4215         struct sctpchunk_listhead tmp;
4216         struct sctp_tmit_chunk template;
4217         struct mbuf *n, *mnext;
4218         struct mbuf *mm;
4219         unsigned int dataout, siz;
4220         int mbcnt = 0;
4221         int mbcnt_e = 0;
4222         int error = 0;
4223
4224         if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4225                 /* Software fault, you blew it on the call */
4226 #ifdef SCTP_DEBUG
4227                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4228                         kprintf("software error in sctp_msg_append:1\n");
4229                         kprintf("stcb:%p net:%p m:%p srcv:%p\n",
4230                                stcb, net, m, srcv);
4231                 }
4232 #endif
4233                 if (m)
4234                         sctp_m_freem(m);
4235                 return (EFAULT);
4236         }
4237         so = stcb->sctp_socket;
4238         asoc = &stcb->asoc;
4239         if (srcv->sinfo_flags & MSG_ABORT) {
4240                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4241                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4242                         /* It has to be up before we abort */
4243                         /* how big is the user initiated abort? */
4244                         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4245                                 dataout = m->m_pkthdr.len;
4246                         } else {
4247                                 /* we must count */
4248                                 dataout = 0;
4249                                 for (n = m; n; n = n->m_next) {
4250                                         dataout += n->m_len;
4251                                 }
4252                         }
4253                         M_PREPEND(m, sizeof(struct sctp_paramhdr), MB_DONTWAIT);
4254                         if (m) {
4255                                 struct sctp_paramhdr *ph;
4256                                 m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4257                                 ph = mtod(m, struct sctp_paramhdr *);
4258                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4259                                 ph->param_length = htons(m->m_len);
4260                         }
4261                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4262                         m = NULL;
4263                 } else {
4264                         /* Only free if we don't send an abort */
4265                         ;
4266                 }
4267                 goto out;
4268         }
4269         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4270             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4271             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4272             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4273                 /* got data while shutting down */
4274                 error = ECONNRESET;
4275                 goto out;
4276         }
4277
4278         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4279                 /* Invalid stream number */
4280                 error = EINVAL;
4281                 goto out;
4282         }
4283         if (asoc->strmout == NULL) {
4284                 /* huh? software error */
4285 #ifdef SCTP_DEBUG
4286                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4287                         kprintf("software error in sctp_msg_append:2\n");
4288                 }
4289 #endif
4290                 error = EFAULT;
4291                 goto out;
4292         }
4293         strq = &asoc->strmout[srcv->sinfo_stream];
4294         /* how big is it ? */
4295         if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4296                 dataout = m->m_pkthdr.len;
4297         } else {
4298                 /* we must count */
4299                 dataout = 0;
4300                 for (n = m; n; n = n->m_next) {
4301                         dataout += n->m_len;
4302                 }
4303         }
4304 #ifdef SCTP_DEBUG
4305         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4306                 kprintf("Attempt to send out %d bytes\n",
4307                        dataout);
4308         }
4309 #endif
4310
4311         /* lock the socket buf */
4312         SOCKBUF_LOCK(&so->so_snd);
4313         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
4314         if (error)
4315                 goto out_locked;
4316
4317         if (dataout > so->so_snd.ssb_hiwat) {
4318                 /* It will NEVER fit */
4319                 error = EMSGSIZE;
4320                 goto release;
4321         }
4322         if ((srcv->sinfo_flags & MSG_EOF) &&
4323             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4324             (dataout == 0)
4325                 ) {
4326                 goto zap_by_it_all;
4327         }
4328         if ((so->so_snd.ssb_hiwat <
4329              (dataout + asoc->total_output_queue_size)) ||
4330             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4331             (asoc->total_output_mbuf_queue_size >
4332              so->so_snd.ssb_mbmax)
4333                 ) {
4334                 /* XXX Buffer space hunt for data to skip */
4335                 if (asoc->peer_supports_prsctp) {
4336                         sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4337                 }
4338                 while ((so->so_snd.ssb_hiwat <
4339                     (dataout + asoc->total_output_queue_size)) ||
4340                     (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4341                     (asoc->total_output_mbuf_queue_size >
4342                     so->so_snd.ssb_mbmax)) {
4343                         struct sctp_inpcb *inp;
4344                         /* Now did we free up enough room? */
4345                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
4346                                 /* Non-blocking io in place */
4347                                 error = EWOULDBLOCK;
4348                                 goto release;
4349                         }
4350                         /*
4351                          * We store off a pointer to the endpoint.
4352                          * Since on return from this we must check to
4353                          * see if an so_error is set. If so we may have
4354                          * been reset and our stcb destroyed. Returning
4355                          * an error will cause the correct error return
4356                          * through and fix this all.
4357                          */
4358                         inp = stcb->sctp_ep;
4359                         /*
4360                          * Not sure how else to do this since
4361                          * the level we suspended at is not
4362                          * known deep down where we are. I will
4363                          * drop to spl0() so that others can
4364                          * get in.
4365                          */
4366
4367                         inp->sctp_tcb_at_block = (void *)stcb;
4368                         inp->error_on_block = 0;
4369                         ssb_unlock(&so->so_snd);
4370                         error = ssb_wait(&so->so_snd);
4371                         /*
4372                          * XXX: This is ugly but I have
4373                          * recreated most of what goes on to
4374                          * block in the sb. UGHH
4375                          * May want to add the bit about being
4376                          * no longer connected.. but this then
4377                          * further dooms the UDP model NOT to
4378                          * allow this.
4379                          */
4380                         inp->sctp_tcb_at_block = 0;
4381                         if (inp->error_on_block)
4382                                 error = inp->error_on_block;
4383                         if (so->so_error)
4384                                 error = so->so_error;
4385                         if (error) {
4386                                 goto out_locked;
4387                         }
4388                         error = ssb_lock(&so->so_snd, M_WAITOK);
4389                         if (error)
4390                                 goto out_locked;
4391                         /* Otherwise we cycle back and recheck
4392                          * the space
4393                          */
4394 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4395                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4396 #else
4397                         if (so->so_state & SS_CANTSENDMORE) {
4398 #endif
4399                                 error = EPIPE;
4400                                 goto release;
4401                         }
4402                         if (so->so_error) {
4403                                 error = so->so_error;
4404                                 goto release;
4405                         }
4406                 }
4407         }
4408         /* If we have a packet header fix it if it was broke */
4409         if (m->m_flags & M_PKTHDR) {
4410                 m->m_pkthdr.len = dataout;
4411         }
4412         /* use the smallest one, user set value or
4413          * smallest mtu of the asoc
4414          */
4415         siz = sctp_get_frag_point(stcb, asoc);
4416         SOCKBUF_UNLOCK(&so->so_snd);
4417         if ((dataout) && (dataout <= siz)) {
4418                 /* Fast path */
4419                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4420                 if (chk == NULL) {
4421                         error = ENOMEM;
4422                         SOCKBUF_LOCK(&so->so_snd);
4423                         goto release;
4424                 }
4425                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4426                 chk->whoTo->ref_count++;
4427                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4428
4429                 /* no flags yet, FRAGMENT_OK goes here */
4430                 sctppcbinfo.ipi_count_chunk++;
4431                 sctppcbinfo.ipi_gencnt_chunk++;
4432                 asoc->chunks_on_out_queue++;
4433                 chk->data = m;
4434                 m = NULL;
4435                 /* Total in the MSIZE */
4436                 for (mm = chk->data; mm; mm = mm->m_next) {
4437                         mbcnt += MSIZE;
4438                         if (mm->m_flags & M_EXT) {
4439                                 mbcnt += chk->data->m_ext.ext_size;
4440                         }
4441                 }
4442                 /* fix up the send_size if it is not present */
4443                 chk->send_size = dataout;
4444                 chk->book_size = chk->send_size;
4445                 chk->mbcnt = mbcnt;
4446                 /* ok, we are commited */
4447                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4448                         /* bump the ssn if we are unordered. */
4449                         strq->next_sequence_sent++;
4450                 }
4451                 chk->data->m_nextpkt = 0;
4452                 asoc->stream_queue_cnt++;
4453                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4454                 /* now check if this stream is on the wheel */
4455                 if ((strq->next_spoke.tqe_next == NULL) &&
4456                     (strq->next_spoke.tqe_prev == NULL)) {
4457                         /* Insert it on the wheel since it is not
4458                          * on it currently
4459                          */
4460                         sctp_insert_on_wheel(asoc, strq);
4461                 }
4462         } else if ((dataout) && (dataout > siz)) {
4463                 /* Slow path */
4464                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4465                     (dataout > siz)) {
4466                         error = EMSGSIZE;
4467                         SOCKBUF_LOCK(&so->so_snd);
4468                         goto release;
4469                 }
4470                 /* setup the template */
4471                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4472
4473                 n = m;
4474                 while (dataout > siz) {
4475                         /*
4476                          * We can wait since this is called from the user
4477                          * send side
4478                          */
4479                         n->m_nextpkt = m_split(n, siz, MB_WAIT);
4480                         if (n->m_nextpkt == NULL) {
4481                                 error = EFAULT;
4482                                 SOCKBUF_LOCK(&so->so_snd);
4483                                 goto release;
4484                         }
4485                         dataout -= siz;
4486                         n = n->m_nextpkt;
4487                 }
4488                 /*
4489                  * ok, now we have a chain on m where m->m_nextpkt points to
4490                  * the next chunk and m/m->m_next chain is the piece to send.
4491                  * We must go through the chains and thread them on to
4492                  * sctp_tmit_chunk chains and place them all on the stream
4493                  * queue, breaking the m->m_nextpkt pointers as we go.
4494                  */
4495                 n = m;
4496                 TAILQ_INIT(&tmp);
4497                 while (n) {
4498                         /*
4499                          * first go through and allocate a sctp_tmit chunk
4500                          * for each chunk piece
4501                          */
4502                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4503                         if (chk == NULL) {
4504                                 /*
4505                                  * ok we must spin through and dump anything
4506                                  * we have allocated and then jump to the
4507                                  * no_membad
4508                                  */
4509                                 chk = TAILQ_FIRST(&tmp);
4510                                 while (chk) {
4511                                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4512                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4513                                         sctppcbinfo.ipi_count_chunk--;
4514                                         asoc->chunks_on_out_queue--;
4515                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4516                                                 panic("Chunk count is negative");
4517                                         }
4518                                         sctppcbinfo.ipi_gencnt_chunk++;
4519                                         chk = TAILQ_FIRST(&tmp);
4520                                 }
4521                                 error = ENOMEM;
4522                                 SOCKBUF_LOCK(&so->so_snd);
4523                                 goto release;
4524                         }
4525                         sctppcbinfo.ipi_count_chunk++;
4526                         asoc->chunks_on_out_queue++;
4527
4528                         sctppcbinfo.ipi_gencnt_chunk++;
4529                         *chk = template;
4530                         chk->whoTo->ref_count++;
4531                         chk->data = n;
4532                         /* Total in the MSIZE */
4533                         mbcnt_e = 0;
4534                         for (mm = chk->data; mm; mm = mm->m_next) {
4535                                 mbcnt_e += MSIZE;
4536                                 if (mm->m_flags & M_EXT) {
4537                                         mbcnt_e += chk->data->m_ext.ext_size;
4538                                 }
4539                         }
4540                         /* now fix the chk->send_size */
4541                         if (chk->data->m_flags & M_PKTHDR) {
4542                                 chk->send_size = chk->data->m_pkthdr.len;
4543                         } else {
4544                                 struct mbuf *nn;
4545                                 chk->send_size = 0;
4546                                 for (nn = chk->data; nn; nn = nn->m_next) {
4547                                         chk->send_size += nn->m_len;
4548                                 }
4549                         }
4550                         chk->book_size = chk->send_size;
4551                         chk->mbcnt = mbcnt_e;
4552                         mbcnt += mbcnt_e;
4553                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4554                                 asoc->sent_queue_cnt_removeable++;
4555                         }
4556                         n = n->m_nextpkt;
4557                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4558                 }
4559                 m = NULL;
4560                 /* now that we have enough space for all de-couple the
4561                  * chain of mbufs by going through our temp array
4562                  * and breaking the pointers.
4563                  */
4564                 /* ok, we are commited */
4565                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4566                         /* bump the ssn if we are unordered. */
4567                         strq->next_sequence_sent++;
4568                 }
4569                 /* Mark the first/last flags. This will
4570                  * result int a 3 for a single item on the list
4571                  */
4572                 chk = TAILQ_FIRST(&tmp);
4573                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4574                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4575                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4576                 /* now break any chains on the queue and
4577                  * move it to the streams actual queue.
4578                  */
4579                 chk = TAILQ_FIRST(&tmp);
4580                 while (chk) {
4581                         chk->data->m_nextpkt = 0;
4582                         TAILQ_REMOVE(&tmp, chk, sctp_next);
4583                         asoc->stream_queue_cnt++;
4584                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4585                         chk = TAILQ_FIRST(&tmp);
4586                 }
4587                 /* now check if this stream is on the wheel */
4588                 if ((strq->next_spoke.tqe_next == NULL) &&
4589                     (strq->next_spoke.tqe_prev == NULL)) {
4590                         /* Insert it on the wheel since it is not
4591                          * on it currently
4592                          */
4593                         sctp_insert_on_wheel(asoc, strq);
4594                 }
4595         }
4596         SOCKBUF_LOCK(&so->so_snd);
4597         /* has a SHUTDOWN been (also) requested by the user on this asoc? */
4598 zap_by_it_all:
4599
4600         if ((srcv->sinfo_flags & MSG_EOF) &&
4601             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4602
4603                 int some_on_streamwheel = 0;
4604
4605                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4606                         /* Check to see if some data queued */
4607                         struct sctp_stream_out *outs;
4608                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4609                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
4610                                         some_on_streamwheel = 1;
4611                                         break;
4612                                 }
4613                         }
4614                 }
4615
4616                 if (TAILQ_EMPTY(&asoc->send_queue) &&
4617                     TAILQ_EMPTY(&asoc->sent_queue) &&
4618                     (some_on_streamwheel == 0)) {
4619                         /* there is nothing queued to send, so I'm done... */
4620                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4621                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4622                                 /* only send SHUTDOWN the first time through */
4623 #ifdef SCTP_DEBUG
4624                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4625                                         kprintf("%s:%d sends a shutdown\n",
4626                                                __FILE__,
4627                                                __LINE__
4628                                                 );
4629                                 }
4630 #endif
4631                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4632                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4633                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4634                                                  asoc->primary_destination);
4635                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4636                                                  asoc->primary_destination);
4637                         }
4638                 } else {
4639                         /*
4640                          * we still got (or just got) data to send, so set
4641                          * SHUTDOWN_PENDING
4642                          */
4643                         /*
4644                          * XXX sockets draft says that MSG_EOF should be sent
4645                          * with no data.  currently, we will allow user data
4646                          * to be sent first and move to SHUTDOWN-PENDING
4647                          */
4648                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4649                 }
4650         }
4651 #ifdef SCTP_MBCNT_LOGGING
4652         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4653                        asoc->total_output_queue_size,
4654                        dataout,
4655                        asoc->total_output_mbuf_queue_size,
4656                        mbcnt);
4657 #endif
4658         asoc->total_output_queue_size += dataout;
4659         asoc->total_output_mbuf_queue_size += mbcnt;
4660         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4661             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4662                 so->so_snd.ssb_cc += dataout;
4663                 so->so_snd.ssb_mbcnt += mbcnt;
4664         }
4665
4666 #ifdef SCTP_DEBUG
4667         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4668                 kprintf("++total out:%d total_mbuf_out:%d\n",
4669                        (int)asoc->total_output_queue_size,
4670                        (int)asoc->total_output_mbuf_queue_size);
4671         }
4672 #endif
4673
4674 release:
4675         ssb_unlock(&so->so_snd);
4676 out_locked:
4677         SOCKBUF_UNLOCK(&so->so_snd);
4678 out:
4679         if (m && m->m_nextpkt) {
4680                 n = m;
4681                 while (n) {
4682                         mnext = n->m_nextpkt;
4683                         n->m_nextpkt = NULL;
4684                         sctp_m_freem(n);
4685                         n = mnext;
4686                 }
4687         } else if (m)
4688                 sctp_m_freem(m);
4689
4690         return (error);
4691 }
4692
4693 static struct mbuf *
4694 sctp_copy_mbufchain(struct mbuf *clonechain,
4695                     struct mbuf *outchain)
4696 {
4697         struct mbuf *appendchain;
4698 #if defined(__FreeBSD__) || defined(__NetBSD__)
4699         /* Supposedly m_copypacket is an optimization, use it if we can */
4700         if (clonechain->m_flags & M_PKTHDR) {
4701                 appendchain = m_copypacket(clonechain, MB_DONTWAIT);
4702                 sctp_pegs[SCTP_CACHED_SRC]++;
4703         } else
4704                 appendchain = m_copy(clonechain, 0, M_COPYALL);
4705 #elif defined(__APPLE__)
4706         appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, MB_DONTWAIT);
4707 #else
4708         appendchain = m_copy(clonechain, 0, M_COPYALL);
4709 #endif
4710
4711         if (appendchain == NULL) {
4712                 /* error */
4713                 if (outchain)
4714                         sctp_m_freem(outchain);
4715                 return (NULL);
4716         }
4717         if (outchain) {
4718                 /* tack on to the end */
4719                 struct mbuf *m;
4720                 m = outchain;
4721                 while (m) {
4722                         if (m->m_next == NULL) {
4723                                 m->m_next = appendchain;
4724                                 break;
4725                         }
4726                         m = m->m_next;
4727                 }
4728                 if (outchain->m_flags & M_PKTHDR) {
4729                         int append_tot;
4730                         struct mbuf *t;
4731                         t = appendchain;
4732                         append_tot = 0;
4733                         while (t) {
4734                                 append_tot += t->m_len;
4735                                 t = t->m_next;
4736                         }
4737                         outchain->m_pkthdr.len += append_tot;
4738                 }
4739                 return (outchain);
4740         } else {
4741                 return (appendchain);
4742         }
4743 }
4744
4745 static void
4746 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4747 {
4748         struct sctp_copy_all *ca;
4749         struct mbuf *m;
4750         int ret;
4751
4752         ca = (struct sctp_copy_all *)ptr;
4753         if (ca->m == NULL) {
4754                 return;
4755         }
4756         if (ca->inp != inp) {
4757                 /* TSNH */
4758                 return;
4759         }
4760         m = sctp_copy_mbufchain(ca->m, NULL);
4761         if (m == NULL) {
4762                 /* can't copy so we are done */
4763                 ca->cnt_failed++;
4764                 return;
4765         }
4766         ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
4767                               &ca->sndrcv, MSG_FNONBLOCKING);
4768         if (ret) {
4769                 ca->cnt_failed++;
4770         } else {
4771                 ca->cnt_sent++;
4772         }
4773 }
4774
4775 static void
4776 sctp_sendall_completes(void *ptr, u_int32_t val)
4777 {
4778         struct sctp_copy_all *ca;
4779         ca = (struct sctp_copy_all *)ptr;
4780         /* Do a notify here?
4781          * Kacheong suggests that the notify
4782          * be done at the send time.. so you would
4783          * push up a notification if any send failed.
4784          * Don't know if this is feasable since the
4785          * only failures we have is "memory" related and
4786          * if you cannot get an mbuf to send the data
4787          * you surely can't get an mbuf to send up
4788          * to notify the user you can't send the data :->
4789          */
4790
4791         /* now free everything */
4792         m_freem(ca->m);
4793         FREE(ca, M_PCB);
4794 }
4795
4796
4797 #define MC_ALIGN(m, len) do {                                           \
4798         (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);                \
4799 } while (0)
4800
4801
4802
4803 static struct mbuf *
4804 sctp_copy_out_all(struct uio *uio, int len)
4805 {
4806         struct mbuf *ret, *at;
4807         int left, willcpy, cancpy, error;
4808
4809         MGETHDR(ret, MB_WAIT, MT_HEADER);
4810         if (ret == NULL) {
4811                 /* TSNH */
4812                 return (NULL);
4813         }
4814         left = len;
4815         ret->m_len = 0;
4816         ret->m_pkthdr.len = len;
4817         MCLGET(ret, MB_WAIT);
4818         if (ret == NULL) {
4819                 return (NULL);
4820         }
4821         if ((ret->m_flags & M_EXT) == 0) {
4822                 m_freem (ret);
4823                 return (NULL);
4824         }
4825         cancpy = M_TRAILINGSPACE(ret);
4826         willcpy = min(cancpy, left);
4827         at = ret;
4828         while (left > 0) {
4829                 /* Align data to the end */
4830                 MC_ALIGN(at, willcpy);
4831                 error = uiomove(mtod(at, caddr_t), willcpy, uio);
4832                 if (error) {
4833                 err_out_now:
4834                         m_freem(ret);
4835                         return (NULL);
4836                 }
4837                 at->m_len = willcpy;
4838                 at->m_nextpkt = at->m_next = 0;
4839                 left -= willcpy;
4840                 if (left > 0) {
4841                         MGET(at->m_next, MB_WAIT, MT_DATA);
4842                         if (at->m_next == NULL) {
4843                                 goto err_out_now;
4844                         }
4845                         at = at->m_next;
4846                         at->m_len = 0;
4847                         MCLGET(at, MB_WAIT);
4848                         if (at == NULL) {
4849                                 goto err_out_now;
4850                         }
4851                         if ((at->m_flags & M_EXT) == 0) {
4852                                 goto err_out_now;
4853                         }
4854                         cancpy = M_TRAILINGSPACE(at);
4855                         willcpy = min(cancpy, left);
4856                 }
4857         }
4858         return (ret);
4859 }
4860
4861 static int
4862 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4863 {
4864         int ret;
4865         struct sctp_copy_all *ca;
4866         MALLOC(ca, struct sctp_copy_all *,
4867                sizeof(struct sctp_copy_all), M_PCB, MB_WAIT);
4868         if (ca == NULL) {
4869                 m_freem(m);
4870                 return (ENOMEM);
4871         }
4872         memset (ca, 0, sizeof(struct sctp_copy_all));
4873
4874         ca->inp = inp;
4875         ca->sndrcv = *srcv;
4876         /* take off the sendall flag, it would
4877          * be bad if we failed to do this  :-0
4878          */
4879         ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4880
4881         /* get length and mbuf chain */
4882         if (uio) {
4883                 ca->sndlen = uio->uio_resid;
4884                 ca->m = sctp_copy_out_all(uio, ca->sndlen);
4885                 if (ca->m == NULL) {
4886                         FREE(ca, M_PCB);
4887                         return (ENOMEM);
4888                 }
4889         } else {
4890                 if ((m->m_flags & M_PKTHDR) == 0) {
4891                         struct mbuf *mat;
4892                         mat = m;
4893                         ca->sndlen = 0;
4894                         while(m) {
4895                                 ca->sndlen += m->m_len;
4896                                 m = m->m_next;
4897                         }
4898                 } else {
4899                         ca->sndlen = m->m_pkthdr.len;
4900                 }
4901                 ca->m = m;
4902         }
4903
4904         ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4905                                      (void *)ca, 0, sctp_sendall_completes, inp);
4906         if (ret) {
4907 #ifdef SCTP_DEBUG
4908                 kprintf("Failed to initate iterator to takeover associations\n");
4909 #endif
4910                 FREE(ca, M_PCB);
4911                 return (EFAULT);
4912
4913         }
4914         return (0);
4915 }
4916
4917
4918 void
4919 sctp_toss_old_cookies(struct sctp_association *asoc)
4920 {
4921         struct sctp_tmit_chunk *chk, *nchk;
4922         chk = TAILQ_FIRST(&asoc->control_send_queue);
4923         while (chk) {
4924                 nchk = TAILQ_NEXT(chk, sctp_next);
4925                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4926                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4927                         if (chk->data) {
4928                                 sctp_m_freem(chk->data);
4929                                 chk->data = NULL;
4930                         }
4931                         asoc->ctrl_queue_cnt--;
4932                         if (chk->whoTo)
4933                                 sctp_free_remote_addr(chk->whoTo);
4934                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4935                         sctppcbinfo.ipi_count_chunk--;
4936                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4937                                 panic("Chunk count is negative");
4938                         }
4939                         sctppcbinfo.ipi_gencnt_chunk++;
4940                 }
4941                 chk = nchk;
4942         }
4943 }
4944
4945 void
4946 sctp_toss_old_asconf(struct sctp_tcb *stcb)
4947 {
4948         struct sctp_association *asoc;
4949         struct sctp_tmit_chunk *chk, *chk_tmp;
4950
4951         asoc = &stcb->asoc;
4952         for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
4953              chk = chk_tmp) {
4954                 /* get next chk */
4955                 chk_tmp = TAILQ_NEXT(chk, sctp_next);
4956                 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */
4957                 if (chk->rec.chunk_id == SCTP_ASCONF) {
4958                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4959                         if (chk->data) {
4960                                 sctp_m_freem(chk->data);
4961                                 chk->data = NULL;
4962                         }
4963                         asoc->ctrl_queue_cnt--;
4964                         if (chk->whoTo)
4965                                 sctp_free_remote_addr(chk->whoTo);
4966                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4967                         sctppcbinfo.ipi_count_chunk--;
4968                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4969                                 panic("Chunk count is negative");
4970                         }
4971                         sctppcbinfo.ipi_gencnt_chunk++;
4972                 }
4973         }
4974 }
4975
4976
4977 static void
4978 sctp_clean_up_datalist(struct sctp_tcb *stcb,
4979                        struct sctp_association *asoc,
4980                        struct sctp_tmit_chunk **data_list,
4981                        int bundle_at,
4982                        struct sctp_nets *net)
4983 {
4984         int i;
4985         for (i = 0; i < bundle_at; i++) {
4986                 /* off of the send queue */
4987                 if (i) {
4988                         /* Any chunk NOT 0 you zap the time
4989                          * chunk 0 gets zapped or set based on
4990                          * if a RTO measurment is needed.
4991                          */
4992                         data_list[i]->do_rtt = 0;
4993                 }
4994                 /* record time */
4995                 data_list[i]->sent_rcv_time = net->last_sent_time;
4996                 TAILQ_REMOVE(&asoc->send_queue,
4997                              data_list[i],
4998                              sctp_next);
4999                 /* on to the sent queue */
5000                 TAILQ_INSERT_TAIL(&asoc->sent_queue,
5001                                   data_list[i],
5002                                   sctp_next);
5003                 /* This does not lower until the cum-ack passes it */
5004                 asoc->sent_queue_cnt++;
5005                 asoc->send_queue_cnt--;
5006                 if ((asoc->peers_rwnd <= 0) &&
5007                     (asoc->total_flight == 0) &&
5008                     (bundle_at == 1)) {
5009                         /* Mark the chunk as being a window probe */
5010 #ifdef SCTP_DEBUG
5011                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
5012                                 kprintf("WINDOW PROBE SET\n");
5013                         }
5014 #endif
5015                         sctp_pegs[SCTP_WINDOW_PROBES]++;
5016                         data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
5017                 } else {
5018                         data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
5019                 }
5020 #ifdef SCTP_AUDITING_ENABLED
5021                 sctp_audit_log(0xC2, 3);
5022 #endif
5023                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
5024                 data_list[i]->snd_count = 1;
5025                 net->flight_size += data_list[i]->book_size;
5026                 asoc->total_flight += data_list[i]->book_size;
5027                 asoc->total_flight_count++;
5028 #ifdef SCTP_LOG_RWND
5029                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
5030                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
5031 #endif
5032                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
5033                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
5034                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5035                         /* SWS sender side engages */
5036                         asoc->peers_rwnd = 0;
5037                 }
5038         }
5039 }
5040
5041 static void
5042 sctp_clean_up_ctl(struct sctp_association *asoc)
5043 {
5044         struct sctp_tmit_chunk *chk, *nchk;
5045         for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5046             chk; chk = nchk) {
5047                 nchk = TAILQ_NEXT(chk, sctp_next);
5048                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5049                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5050                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5051                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5052                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5053                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5054                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5055                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5056                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5057                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5058                         /* Stray chunks must be cleaned up */
5059                 clean_up_anyway:
5060                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5061                         if (chk->data) {
5062                                 sctp_m_freem(chk->data);
5063                                 chk->data = NULL;
5064                         }
5065                         asoc->ctrl_queue_cnt--;
5066                         sctp_free_remote_addr(chk->whoTo);
5067                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5068                         sctppcbinfo.ipi_count_chunk--;
5069                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5070                                 panic("Chunk count is negative");
5071                         }
5072                         sctppcbinfo.ipi_gencnt_chunk++;
5073                 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
5074                         struct sctp_stream_reset_req *strreq;
5075                         /* special handling, we must look into the param */
5076                         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
5077                         if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5078                                 goto clean_up_anyway;
5079                         }
5080                 }
5081         }
5082 }
5083
5084 static int
5085 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5086                       struct sctp_stream_out *strq)
5087 {
5088         /* Move from the stream to the send_queue keeping track of the total */
5089         struct sctp_association *asoc;
5090         int tot_moved = 0;
5091         int failed = 0;
5092         int padval;
5093         struct sctp_tmit_chunk *chk, *nchk;
5094         struct sctp_data_chunk *dchkh;
5095         struct sctpchunk_listhead tmp;
5096         struct mbuf *orig;
5097
5098         asoc = &stcb->asoc;
5099         TAILQ_INIT(&tmp);
5100         chk = TAILQ_FIRST(&strq->outqueue);
5101         while (chk) {
5102                 nchk = TAILQ_NEXT(chk, sctp_next);
5103                 /* now put in the chunk header */
5104                 orig = chk->data;
5105                 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), MB_DONTWAIT);
5106                 if (chk->data == NULL) {
5107                         /* HELP */
5108                         failed++;
5109                         break;
5110                 }
5111                 if (orig != chk->data) {
5112                         /* A new mbuf was added, account for it */
5113                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5114                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5115                                 stcb->sctp_socket->so_snd.ssb_mbcnt += MSIZE;
5116                         }
5117 #ifdef SCTP_MBCNT_LOGGING
5118                         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5119                                        asoc->total_output_queue_size,
5120                                        0,
5121                                        asoc->total_output_mbuf_queue_size,
5122                                        MSIZE);
5123 #endif
5124                         stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5125                         chk->mbcnt += MSIZE;
5126                 }
5127                 chk->send_size += sizeof(struct sctp_data_chunk);
5128                 /* This should NOT have to do anything, but
5129                  * I would rather be cautious
5130                  */
5131                 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5132                         m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5133                         if (chk->data == NULL) {
5134                                 failed++;
5135                                 break;
5136                         }
5137                 }
5138                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5139                 dchkh->ch.chunk_length = htons(chk->send_size);
5140                 /* Chunks must be padded to even word boundary */
5141                 padval = chk->send_size % 4;
5142                 if (padval) {
5143                         /* For fragmented messages this should not
5144                          * run except possibly on the last chunk
5145                          */
5146                         if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5147                                 /* we are in big big trouble no mbufs :< */
5148                                 failed++;
5149                                 break;
5150                         }
5151                         chk->send_size += (4 - padval);
5152                 }
5153                 /* pull from stream queue */
5154                 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5155                 asoc->stream_queue_cnt--;
5156                 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5157                 /* add it in to the size of moved chunks */
5158                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5159                         /* we pull only one message */
5160                         break;
5161                 }
5162                 chk = nchk;
5163         }
5164         if (failed) {
5165                 /* Gak, we just lost the user message */
5166                 chk = TAILQ_FIRST(&tmp);
5167                 while (chk) {
5168                         nchk = TAILQ_NEXT(chk, sctp_next);
5169                         TAILQ_REMOVE(&tmp, chk, sctp_next);
5170
5171                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5172                                         (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5173                                         chk);
5174
5175                         if (chk->data) {
5176                                 sctp_m_freem(chk->data);
5177                                 chk->data = NULL;
5178                         }
5179                         if (chk->whoTo) {
5180                                 sctp_free_remote_addr(chk->whoTo);
5181                                 chk->whoTo = NULL;
5182                         }
5183                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5184                         sctppcbinfo.ipi_count_chunk--;
5185                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5186                                 panic("Chunk count is negative");
5187                         }
5188                         sctppcbinfo.ipi_gencnt_chunk++;
5189                         chk = nchk;
5190                 }
5191                 return (0);
5192         }
5193         /* now pull them off of temp wheel */
5194         chk = TAILQ_FIRST(&tmp);
5195         while (chk) {
5196                 nchk = TAILQ_NEXT(chk, sctp_next);
5197                 /* insert on send_queue */
5198                 TAILQ_REMOVE(&tmp, chk, sctp_next);
5199                 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5200                 asoc->send_queue_cnt++;
5201                 /* assign TSN */
5202                 chk->rec.data.TSN_seq = asoc->sending_seq++;
5203
5204                 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5205                 /* Put the rest of the things in place now. Size
5206                  * was done earlier in previous loop prior to
5207                  * padding.
5208                  */
5209                 dchkh->ch.chunk_type = SCTP_DATA;
5210                 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5211                 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5212                 dchkh->dp.stream_id = htons(strq->stream_no);
5213                 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5214                 dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5215                 /* total count moved */
5216                 tot_moved += chk->send_size;
5217                 chk = nchk;
5218         }
5219         return (tot_moved);
5220 }
5221
5222 static void
5223 sctp_fill_outqueue(struct sctp_tcb *stcb,
5224                    struct sctp_nets *net)
5225 {
5226         struct sctp_association *asoc;
5227         struct sctp_tmit_chunk *chk;
5228         struct sctp_stream_out *strq, *strqn;
5229         int mtu_fromwheel, goal_mtu;
5230         unsigned int moved, seenend, cnt_mvd=0;
5231
5232         asoc = &stcb->asoc;
5233         /* Attempt to move at least 1 MTU's worth
5234          * onto the wheel for each destination address
5235          */
5236         goal_mtu = net->cwnd - net->flight_size;
5237         if ((unsigned int)goal_mtu < net->mtu) {
5238                 goal_mtu = net->mtu;
5239         }
5240         if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5241                 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5242         }
5243         seenend = moved = mtu_fromwheel = 0;
5244         if (asoc->last_out_stream == NULL) {
5245                 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5246                 if (asoc->last_out_stream == NULL) {
5247                         /* huh nothing on the wheel, TSNH */
5248                         return;
5249                 }
5250                 goto done_it;
5251         }
5252         strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5253  done_it:
5254         if (strq == NULL) {
5255                 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5256         }
5257         while (mtu_fromwheel < goal_mtu) {
5258                 if (strq == NULL) {
5259                         if (seenend == 0) {
5260                                 seenend = 1;
5261                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5262                         } else if ((moved == 0) && (seenend)) {
5263                                 /* none left on the wheel */
5264                                 sctp_pegs[SCTP_MOVED_NLEF]++;
5265                                 return;
5266                         } else if (moved) {
5267                                 /*
5268                                  * clear the flags and rotate back through
5269                                  * again
5270                                  */
5271                                 moved = 0;
5272                                 seenend = 0;
5273                                 strq = TAILQ_FIRST(&asoc->out_wheel);
5274                         }
5275                         if (strq == NULL)
5276                                 break;
5277                         continue;
5278                 }
5279                 strqn = TAILQ_NEXT(strq, next_spoke);
5280                 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5281                         /* none left on this queue, prune a spoke?  */
5282                         sctp_remove_from_wheel(asoc, strq);
5283                         if (strq == asoc->last_out_stream) {
5284                             /* the last one we used went off the wheel */
5285                             asoc->last_out_stream = NULL;
5286                         }
5287                         strq = strqn;
5288                         continue;
5289                 }
5290                 if (chk->whoTo != net) {
5291                         /* Skip this stream, first one on stream
5292                          * does not head to our current destination.
5293                          */
5294                         strq = strqn;
5295                         continue;
5296                 }
5297                 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5298                 cnt_mvd++;
5299                 moved++;
5300                 asoc->last_out_stream = strq;
5301                 strq = strqn;
5302         }
5303         sctp_pegs[SCTP_MOVED_MAX]++;
5304 #ifdef SCTP_DEBUG
5305         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5306                 kprintf("Ok we moved %d chunks to send queue\n",
5307                        moved);
5308         }
5309 #endif
5310         if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5311                 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5312         }
5313 }
5314
5315 void
5316 sctp_fix_ecn_echo(struct sctp_association *asoc)
5317 {
5318         struct sctp_tmit_chunk *chk;
5319         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5320                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5321                         chk->sent = SCTP_DATAGRAM_UNSENT;
5322                 }
5323         }
5324 }
5325
5326 static void
5327 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5328                     struct sctp_association *asoc,
5329                     struct sctp_nets *net)
5330 {
5331         struct sctp_tmit_chunk *chk;
5332         struct sctp_nets *a_net;
5333         a_net = sctp_find_alternate_net(stcb, net);
5334         if ((a_net != net) &&
5335             ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5336                 /*
5337                  * We only proceed if a valid alternate is found that is
5338                  * not this one and is reachable. Here we must move all
5339                  * chunks queued in the send queue off of the destination
5340                  * address to our alternate.
5341                  */
5342                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5343                         if (chk->whoTo == net) {
5344                                 /* Move the chunk to our alternate */
5345                                 sctp_free_remote_addr(chk->whoTo);
5346                                 chk->whoTo = a_net;
5347                                 a_net->ref_count++;
5348                         }
5349                 }
5350         }
5351 }
5352
5353 static int sctp_from_user_send=0;
5354
5355 static int
5356 sctp_med_chunk_output(struct sctp_inpcb *inp,
5357                       struct sctp_tcb *stcb,
5358                       struct sctp_association *asoc,
5359                       int *num_out,
5360                       int *reason_code,
5361                       int control_only, int *cwnd_full, int from_where,
5362                       struct timeval *now, int *now_filled)
5363 {
5364         /*
5365          * Ok this is the generic chunk service queue.
5366          * we must do the following:
5367          *  - Service the stream queue that is next, moving any message
5368          *    (note I must get a complete message i.e. FIRST/MIDDLE and
5369          *    LAST to the out queue in one pass) and assigning TSN's
5370          *  - Check to see if the cwnd/rwnd allows any output, if so we
5371          *    go ahead and fomulate and send the low level chunks. Making
5372          *    sure to combine any control in the control chunk queue also.
5373          */
5374         struct sctp_nets *net;
5375         struct mbuf *outchain;
5376         struct sctp_tmit_chunk *chk, *nchk;
5377         struct sctphdr *shdr;
5378         /* temp arrays for unlinking */
5379         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5380         int no_fragmentflg, error;
5381         int one_chunk, hbflag;
5382         int asconf, cookie, no_out_cnt;
5383         int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5384         unsigned int mtu, r_mtu, omtu;
5385         *num_out = 0;
5386         cwnd_full_ind = 0;
5387         ctl_cnt = no_out_cnt = asconf = cookie = 0;
5388         /*
5389          * First lets prime the pump. For each destination, if there
5390          * is room in the flight size, attempt to pull an MTU's worth
5391          * out of the stream queues into the general send_queue
5392          */
5393 #ifdef SCTP_AUDITING_ENABLED
5394         sctp_audit_log(0xC2, 2);
5395 #endif
5396 #ifdef SCTP_DEBUG
5397         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5398                 kprintf("***********************\n");
5399         }
5400 #endif
5401         hbflag = 0;
5402         if (control_only)
5403                 no_data_chunks = 1;
5404         else
5405                 no_data_chunks = 0;
5406
5407         /* Nothing to possible to send? */
5408         if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5409             TAILQ_EMPTY(&asoc->send_queue) &&
5410             TAILQ_EMPTY(&asoc->out_wheel)) {
5411 #ifdef SCTP_DEBUG
5412                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5413                         kprintf("All wheels empty\n");
5414                 }
5415 #endif
5416                 return (0);
5417         }
5418         if (asoc->peers_rwnd <= 0) {
5419                 /* No room in peers rwnd */
5420                 *cwnd_full = 1;
5421                 *reason_code = 1;
5422                 if (asoc->total_flight > 0) {
5423                         /* we are allowed one chunk in flight */
5424                         no_data_chunks = 1;
5425                         sctp_pegs[SCTP_RWND_BLOCKED]++;
5426                 }
5427         }
5428 #ifdef SCTP_DEBUG
5429         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5430                 kprintf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5431                        (int)no_data_chunks,
5432                        (int)asoc->total_flight, (int)asoc->peers_rwnd);
5433         }
5434 #endif
5435         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5436 #ifdef SCTP_DEBUG
5437                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5438                         kprintf("net:%p fs:%d  cwnd:%d\n",
5439                                net, net->flight_size, net->cwnd);
5440                 }
5441 #endif
5442                 if (net->flight_size >= net->cwnd) {
5443                         /* skip this network, no room */
5444                         cwnd_full_ind++;
5445 #ifdef SCTP_DEBUG
5446                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5447                                 kprintf("Ok skip fillup->fs:%d > cwnd:%d\n",
5448                                        net->flight_size,
5449                                        net->cwnd);
5450                         }
5451 #endif
5452                         sctp_pegs[SCTP_CWND_NOFILL]++;
5453                         continue;
5454                 }
5455                 /*
5456                  * spin through the stream queues moving one message and
5457                  * assign TSN's as appropriate.
5458                  */
5459                 sctp_fill_outqueue(stcb, net);
5460         }
5461         *cwnd_full = cwnd_full_ind;
5462         /* now service each destination and send out what we can for it */
5463 #ifdef SCTP_DEBUG
5464         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5465                 int chk_cnt = 0;
5466                 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5467                         chk_cnt++;
5468                 }
5469                 kprintf("We have %d chunks on the send_queue\n", chk_cnt);
5470                 chk_cnt = 0;
5471                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5472                         chk_cnt++;
5473                 }
5474                 kprintf("We have %d chunks on the sent_queue\n", chk_cnt);
5475                 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5476                         chk_cnt++;
5477                 }
5478                 kprintf("We have %d chunks on the control_queue\n", chk_cnt);
5479         }
5480 #endif
5481         /* If we have data to send, and DSACK is running, stop it
5482          * and build a SACK to dump on to bundle with output. This
5483          * actually MAY make it so the bundling does not occur if
5484          * the SACK is big but I think this is ok because basic SACK
5485          * space is pre-reserved in our fragmentation size choice.
5486          */
5487         if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5488             (no_data_chunks == 0)) {
5489                 /* We will be sending something */
5490                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5491                         /* Yep a callout is pending */
5492                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5493                                         stcb->sctp_ep,
5494                                         stcb, NULL);
5495                         sctp_send_sack(stcb);
5496                 }
5497         }
5498         /* Nothing to send? */
5499         if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5500             (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5501                 return (0);
5502         }
5503         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5504                 /* how much can we send? */
5505                 if (net->ref_count < 2) {
5506                         /* Ref-count of 1 so we cannot have data or control
5507                          * queued to this address. Skip it.
5508                          */
5509                         continue;
5510                 }
5511                 ctl_cnt = bundle_at = 0;
5512                 outchain = NULL;
5513                 no_fragmentflg = 1;
5514                 one_chunk = 0;
5515
5516                 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) {
5517                         /* if we have a route and an ifp
5518                          * check to see if we have room to
5519                          * send to this guy
5520                          */
5521                         struct ifnet *ifp;
5522                         ifp = net->ro.ro_rt->rt_ifp;
5523                         if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
5524                                 sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
5525 #ifdef SCTP_LOG_MAXBURST
5526                                 sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
5527   #endif
5528                                 continue;
5529                         }
5530                 }
5531                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5532                         mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5533                 } else {
5534                         mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5535                 }
5536                 if (mtu > asoc->peers_rwnd) {
5537                         if (asoc->total_flight > 0) {
5538                                 /* We have a packet in flight somewhere */
5539                                 r_mtu = asoc->peers_rwnd;
5540                         } else {
5541                                 /* We are always allowed to send one MTU out */
5542                                 one_chunk = 1;
5543                                 r_mtu = mtu;
5544                         }
5545                 } else {
5546                         r_mtu = mtu;
5547                 }
5548 #ifdef SCTP_DEBUG
5549                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5550                         kprintf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5551                                r_mtu, mtu, net, one_chunk);
5552                 }
5553 #endif
5554                 /************************/
5555                 /* Control transmission */
5556                 /************************/
5557                 /* Now first lets go through the control queue */
5558                 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5559                      chk; chk = nchk) {
5560                         nchk = TAILQ_NEXT(chk, sctp_next);
5561                         if (chk->whoTo != net) {
5562                                 /*
5563                                  * No, not sent to the network we are
5564                                  * looking at
5565                                  */
5566                                 continue;
5567                         }
5568                         if (chk->data == NULL) {
5569                                 continue;
5570                         }
5571                         if ((chk->data->m_flags & M_PKTHDR) == 0) {
5572                                 /*
5573                                  * NOTE: the chk queue MUST have the PKTHDR
5574                                  * flag set on it with a total in the
5575                                  * m_pkthdr.len field!! else the chunk will
5576                                  * ALWAYS be skipped
5577                                  */
5578                                 continue;
5579                         }
5580                         if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5581                                 /*
5582                                  * It must be unsent. Cookies and ASCONF's
5583                                  * hang around but there timers will force
5584                                  * when marked for resend.
5585                                  */
5586                                 continue;
5587                         }
5588                         /* Here we do NOT factor the r_mtu */
5589                         if ((chk->data->m_pkthdr.len < (int)mtu) ||
5590                             (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5591                                 /*
5592                                  * We probably should glom the mbuf chain from
5593                                  * the chk->data for control but the problem
5594                                  * is it becomes yet one more level of
5595                                  * tracking to do if for some reason output
5596                                  * fails. Then I have got to reconstruct the
5597                                  * merged control chain.. el yucko.. for now
5598                                  * we take the easy way and do the copy
5599                                  */
5600                                 outchain = sctp_copy_mbufchain(chk->data,
5601                                                                outchain);
5602                                 if (outchain == NULL) {
5603                                         return (ENOMEM);
5604                                 }
5605                                 /* update our MTU size */
5606                                 mtu -= chk->data->m_pkthdr.len;
5607                                 if (mtu < 0) {
5608                                         mtu = 0;
5609                                 }
5610                                 /* Do clear IP_DF ? */
5611                                 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5612                                         no_fragmentflg = 0;
5613                                 }
5614                                 /* Mark things to be removed, if needed */
5615                                 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5616                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5617                                     (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5618                                     (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5619                                     (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5620                                     (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5621                                     (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5622                                     (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5623                                     (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5624                                     (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5625
5626                                         if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5627                                                 hbflag = 1;
5628                                         /* remove these chunks at the end */
5629                                         if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5630                                                 /* turn off the timer */
5631                                                 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5632                                                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5633                                                                         inp, stcb, net);
5634                                                 }
5635                                         }
5636                                         ctl_cnt++;
5637                                 } else {
5638                                         /*
5639                                          * Other chunks, since they have
5640                                          * timers running (i.e. COOKIE or
5641                                          * ASCONF) we just "trust" that it
5642                                          * gets sent or retransmitted.
5643                                          */
5644                                         ctl_cnt++;
5645                                         if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5646                                                 cookie = 1;
5647                                                 no_out_cnt = 1;
5648                                         } else if (chk->rec.chunk_id == SCTP_ASCONF) {
5649                                                 /*
5650                                                  * set hb flag since we can use
5651                                                  * these for RTO
5652                                                  */
5653                                                 hbflag = 1;
5654                                                 asconf = 1;
5655                                         }
5656                                         chk->sent = SCTP_DATAGRAM_SENT;
5657                                         chk->snd_count++;
5658                                 }
5659                                 if (mtu == 0) {
5660                                         /*
5661                                          * Ok we are out of room but we can
5662                                          * output without effecting the flight
5663                                          * size since this little guy is a
5664                                          * control only packet.
5665                                          */
5666                                         if (asconf) {
5667                                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5668                                                 asconf = 0;
5669                                         }
5670                                         if (cookie) {
5671                                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5672                                                 cookie = 0;
5673                                         }
5674                                         if (outchain->m_len == 0) {
5675                                                 /*
5676                                                  * Special case for when you
5677                                                  * get a 0 len mbuf at the
5678                                                  * head due to the lack of a
5679                                                  * MHDR at the beginning.
5680                                                  */
5681                                                 outchain->m_len = sizeof(struct sctphdr);
5682                                         } else {
5683                                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5684                                                 if (outchain == NULL) {
5685                                                         /* no memory */
5686                                                         error = ENOBUFS;
5687                                                         goto error_out_again;
5688                                                 }
5689                                         }
5690                                         shdr = mtod(outchain, struct sctphdr *);
5691                                         shdr->src_port = inp->sctp_lport;
5692                                         shdr->dest_port = stcb->rport;
5693                                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5694                                         shdr->checksum = 0;
5695
5696                                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5697                                                                                 (struct sockaddr *)&net->ro._l_addr,
5698                                                                                 outchain,
5699                                                                                 no_fragmentflg, 0, NULL, asconf))) {
5700                                                 if (error == ENOBUFS) {
5701                                                         asoc->ifp_had_enobuf = 1;
5702                                                 }
5703                                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5704                                                 if (from_where == 0) {
5705                                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5706                                                 }
5707                                         error_out_again:
5708 #ifdef SCTP_DEBUG
5709                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5710                                                         kprintf("Gak got ctrl error %d\n", error);
5711                                                 }
5712 #endif
5713                                                 /* error, could not output */
5714                                                 if (hbflag) {
5715 #ifdef SCTP_DEBUG
5716                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5717                                                                 kprintf("Update HB anyway\n");
5718                                                         }
5719 #endif
5720                                                         if (*now_filled == 0) {
5721                                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5722                                                                 *now_filled = 1;
5723                                                                 *now = net->last_sent_time;
5724                                                         } else {
5725                                                                 net->last_sent_time = *now;
5726                                                         }
5727                                                         hbflag = 0;
5728                                                 }
5729                                                 if (error == EHOSTUNREACH) {
5730                                                         /*
5731                                                          * Destination went
5732                                                          * unreachable during
5733                                                          * this send
5734                                                          */
5735 #ifdef SCTP_DEBUG
5736                                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5737                                                                 kprintf("Moving data to an alterante\n");
5738                                                         }
5739 #endif
5740                                                         sctp_move_to_an_alt(stcb, asoc, net);
5741                                                 }
5742                                                 sctp_clean_up_ctl (asoc);
5743                                                 return (error);
5744                                         } else
5745                                                 asoc->ifp_had_enobuf = 0;
5746                                         /* Only HB or ASCONF advances time */
5747                                         if (hbflag) {
5748                                                 if (*now_filled == 0) {
5749                                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5750                                                         *now_filled = 1;
5751                                                         *now = net->last_sent_time;
5752                                                 } else {
5753                                                         net->last_sent_time = *now;
5754                                                 }
5755                                                 hbflag = 0;
5756                                         }
5757                                         /*
5758                                          * increase the number we sent, if a
5759                                          * cookie is sent we don't tell them
5760                                          * any was sent out.
5761                                          */
5762                                         if (!no_out_cnt)
5763                                                 *num_out +=  ctl_cnt;
5764                                         /* recalc a clean slate and setup */
5765                                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5766                                                 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5767                                         } else {
5768                                                 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5769                                         }
5770                                         no_fragmentflg = 1;
5771                                 }
5772                         }
5773                 }
5774                 /*********************/
5775                 /* Data transmission */
5776                 /*********************/
5777                 /* now lets add any data within the MTU constraints */
5778                 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5779                         omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5780                 } else {
5781                         omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5782                 }
5783
5784 #ifdef SCTP_DEBUG
5785                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5786                         kprintf("Now to data transmission\n");
5787                 }
5788 #endif
5789
5790                 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5791                     (cookie)) {
5792                         for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5793                                 if (no_data_chunks) {
5794                                         /* let only control go out */
5795 #ifdef SCTP_DEBUG
5796                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5797                                                 kprintf("Either nothing to send or we are full\n");
5798                                         }
5799 #endif
5800                                         break;
5801                                 }
5802                                 if (net->flight_size >= net->cwnd) {
5803                                         /* skip this net, no room for data */
5804 #ifdef SCTP_DEBUG
5805                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5806                                                 kprintf("fs:%d > cwnd:%d\n",
5807                                                        net->flight_size, net->cwnd);
5808                                         }
5809 #endif
5810                                         sctp_pegs[SCTP_CWND_BLOCKED]++;
5811                                         *reason_code = 2;
5812                                         break;
5813                                 }
5814                                 nchk = TAILQ_NEXT(chk, sctp_next);
5815                                 if (chk->whoTo != net) {
5816                                         /* No, not sent to this net */
5817 #ifdef SCTP_DEBUG
5818                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5819                                                 kprintf("chk->whoTo:%p not %p\n",
5820                                                        chk->whoTo, net);
5821
5822                                         }
5823 #endif
5824                                         continue;
5825                                 }
5826 #ifdef SCTP_DEBUG
5827                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5828                                         kprintf("Can we pick up a chunk?\n");
5829                                 }
5830 #endif
5831                                 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5832                                         /* strange, we have a chunk that is to bit
5833                                          * for its destination and yet no fragment ok flag.
5834                                          * Something went wrong when the PMTU changed...we did
5835                                          * not mark this chunk for some reason?? I will
5836                                          * fix it here by letting IP fragment it for now and
5837                                          * printing a warning. This really should not happen ...
5838                                          */
5839 /*#ifdef SCTP_DEBUG*/
5840                                         kprintf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5841                                                chk->send_size, mtu);
5842 /*#endif*/
5843                                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5844                                 }
5845
5846                                 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5847                                     ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5848                                         /* ok we will add this one */
5849 #ifdef SCTP_DEBUG
5850                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5851                                                 kprintf("Picking up the chunk\n");
5852                                         }
5853 #endif
5854                                         outchain = sctp_copy_mbufchain(chk->data, outchain);
5855                                         if (outchain == NULL) {
5856 #ifdef SCTP_DEBUG
5857                                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5858                                                         kprintf("Gakk no memory\n");
5859                                                 }
5860 #endif
5861                                                 if (!callout_pending(&net->rxt_timer.timer)) {
5862                                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5863                                                 }
5864                                                 return (ENOMEM);
5865                                         }
5866                                         /* upate our MTU size */
5867                                         /* Do clear IP_DF ? */
5868                                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5869                                                 no_fragmentflg = 0;
5870                                         }
5871                                         mtu -= chk->send_size;
5872                                         r_mtu -= chk->send_size;
5873                                         data_list[bundle_at++] = chk;
5874                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5875                                                 mtu = 0;
5876                                                 break;
5877                                         }
5878                                         if (mtu <= 0) {
5879                                                 mtu = 0;
5880                                                 break;
5881                                         }
5882                                         if ((r_mtu <= 0) || one_chunk) {
5883                                                 r_mtu = 0;
5884                                                 break;
5885                                         }
5886                                 } else {
5887                                         /*
5888                                          * Must be sent in order of the TSN's
5889                                          * (on a network)
5890                                          */
5891 #ifdef SCTP_DEBUG
5892                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5893                                                 kprintf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5894                                                        chk->send_size, mtu, r_mtu);
5895                                         }
5896 #endif
5897
5898                                         break;
5899                                 }
5900                         }/* for () */
5901                 } /* if asoc.state OPEN */
5902                 /* Is there something to send for this destination? */
5903 #ifdef SCTP_DEBUG
5904                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5905                         kprintf("ok now is chain assembled? %p\n",
5906                                outchain);
5907                 }
5908 #endif
5909
5910                 if (outchain) {
5911                         /* We may need to start a control timer or two */
5912                         if (asconf) {
5913                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5914                                 asconf = 0;
5915                         }
5916                         if (cookie) {
5917                                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5918                                 cookie = 0;
5919                         }
5920                         /* must start a send timer if data is being sent */
5921                         if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5922                                 /* no timer running on this destination
5923                                  * restart it.
5924                                  */
5925 #ifdef SCTP_DEBUG
5926                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5927                                         kprintf("ok lets start a send timer .. we will transmit %p\n",
5928                                                outchain);
5929                                 }
5930 #endif
5931                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5932                         }
5933                         /* Now send it, if there is anything to send :> */
5934                         if ((outchain->m_flags & M_PKTHDR) == 0) {
5935                                 struct mbuf *t;
5936
5937                                 MGETHDR(t, MB_DONTWAIT, MT_HEADER);
5938                                 if (t == NULL) {
5939                                         sctp_m_freem(outchain);
5940                                         return (ENOMEM);
5941                                 }
5942                                 t->m_next = outchain;
5943                                 t->m_pkthdr.len = 0;
5944                                 t->m_pkthdr.rcvif = 0;
5945                                 t->m_len = 0;
5946
5947                                 outchain = t;
5948                                 while (t) {
5949                                         outchain->m_pkthdr.len += t->m_len;
5950                                         t = t->m_next;
5951                                 }
5952                         }
5953                         if (outchain->m_len == 0) {
5954                                 /* Special case for when you get a 0 len
5955                                  * mbuf at the head due to the lack
5956                                  * of a MHDR at the beginning.
5957                                  */
5958                                 MH_ALIGN(outchain, sizeof(struct sctphdr));
5959                                 outchain->m_len = sizeof(struct sctphdr);
5960                         } else {
5961                                 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5962                                 if (outchain == NULL) {
5963                                         /* out of mbufs */
5964                                         error = ENOBUFS;
5965                                         goto errored_send;
5966                                 }
5967                         }
5968                         shdr = mtod(outchain, struct sctphdr *);
5969                         shdr->src_port = inp->sctp_lport;
5970                         shdr->dest_port = stcb->rport;
5971                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5972                         shdr->checksum = 0;
5973                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5974                                                                 (struct sockaddr *)&net->ro._l_addr,
5975                                                                 outchain,
5976                                                                 no_fragmentflg, bundle_at, data_list[0], asconf))) {
5977                                 /* error, we could not output */
5978                                 if (error == ENOBUFS) {
5979                                         asoc->ifp_had_enobuf = 1;
5980                                 }
5981                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5982                                 if (from_where == 0) {
5983                                         sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5984                                 }
5985
5986                         errored_send:
5987 #ifdef SCTP_DEBUG
5988                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5989                                         kprintf("Gak send error %d\n", error);
5990                                 }
5991 #endif
5992                                 if (hbflag) {
5993 #ifdef SCTP_DEBUG
5994                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5995                                                 kprintf("Update HB time anyway\n");
5996                                         }
5997 #endif
5998                                         if (*now_filled == 0) {
5999                                                 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6000                                                 *now_filled = 1;
6001                                                 *now = net->last_sent_time;
6002                                         } else {
6003                                                 net->last_sent_time = *now;
6004                                         }
6005                                         hbflag = 0;
6006                                 }
6007                                 if (error == EHOSTUNREACH) {
6008                                         /*
6009                                          * Destination went unreachable during
6010                                          * this send
6011                                          */
6012 #ifdef SCTP_DEBUG
6013                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6014                                                 kprintf("Calling the movement routine\n");
6015                                         }
6016 #endif
6017                                         sctp_move_to_an_alt(stcb, asoc, net);
6018                                 }
6019                                 sctp_clean_up_ctl (asoc);
6020                                 return (error);
6021                         } else {
6022                                 asoc->ifp_had_enobuf = 0;
6023                         }
6024                         if (bundle_at || hbflag) {
6025                                 /* For data/asconf and hb set time */
6026                                 if (*now_filled == 0) {
6027                                         SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6028                                         *now_filled = 1;
6029                                         *now = net->last_sent_time;
6030                                 } else {
6031                                         net->last_sent_time = *now;
6032                                 }
6033                         }
6034
6035                         if (!no_out_cnt) {
6036                                 *num_out += (ctl_cnt + bundle_at);
6037                         }
6038                         if (bundle_at) {
6039                                 if (!net->rto_pending) {
6040                                         /* setup for a RTO measurement */
6041                                         net->rto_pending = 1;
6042                                         data_list[0]->do_rtt = 1;
6043                                 } else {
6044                                         data_list[0]->do_rtt = 0;
6045                                 }
6046                                 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
6047                                 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
6048                         }
6049                         if (one_chunk) {
6050                                 break;
6051                         }
6052                 }
6053         }
6054         /* At the end there should be no NON timed
6055          * chunks hanging on this queue.
6056          */
6057         if ((*num_out == 0) && (*reason_code == 0)) {
6058                 *reason_code = 3;
6059         }
6060         sctp_clean_up_ctl (asoc);
6061         return (0);
6062 }
6063
6064 void
6065 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
6066 {
6067         /* Prepend a OPERATIONAL_ERROR chunk header
6068          * and put on the end of the control chunk queue.
6069          */
6070         /* Sender had better have gotten a MGETHDR or else
6071          * the control chunk will be forever skipped
6072          */
6073         struct sctp_chunkhdr *hdr;
6074         struct sctp_tmit_chunk *chk;
6075         struct mbuf *mat;
6076
6077         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6078         if (chk == NULL) {
6079                 /* no memory */
6080                 sctp_m_freem(op_err);
6081                 return;
6082         }
6083         sctppcbinfo.ipi_count_chunk++;
6084         sctppcbinfo.ipi_gencnt_chunk++;
6085         M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), MB_DONTWAIT);
6086         if (op_err == NULL) {
6087                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6088                 sctppcbinfo.ipi_count_chunk--;
6089                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6090                         panic("Chunk count is negative");
6091                 }
6092                 sctppcbinfo.ipi_gencnt_chunk++;
6093                 return;
6094         }
6095         chk->send_size = 0;
6096         mat = op_err;
6097         while (mat != NULL) {
6098                 chk->send_size += mat->m_len;
6099                 mat = mat->m_next;
6100         }
6101         chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6102         chk->sent = SCTP_DATAGRAM_UNSENT;
6103         chk->snd_count = 0;
6104         chk->flags = 0;
6105         chk->asoc = &stcb->asoc;
6106         chk->data = op_err;
6107         chk->whoTo = chk->asoc->primary_destination;
6108         chk->whoTo->ref_count++;
6109         hdr = mtod(op_err, struct sctp_chunkhdr *);
6110         hdr->chunk_type = SCTP_OPERATION_ERROR;
6111         hdr->chunk_flags = 0;
6112         hdr->chunk_length = htons(chk->send_size);
6113         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6114                           chk,
6115                           sctp_next);
6116         chk->asoc->ctrl_queue_cnt++;
6117 }
6118
6119 int
6120 sctp_send_cookie_echo(struct mbuf *m,
6121                       int offset,
6122                       struct sctp_tcb *stcb,
6123                       struct sctp_nets *net)
6124 {
6125         /*
6126          * pull out the cookie and put it at the front of the control
6127          * chunk queue.
6128          */
6129         int at;
6130         struct mbuf *cookie, *mat;
6131         struct sctp_paramhdr parm, *phdr;
6132         struct sctp_chunkhdr *hdr;
6133         struct sctp_tmit_chunk *chk;
6134         uint16_t ptype, plen;
6135         /* First find the cookie in the param area */
6136         cookie = NULL;
6137         at = offset + sizeof(struct sctp_init_chunk);
6138
6139         do {
6140                 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6141                 if (phdr == NULL) {
6142                         return (-3);
6143                 }
6144                 ptype = ntohs(phdr->param_type);
6145                 plen = ntohs(phdr->param_length);
6146                 if (ptype == SCTP_STATE_COOKIE) {
6147                         int pad;
6148                         /* found the cookie */
6149                         if ((pad = (plen % 4))) {
6150                                 plen += 4 - pad;
6151                         }
6152                         cookie = sctp_m_copym(m, at, plen, MB_DONTWAIT);
6153                         if (cookie == NULL) {
6154                                 /* No memory */
6155                                 return (-2);
6156                         }
6157                         break;
6158                 }
6159                 at += SCTP_SIZE32(plen);
6160         } while (phdr);
6161         if (cookie == NULL) {
6162                 /* Did not find the cookie */
6163                 return (-3);
6164         }
6165         /* ok, we got the cookie lets change it into a cookie echo chunk */
6166
6167         /* first the change from param to cookie */
6168         hdr = mtod(cookie, struct sctp_chunkhdr *);
6169         hdr->chunk_type = SCTP_COOKIE_ECHO;
6170         hdr->chunk_flags = 0;
6171         /* now we MUST have a PKTHDR on it */
6172         if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6173                 /* we hope this happens rarely */
6174                 MGETHDR(mat, MB_DONTWAIT, MT_HEADER);
6175                 if (mat == NULL) {
6176                         sctp_m_freem(cookie);
6177                         return (-4);
6178                 }
6179                 mat->m_len = 0;
6180                 mat->m_pkthdr.rcvif = 0;
6181                 mat->m_next = cookie;
6182                 cookie = mat;
6183         }
6184         cookie->m_pkthdr.len = plen;
6185         /* get the chunk stuff now and place it in the FRONT of the queue */
6186         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6187         if (chk == NULL) {
6188                 /* no memory */
6189                 sctp_m_freem(cookie);
6190                 return (-5);
6191         }
6192         sctppcbinfo.ipi_count_chunk++;
6193         sctppcbinfo.ipi_gencnt_chunk++;
6194         chk->send_size = cookie->m_pkthdr.len;
6195         chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6196         chk->sent = SCTP_DATAGRAM_UNSENT;
6197         chk->snd_count = 0;
6198         chk->flags = 0;
6199         chk->asoc = &stcb->asoc;
6200         chk->data = cookie;
6201         chk->whoTo = chk->asoc->primary_destination;
6202         chk->whoTo->ref_count++;
6203         TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6204         chk->asoc->ctrl_queue_cnt++;
6205         return (0);
6206 }
6207
6208 void
6209 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6210                         struct mbuf *m,
6211                         int offset,
6212                         int chk_length,
6213                         struct sctp_nets *net)
6214 {
6215         /* take a HB request and make it into a
6216          * HB ack and send it.
6217          */
6218         struct mbuf *outchain;
6219         struct sctp_chunkhdr *chdr;
6220         struct sctp_tmit_chunk *chk;
6221
6222
6223         if (net == NULL)
6224                 /* must have a net pointer */
6225                 return;
6226
6227         outchain = sctp_m_copym(m, offset, chk_length, MB_DONTWAIT);
6228         if (outchain == NULL) {
6229                 /* gak out of memory */
6230                 return;
6231         }
6232         chdr = mtod(outchain, struct sctp_chunkhdr *);
6233         chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6234         chdr->chunk_flags = 0;
6235         if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6236                 /* should not happen but we are cautious. */
6237                 struct mbuf *tmp;
6238                 MGETHDR(tmp, MB_DONTWAIT, MT_HEADER);
6239                 if (tmp == NULL) {
6240                         return;
6241                 }
6242                 tmp->m_len = 0;
6243                 tmp->m_pkthdr.rcvif = 0;
6244                 tmp->m_next = outchain;
6245                 outchain = tmp;
6246         }
6247         outchain->m_pkthdr.len = chk_length;
6248         if (chk_length % 4) {
6249                 /* need pad */
6250                 u_int32_t cpthis=0;
6251                 int padlen;
6252                 padlen = 4 - (outchain->m_pkthdr.len % 4);
6253                 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (caddr_t)&cpthis);
6254         }
6255         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6256         if (chk == NULL) {
6257                 /* no memory */
6258                 sctp_m_freem(outchain);
6259                 return ;
6260         }
6261         sctppcbinfo.ipi_count_chunk++;
6262         sctppcbinfo.ipi_gencnt_chunk++;
6263
6264         chk->send_size = chk_length;
6265         chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6266         chk->sent = SCTP_DATAGRAM_UNSENT;
6267         chk->snd_count = 0;
6268         chk->flags = 0;
6269         chk->asoc = &stcb->asoc;
6270         chk->data = outchain;
6271         chk->whoTo = net;
6272         chk->whoTo->ref_count++;
6273         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6274         chk->asoc->ctrl_queue_cnt++;
6275 }
6276
6277 int
6278 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6279         /* formulate and queue a cookie-ack back to sender */
6280         struct mbuf *cookie_ack;
6281         struct sctp_chunkhdr *hdr;
6282         struct sctp_tmit_chunk *chk;
6283
6284         cookie_ack = NULL;
6285         MGETHDR(cookie_ack, MB_DONTWAIT, MT_HEADER);
6286         if (cookie_ack == NULL) {
6287                 /* no mbuf's */
6288                 return (-1);
6289         }
6290         cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6291         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6292         if (chk == NULL) {
6293                 /* no memory */
6294                 sctp_m_freem(cookie_ack);
6295                 return (-1);
6296         }
6297         sctppcbinfo.ipi_count_chunk++;
6298         sctppcbinfo.ipi_gencnt_chunk++;
6299
6300         chk->send_size = sizeof(struct sctp_chunkhdr);
6301         chk->rec.chunk_id = SCTP_COOKIE_ACK;
6302         chk->sent = SCTP_DATAGRAM_UNSENT;
6303         chk->snd_count = 0;
6304         chk->flags = 0;
6305         chk->asoc = &stcb->asoc;
6306         chk->data = cookie_ack;
6307         if (chk->asoc->last_control_chunk_from != NULL) {
6308                 chk->whoTo = chk->asoc->last_control_chunk_from;
6309         } else {
6310                 chk->whoTo = chk->asoc->primary_destination;
6311         }
6312         chk->whoTo->ref_count++;
6313         hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6314         hdr->chunk_type = SCTP_COOKIE_ACK;
6315         hdr->chunk_flags = 0;
6316         hdr->chunk_length = htons(chk->send_size);
6317         cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6318         cookie_ack->m_pkthdr.rcvif = 0;
6319         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6320         chk->asoc->ctrl_queue_cnt++;
6321         return (0);
6322 }
6323
6324
6325 int
6326 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6327 {
6328         /* formulate and queue a SHUTDOWN-ACK back to the sender */
6329         struct mbuf *m_shutdown_ack;
6330         struct sctp_shutdown_ack_chunk *ack_cp;
6331         struct sctp_tmit_chunk *chk;
6332
6333         m_shutdown_ack = NULL;
6334         MGETHDR(m_shutdown_ack, MB_DONTWAIT, MT_HEADER);
6335         if (m_shutdown_ack == NULL) {
6336                 /* no mbuf's */
6337                 return (-1);
6338         }
6339         m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6340         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6341         if (chk == NULL) {
6342                 /* no memory */
6343                 sctp_m_freem(m_shutdown_ack);
6344                 return (-1);
6345         }
6346         sctppcbinfo.ipi_count_chunk++;
6347         sctppcbinfo.ipi_gencnt_chunk++;
6348
6349         chk->send_size = sizeof(struct sctp_chunkhdr);
6350         chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6351         chk->sent = SCTP_DATAGRAM_UNSENT;
6352         chk->snd_count = 0;
6353         chk->flags = 0;
6354         chk->asoc = &stcb->asoc;
6355         chk->data = m_shutdown_ack;
6356         chk->whoTo = net;
6357         net->ref_count++;
6358
6359         ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6360         ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6361         ack_cp->ch.chunk_flags = 0;
6362         ack_cp->ch.chunk_length = htons(chk->send_size);
6363         m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6364         m_shutdown_ack->m_pkthdr.rcvif = 0;
6365         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6366         chk->asoc->ctrl_queue_cnt++;
6367         return (0);
6368 }
6369
6370 int
6371 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6372 {
6373         /* formulate and queue a SHUTDOWN to the sender */
6374         struct mbuf *m_shutdown;
6375         struct sctp_shutdown_chunk *shutdown_cp;
6376         struct sctp_tmit_chunk *chk;
6377
6378         m_shutdown = NULL;
6379         MGETHDR(m_shutdown, MB_DONTWAIT, MT_HEADER);
6380         if (m_shutdown == NULL) {
6381                 /* no mbuf's */
6382                 return (-1);
6383         }
6384         m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6385         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6386         if (chk == NULL) {
6387                 /* no memory */
6388                 sctp_m_freem(m_shutdown);
6389                 return (-1);
6390         }
6391         sctppcbinfo.ipi_count_chunk++;
6392         sctppcbinfo.ipi_gencnt_chunk++;
6393
6394         chk->send_size = sizeof(struct sctp_shutdown_chunk);
6395         chk->rec.chunk_id = SCTP_SHUTDOWN;
6396         chk->sent = SCTP_DATAGRAM_UNSENT;
6397         chk->snd_count = 0;
6398         chk->flags = 0;
6399         chk->asoc = &stcb->asoc;
6400         chk->data = m_shutdown;
6401         chk->whoTo = net;
6402         net->ref_count++;
6403
6404         shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6405         shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6406         shutdown_cp->ch.chunk_flags = 0;
6407         shutdown_cp->ch.chunk_length = htons(chk->send_size);
6408         shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6409         m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6410         m_shutdown->m_pkthdr.rcvif = 0;
6411         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6412         chk->asoc->ctrl_queue_cnt++;
6413
6414         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6415             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6416                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
6417                 soisdisconnecting(stcb->sctp_ep->sctp_socket);
6418         }
6419         return (0);
6420 }
6421
6422 int
6423 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6424 {
6425         /*
6426          * formulate and queue an ASCONF to the peer
6427          * ASCONF parameters should be queued on the assoc queue
6428          */
6429         struct sctp_tmit_chunk *chk;
6430         struct mbuf *m_asconf;
6431         struct sctp_asconf_chunk *acp;
6432
6433
6434         /* compose an ASCONF chunk, maximum length is PMTU */
6435         m_asconf = sctp_compose_asconf(stcb);
6436         if (m_asconf == NULL) {
6437                 return (-1);
6438         }
6439         acp = mtod(m_asconf, struct sctp_asconf_chunk *);
6440         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6441         if (chk == NULL) {
6442                 /* no memory */
6443                 sctp_m_freem(m_asconf);
6444                 return (-1);
6445         }
6446         sctppcbinfo.ipi_count_chunk++;
6447         sctppcbinfo.ipi_gencnt_chunk++;
6448
6449         chk->data = m_asconf;
6450         chk->send_size = m_asconf->m_pkthdr.len;
6451         chk->rec.chunk_id = SCTP_ASCONF;
6452         chk->sent = SCTP_DATAGRAM_UNSENT;
6453         chk->snd_count = 0;
6454         chk->flags = 0;
6455         chk->asoc = &stcb->asoc;
6456         chk->whoTo = chk->asoc->primary_destination;
6457         chk->whoTo->ref_count++;
6458         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6459         chk->asoc->ctrl_queue_cnt++;
6460         return (0);
6461 }
6462
6463 int
6464 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6465 {
6466         /*
6467          * formulate and queue a asconf-ack back to sender
6468          * the asconf-ack must be stored in the tcb
6469          */
6470         struct sctp_tmit_chunk *chk;
6471         struct mbuf *m_ack;
6472
6473         /* is there a asconf-ack mbuf chain to send? */
6474         if (stcb->asoc.last_asconf_ack_sent == NULL) {
6475                 return (-1);
6476         }
6477
6478         /* copy the asconf_ack */
6479 #if defined(__FreeBSD__) || defined(__NetBSD__)
6480         /* Supposedly the m_copypacket is a optimzation,
6481          * use it if we can.
6482          */
6483         if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6484                 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, MB_DONTWAIT);
6485                 sctp_pegs[SCTP_CACHED_SRC]++;
6486         } else
6487                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6488 #else
6489                 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6490 #endif
6491         if (m_ack == NULL) {
6492                 /* couldn't copy it */
6493
6494                 return (-1);
6495         }
6496         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6497         if (chk == NULL) {
6498                 /* no memory */
6499                 if (m_ack)
6500                         sctp_m_freem(m_ack);
6501                 return (-1);
6502         }
6503         sctppcbinfo.ipi_count_chunk++;
6504         sctppcbinfo.ipi_gencnt_chunk++;
6505
6506         /* figure out where it goes to */
6507         if (retrans) {
6508                 /* we're doing a retransmission */
6509                 if (stcb->asoc.used_alt_asconfack > 2) {
6510                         /* tried alternate nets already, go back */
6511                         chk->whoTo = NULL;
6512                 } else {
6513                         /* need to try and alternate net */
6514                         chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6515                         stcb->asoc.used_alt_asconfack++;
6516                 }
6517                 if (chk->whoTo == NULL) {
6518                         /* no alternate */
6519                         if (stcb->asoc.last_control_chunk_from == NULL)
6520                                 chk->whoTo = stcb->asoc.primary_destination;
6521                         else
6522                                 chk->whoTo = stcb->asoc.last_control_chunk_from;
6523                         stcb->asoc.used_alt_asconfack = 0;
6524                 }
6525         } else {
6526                 /* normal case */
6527                 if (stcb->asoc.last_control_chunk_from == NULL)
6528                         chk->whoTo = stcb->asoc.primary_destination;
6529                 else
6530                         chk->whoTo = stcb->asoc.last_control_chunk_from;
6531                 stcb->asoc.used_alt_asconfack = 0;
6532         }
6533         chk->data = m_ack;
6534         chk->send_size = m_ack->m_pkthdr.len;
6535         chk->rec.chunk_id = SCTP_ASCONF_ACK;
6536         chk->sent = SCTP_DATAGRAM_UNSENT;
6537         chk->snd_count = 0;
6538         chk->flags = 0;
6539         chk->asoc = &stcb->asoc;
6540         chk->whoTo->ref_count++;
6541         TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6542         chk->asoc->ctrl_queue_cnt++;
6543         return (0);
6544 }
6545
6546
6547 static int
6548 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6549                           struct sctp_tcb *stcb,
6550                           struct sctp_association *asoc,
6551                           int *cnt_out, struct timeval *now, int *now_filled)
6552 {
6553         /*
6554          * send out one MTU of retransmission.
6555          * If fast_retransmit is happening we ignore the cwnd.
6556          * Otherwise we obey the cwnd and rwnd.
6557          * For a Cookie or Asconf in the control chunk queue we retransmit
6558          * them by themselves.
6559          *
6560          * For data chunks we will pick out the lowest TSN's in the
6561          * sent_queue marked for resend and bundle them all together
6562          * (up to a MTU of destination). The address to send to should
6563          * have been selected/changed where the retransmission was
6564          * marked (i.e. in FR or t3-timeout routines).
6565          */
6566         struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6567         struct sctp_tmit_chunk *chk, *fwd;
6568         struct mbuf *m;
6569         struct sctphdr *shdr;
6570         int asconf;
6571         struct sctp_nets *net;
6572         int no_fragmentflg, bundle_at, cnt_thru;
6573         unsigned int mtu;
6574         int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6575
6576         tmr_started = ctl_cnt = bundle_at =  error = 0;
6577         no_fragmentflg = 1;
6578         asconf = 0;
6579         fwd_tsn = 0;
6580         *cnt_out = 0;
6581         fwd = NULL;
6582         m = NULL;
6583 #ifdef SCTP_AUDITING_ENABLED
6584         sctp_audit_log(0xC3, 1);
6585 #endif
6586         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6587 #ifdef SCTP_DEBUG
6588                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6589                         kprintf("SCTP hits empty queue with cnt set to %d?\n",
6590                                asoc->sent_queue_retran_cnt);
6591                 }
6592 #endif
6593                 asoc->sent_queue_cnt = 0;
6594                 asoc->sent_queue_cnt_removeable = 0;
6595         }
6596         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6597                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6598                         /* we only worry about things marked for resend */
6599                         continue;
6600                 }
6601                 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6602                     (chk->rec.chunk_id == SCTP_ASCONF) ||
6603                     (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6604                     (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6605                         if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6606                                 /* For stream reset we only retran the request
6607                                  * not the response.
6608                                  */
6609                                 struct sctp_stream_reset_req *strreq;
6610                                 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6611                                 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6612                                         continue;
6613                                 }
6614                         }
6615                         ctl_cnt++;
6616                         if (chk->rec.chunk_id == SCTP_ASCONF) {
6617                                 no_fragmentflg = 1;
6618                                 asconf = 1;
6619                         }
6620                         if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6621                                 fwd_tsn = 1;
6622                                 fwd = chk;
6623                         }
6624                         m = sctp_copy_mbufchain(chk->data, m);
6625                         break;
6626                 }
6627         }
6628         one_chunk = 0;
6629         cnt_thru = 0;
6630         /* do we have control chunks to retransmit? */
6631         if (m != NULL) {
6632                 /* Start a timer no matter if we suceed or fail */
6633                 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6634                         sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6635                 } else if (chk->rec.chunk_id == SCTP_ASCONF)
6636                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6637
6638                 if (m->m_len == 0) {
6639                         /* Special case for when you get a 0 len
6640                          * mbuf at the head due to the lack
6641                          * of a MHDR at the beginning.
6642                          */
6643                         m->m_len = sizeof(struct sctphdr);
6644                 } else {
6645                         M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6646                         if (m == NULL) {
6647                                 return (ENOBUFS);
6648                         }
6649                 }
6650                 shdr = mtod(m, struct sctphdr *);
6651                 shdr->src_port = inp->sctp_lport;
6652                 shdr->dest_port = stcb->rport;
6653                 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6654                 shdr->checksum = 0;
6655                 chk->snd_count++;               /* update our count */
6656
6657                 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6658                     (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
6659                     no_fragmentflg, 0, NULL, asconf))) {
6660                         sctp_pegs[SCTP_DATA_OUT_ERR]++;
6661                         return (error);
6662                 }
6663                 /*
6664                  *We don't want to mark the net->sent time here since this
6665                  * we use this for HB and retrans cannot measure RTT
6666                  */
6667                 /*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6668                 *cnt_out += 1;
6669                 chk->sent = SCTP_DATAGRAM_SENT;
6670                 asoc->sent_queue_retran_cnt--;
6671                 if (asoc->sent_queue_retran_cnt < 0) {
6672                     asoc->sent_queue_retran_cnt = 0;
6673                 }
6674                 if (fwd_tsn == 0) {
6675                         return (0);
6676                 } else {
6677                         /* Clean up the fwd-tsn list */
6678                         sctp_clean_up_ctl (asoc);
6679                         return (0);
6680                 }
6681         }
6682         /* Ok, it is just data retransmission we need to do or
6683          * that and a fwd-tsn with it all.
6684          */
6685         if (TAILQ_EMPTY(&asoc->sent_queue)) {
6686                 return (-1);
6687         }
6688 #ifdef SCTP_DEBUG
6689         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6690                 kprintf("Normal chunk retransmission cnt:%d\n",
6691                        asoc->sent_queue_retran_cnt);
6692         }
6693 #endif
6694         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6695             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6696                 /* not yet open, resend the cookie and that is it */
6697                 return (1);
6698         }
6699
6700
6701 #ifdef SCTP_AUDITING_ENABLED
6702         sctp_auditing(20, inp, stcb, NULL);
6703 #endif
6704         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6705                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6706                         /* No, not sent to this net or not ready for rtx */
6707                         continue;
6708
6709                 }
6710                 /* pick up the net */
6711                 net = chk->whoTo;
6712                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6713                         mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6714                 } else {
6715                         mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6716                 }
6717
6718                 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6719                         /* No room in peers rwnd */
6720                         uint32_t tsn;
6721                         tsn = asoc->last_acked_seq + 1;
6722                         if (tsn == chk->rec.data.TSN_seq) {
6723                                 /* we make a special exception for this case.
6724                                  * The peer has no rwnd but is missing the
6725                                  * lowest chunk.. which is probably what is
6726                                  * holding up the rwnd.
6727                                  */
6728                                 goto one_chunk_around;
6729                         }
6730 #ifdef SCTP_DEBUG
6731                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6732                                 kprintf("blocked-peers_rwnd:%d tf:%d\n",
6733                                        (int)asoc->peers_rwnd,
6734                                        (int)asoc->total_flight);
6735                         }
6736 #endif
6737                         sctp_pegs[SCTP_RWND_BLOCKED]++;
6738                         return (1);
6739                 }
6740         one_chunk_around:
6741                 if (asoc->peers_rwnd < mtu) {
6742                         one_chunk = 1;
6743                 }
6744 #ifdef SCTP_AUDITING_ENABLED
6745                 sctp_audit_log(0xC3, 2);
6746 #endif
6747                 bundle_at = 0;
6748                 m = NULL;
6749                 net->fast_retran_ip = 0;
6750                 if (chk->rec.data.doing_fast_retransmit == 0) {
6751                         /* if no FR in progress skip destination that
6752                          * have flight_size > cwnd.
6753                          */
6754                         if (net->flight_size >= net->cwnd) {
6755                                 sctp_pegs[SCTP_CWND_BLOCKED]++;
6756                                 continue;
6757                         }
6758                 } else {
6759                         /* Mark the destination net to have FR recovery
6760                          * limits put on it.
6761                          */
6762                         net->fast_retran_ip = 1;
6763                 }
6764
6765                 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6766                         /* ok we will add this one */
6767                         m = sctp_copy_mbufchain(chk->data, m);
6768                         if (m == NULL) {
6769                                 return (ENOMEM);
6770                         }
6771                         /* upate our MTU size */
6772                         /* Do clear IP_DF ? */
6773                         if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6774                                 no_fragmentflg = 0;
6775                         }
6776                         mtu -= chk->send_size;
6777                         data_list[bundle_at++] = chk;
6778                         if (one_chunk && (asoc->total_flight <= 0)) {
6779                                 sctp_pegs[SCTP_WINDOW_PROBES]++;
6780                                 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6781                         }
6782                 }
6783                 if (one_chunk == 0) {
6784                         /* now are there anymore forward from chk to pick up?*/
6785                         fwd = TAILQ_NEXT(chk, sctp_next);
6786                         while (fwd) {
6787                                 if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6788                                         /* Nope, not for retran */
6789                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6790                                         continue;
6791                                 }
6792                                 if (fwd->whoTo != net) {
6793                                         /* Nope, not the net in question */
6794                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6795                                         continue;
6796                                 }
6797                                 if (fwd->send_size <= mtu) {
6798                                         m = sctp_copy_mbufchain(fwd->data, m);
6799                                         if (m == NULL) {
6800                                                 return (ENOMEM);
6801                                         }
6802                                         /* upate our MTU size */
6803                                         /* Do clear IP_DF ? */
6804                                         if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6805                                                 no_fragmentflg = 0;
6806                                         }
6807                                         mtu -= fwd->send_size;
6808                                         data_list[bundle_at++] = fwd;
6809                                         if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6810                                                 break;
6811                                         }
6812                                         fwd = TAILQ_NEXT(fwd, sctp_next);
6813                                 } else {
6814                                         /* can't fit so we are done */
6815                                         break;
6816                                 }
6817                         }
6818                 }
6819                 /* Is there something to send for this destination? */
6820                 if (m) {
6821                         /* No matter if we fail/or suceed we should
6822                          * start a timer. A failure is like a lost
6823                          * IP packet :-)
6824                          */
6825                         if (!callout_pending(&net->rxt_timer.timer)) {
6826                                 /* no timer running on this destination
6827                                  * restart it.
6828                                  */
6829                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6830                                 tmr_started = 1;
6831                         }
6832                         if (m->m_len == 0) {
6833                                 /* Special case for when you get a 0 len
6834                                  * mbuf at the head due to the lack
6835                                  * of a MHDR at the beginning.
6836                                  */
6837                                 m->m_len = sizeof(struct sctphdr);
6838                         } else {
6839                                 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6840                                 if (m == NULL) {
6841                                         return (ENOBUFS);
6842                                 }
6843                         }
6844                         shdr = mtod(m, struct sctphdr *);
6845                         shdr->src_port = inp->sctp_lport;
6846                         shdr->dest_port = stcb->rport;
6847                         shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6848                         shdr->checksum = 0;
6849
6850                         /* Now lets send it, if there is anything to send :> */
6851                         if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6852                                                                (struct sockaddr *)&net->ro._l_addr,
6853                                                                m,
6854                                                                no_fragmentflg, 0, NULL, asconf))) {
6855                                 /* error, we could not output */
6856                                 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6857                                 return (error);
6858                         }
6859                         /* For HB's */
6860                         /*
6861                          * We don't want to mark the net->sent time here since
6862                          * this we use this for HB and retrans cannot measure
6863                          * RTT
6864                          */
6865                         /*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6866
6867                         /* For auto-close */
6868                         cnt_thru++;
6869                         if (*now_filled == 0) {
6870                                 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6871                                 *now = asoc->time_last_sent;
6872                                 *now_filled = 1;
6873                         } else {
6874                                 asoc->time_last_sent = *now;
6875                         }
6876                         *cnt_out += bundle_at;
6877 #ifdef SCTP_AUDITING_ENABLED
6878                         sctp_audit_log(0xC4, bundle_at);
6879 #endif
6880                         for (i = 0; i < bundle_at; i++) {
6881                                 sctp_pegs[SCTP_RETRANTSN_SENT]++;
6882                                 data_list[i]->sent = SCTP_DATAGRAM_SENT;
6883                                 data_list[i]->snd_count++;
6884                                 asoc->sent_queue_retran_cnt--;
6885                                 /* record the time */
6886                                 data_list[i]->sent_rcv_time = asoc->time_last_sent;
6887                                 if (asoc->sent_queue_retran_cnt < 0) {
6888                                     asoc->sent_queue_retran_cnt = 0;
6889                                 }
6890                                 net->flight_size += data_list[i]->book_size;
6891                                 asoc->total_flight += data_list[i]->book_size;
6892                                 asoc->total_flight_count++;
6893
6894 #ifdef SCTP_LOG_RWND
6895                                 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6896                                               asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6897 #endif
6898                                 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6899                                                                     (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6900                                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6901                                         /* SWS sender side engages */
6902                                         asoc->peers_rwnd = 0;
6903                                 }
6904
6905                                 if ((i == 0) &&
6906                                     (data_list[i]->rec.data.doing_fast_retransmit)) {
6907                                         sctp_pegs[SCTP_FAST_RETRAN]++;
6908                                         if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6909                                             (tmr_started == 0)) {
6910                                                 /*
6911                                                  * ok we just fast-retrans'd
6912                                                  * the lowest TSN, i.e the
6913                                                  * first on the list. In this
6914                                                  * case we want to give some
6915                                                  * more time to get a SACK
6916                                                  * back without a t3-expiring.
6917                                                  */
6918                                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6919                                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6920                                         }
6921                                 }
6922                         }
6923 #ifdef SCTP_AUDITING_ENABLED
6924                         sctp_auditing(21, inp, stcb, NULL);
6925 #endif
6926                 } else {
6927                         /* None will fit */
6928                         return (1);
6929                 }
6930                 if (asoc->sent_queue_retran_cnt <= 0) {
6931                         /* all done we have no more to retran */
6932                         asoc->sent_queue_retran_cnt = 0;
6933                         break;
6934                 }
6935                 if (one_chunk) {
6936                         /* No more room in rwnd */
6937                         return (1);
6938                 }
6939                 /* stop the for loop here. we sent out a packet */
6940                 break;
6941         }
6942         return (0);
6943 }
6944
6945
6946 static int
6947 sctp_timer_validation(struct sctp_inpcb *inp,
6948                       struct sctp_tcb *stcb,
6949                       struct sctp_association *asoc,
6950                       int ret)
6951 {
6952         struct sctp_nets *net;
6953         /* Validate that a timer is running somewhere */
6954         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6955                 if (callout_pending(&net->rxt_timer.timer)) {
6956                         /* Here is a timer */
6957                         return (ret);
6958                 }
6959         }
6960         /* Gak, we did not have a timer somewhere */
6961 #ifdef SCTP_DEBUG
6962         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6963                 kprintf("Deadlock avoided starting timer on a dest at retran\n");
6964         }
6965 #endif
6966         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
6967         return (ret);
6968 }
6969
6970 int
6971 sctp_chunk_output(struct sctp_inpcb *inp,
6972                   struct sctp_tcb *stcb,
6973                   int from_where)
6974 {
6975         /* Ok this is the generic chunk service queue.
6976          * we must do the following:
6977          *  - See if there are retransmits pending, if so we
6978          *      must do these first and return.
6979          *  - Service the stream queue that is next,
6980          *    moving any message (note I must get a complete
6981          *    message i.e. FIRST/MIDDLE and LAST to the out
6982          *    queue in one pass) and assigning TSN's
6983          *  - Check to see if the cwnd/rwnd allows any output, if
6984          *      so we go ahead and fomulate and send the low level
6985          *    chunks. Making sure to combine any control in the
6986          *    control chunk queue also.
6987          */
6988         struct sctp_association *asoc;
6989         struct sctp_nets *net;
6990         int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
6991         struct timeval now;
6992         int now_filled=0;
6993         int cwnd_full=0;
6994         asoc = &stcb->asoc;
6995         tot_out = 0;
6996         num_out = 0;
6997         reason_code = 0;
6998         sctp_pegs[SCTP_CALLS_TO_CO]++;
6999 #ifdef SCTP_DEBUG
7000         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7001                 kprintf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
7002         }
7003 #endif
7004         while (asoc->sent_queue_retran_cnt) {
7005                 /* Ok, it is retransmission time only, we send out only ONE
7006                  * packet with a single call off to the retran code.
7007                  */
7008                 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
7009                 if (ret > 0) {
7010                         /* Can't send anymore */
7011 #ifdef SCTP_DEBUG
7012                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7013                                 kprintf("retransmission ret:%d -- full\n", ret);
7014                         }
7015 #endif
7016                         /*
7017                          * now lets push out control by calling med-level
7018                          * output once. this assures that we WILL send HB's
7019                          * if queued too.
7020                          */
7021                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
7022                                               &cwnd_full, from_where,
7023                                               &now, &now_filled);
7024 #ifdef SCTP_DEBUG
7025                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7026                                 kprintf("Control send outputs:%d@full\n", num_out);
7027                         }
7028 #endif
7029 #ifdef SCTP_AUDITING_ENABLED
7030                         sctp_auditing(8, inp, stcb, NULL);
7031 #endif
7032                         return (sctp_timer_validation(inp, stcb, asoc, ret));
7033                 }
7034                 if (ret < 0) {
7035                         /*
7036                          * The count was off.. retran is not happening so do
7037                          * the normal retransmission.
7038                          */
7039 #ifdef SCTP_DEBUG
7040                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7041                                 kprintf("Done with retrans, none left fill up window\n");
7042                         }
7043 #endif
7044 #ifdef SCTP_AUDITING_ENABLED
7045                         sctp_auditing(9, inp, stcb, NULL);
7046 #endif
7047                         break;
7048                 }
7049                 if (from_where == 1) {
7050                         /* Only one transmission allowed out of a timeout */
7051 #ifdef SCTP_DEBUG
7052                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7053                                 kprintf("Only one packet allowed out\n");
7054                         }
7055 #endif
7056 #ifdef SCTP_AUDITING_ENABLED
7057                         sctp_auditing(10, inp, stcb, NULL);
7058 #endif
7059                         /* Push out any control */
7060                         sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
7061                                               &now, &now_filled);
7062                         return (ret);
7063                 }
7064                 if ((num_out == 0) && (ret == 0)) {
7065                         /* No more retrans to send */
7066                         break;
7067                 }
7068         }
7069 #ifdef SCTP_AUDITING_ENABLED
7070         sctp_auditing(12, inp, stcb, NULL);
7071 #endif
7072         /* Check for bad destinations, if they exist move chunks around. */
7073         burst_limit = asoc->max_burst;
7074         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7075                 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
7076                     SCTP_ADDR_NOT_REACHABLE) {
7077                         /*
7078                          * if possible move things off of this address
7079                          * we still may send below due to the dormant state
7080                          * but we try to find an alternate address to send
7081                          * to and if we have one we move all queued data on
7082                          * the out wheel to this alternate address.
7083                          */
7084                         sctp_move_to_an_alt(stcb, asoc, net);
7085                 } else {
7086                         /*
7087                         if ((asoc->sat_network) || (net->addr_is_local)) {
7088                                 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7089                         }
7090                         */
7091 #ifdef SCTP_DEBUG
7092                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7093                                 kprintf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7094                         }
7095 #endif
7096
7097 #ifdef SCTP_USE_ALLMAN_BURST
7098                         if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7099                                 if (net->ssthresh < net->cwnd)
7100                                         net->ssthresh = net->cwnd;
7101                                 net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7102 #ifdef SCTP_LOG_MAXBURST
7103                                 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7104 #endif
7105                                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7106                         }
7107                         net->fast_retran_ip = 0;
7108 #endif
7109                 }
7110
7111         }
7112         /* Fill up what we can to the destination */
7113         burst_cnt = 0;
7114         cwnd_full = 0;
7115         do {
7116 #ifdef SCTP_DEBUG
7117                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7118                         kprintf("Burst count:%d - call m-c-o\n", burst_cnt);
7119                 }
7120 #endif
7121                 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7122                                               &reason_code, 0,  &cwnd_full, from_where,
7123                                               &now, &now_filled);
7124                 if (error) {
7125 #ifdef SCTP_DEBUG
7126                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7127                                 kprintf("Error %d was returned from med-c-op\n", error);
7128                         }
7129 #endif
7130 #ifdef SCTP_LOG_MAXBURST
7131                         sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7132 #endif
7133                         break;
7134                 }
7135 #ifdef SCTP_DEBUG
7136                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7137                         kprintf("m-c-o put out %d\n", num_out);
7138                 }
7139 #endif
7140                 tot_out += num_out;
7141                 burst_cnt++;
7142         } while (num_out
7143 #ifndef SCTP_USE_ALLMAN_BURST
7144                  &&  (burst_cnt < burst_limit)
7145 #endif
7146                 );
7147 #ifndef SCTP_USE_ALLMAN_BURST
7148         if (burst_cnt >= burst_limit) {
7149                 sctp_pegs[SCTP_MAX_BURST_APL]++;
7150                 asoc->burst_limit_applied = 1;
7151 #ifdef SCTP_LOG_MAXBURST
7152                 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7153 #endif
7154         } else {
7155                 asoc->burst_limit_applied = 0;
7156         }
7157 #endif
7158
7159 #ifdef SCTP_DEBUG
7160         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7161                 kprintf("Ok, we have put out %d chunks\n", tot_out);
7162         }
7163 #endif
7164         if (tot_out == 0) {
7165                 sctp_pegs[SCTP_CO_NODATASNT]++;
7166                 if (asoc->stream_queue_cnt > 0) {
7167                         sctp_pegs[SCTP_SOS_NOSNT]++;
7168                 } else {
7169                         sctp_pegs[SCTP_NOS_NOSNT]++;
7170                 }
7171                 if (asoc->send_queue_cnt > 0) {
7172                         sctp_pegs[SCTP_SOSE_NOSNT]++;
7173                 } else {
7174                         sctp_pegs[SCTP_NOSE_NOSNT]++;
7175                 }
7176         }
7177         /* Now we need to clean up the control chunk chain if
7178          * a ECNE is on it. It must be marked as UNSENT again
7179          * so next call will continue to send it until
7180          * such time that we get a CWR, to remove it.
7181          */
7182         sctp_fix_ecn_echo(asoc);
7183         return (error);
7184 }
7185
7186
7187 int
7188 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, struct sockaddr *addr,
7189             struct mbuf *control, struct thread *p, int flags)
7190 {
7191         struct inpcb *ip_inp;
7192         struct sctp_inpcb *t_inp;
7193         struct sctp_tcb *stcb;
7194         struct sctp_nets *net;
7195         struct sctp_association *asoc;
7196         int create_lock_applied = 0;
7197         int queue_only, error = 0;
7198         struct sctp_sndrcvinfo srcv;
7199         int un_sent = 0;
7200         int use_rcvinfo = 0;
7201         t_inp = inp;
7202         /*  struct route ro;*/
7203
7204         crit_enter();
7205         queue_only = 0;
7206         ip_inp = (struct inpcb *)inp;
7207         stcb = NULL;
7208         asoc = NULL;
7209         net = NULL;
7210
7211 #ifdef SCTP_DEBUG
7212         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7213                 kprintf("USR Send BEGINS\n");
7214         }
7215 #endif
7216
7217         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7218             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7219                 /* The listner can NOT send */
7220                 if (control) {
7221                         sctppcbinfo.mbuf_track--;
7222                         sctp_m_freem(control);
7223                         control = NULL;
7224                 }
7225                 sctp_m_freem(m);
7226                 crit_exit();
7227                 return (EFAULT);
7228         }
7229         /* Can't allow a V6 address on a non-v6 socket */
7230         if (addr) {
7231                 SCTP_ASOC_CREATE_LOCK(inp);
7232                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7233                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7234                         /* Should I really unlock ? */
7235                         SCTP_ASOC_CREATE_UNLOCK(inp);
7236                         if (control) {
7237                                 sctppcbinfo.mbuf_track--;
7238                                 sctp_m_freem(control);
7239                                 control = NULL;
7240                         }
7241                         sctp_m_freem(m);
7242                         crit_exit();
7243                         return (EFAULT);
7244                 }
7245                 create_lock_applied = 1;
7246                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7247                     (addr->sa_family == AF_INET6)) {
7248                         SCTP_ASOC_CREATE_UNLOCK(inp);
7249                         if (control) {
7250                                 sctppcbinfo.mbuf_track--;
7251                                 sctp_m_freem(control);
7252                                 control = NULL;
7253                         }
7254                         sctp_m_freem(m);
7255                         crit_exit();
7256                         return (EINVAL);
7257                 }
7258         }
7259         if (control) {
7260                 sctppcbinfo.mbuf_track++;
7261                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
7262                                    sizeof(srcv))) {
7263                         if (srcv.sinfo_flags & MSG_SENDALL) {
7264                                 /* its a sendall */
7265                                 sctppcbinfo.mbuf_track--;
7266                                 sctp_m_freem(control);
7267                                 crit_exit();
7268                                 if (create_lock_applied) {
7269                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7270                                         create_lock_applied = 0;
7271                                 }
7272                                 return (sctp_sendall(inp, NULL, m, &srcv));
7273                         }
7274                         if (srcv.sinfo_assoc_id) {
7275                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7276                                         SCTP_INP_RLOCK(inp);
7277                                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7278                                         if (stcb)
7279                                                 SCTP_TCB_LOCK(stcb);
7280                                         SCTP_INP_RUNLOCK(inp);
7281
7282                                         if (stcb == NULL) {
7283                                                 if (create_lock_applied) {
7284                                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7285                                                         create_lock_applied = 0;
7286                                                 }
7287                                                 sctppcbinfo.mbuf_track--;
7288                                                 sctp_m_freem(control);
7289                                                 sctp_m_freem(m);
7290                                                 crit_exit();
7291                                                 return (ENOTCONN);
7292                                         }
7293                                         net = stcb->asoc.primary_destination;
7294                                 } else {
7295                                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7296                                 }
7297                                 /*
7298                                  * Question: Should I error here if the
7299
7300                                  * assoc_id is no longer valid?
7301                                  * i.e. I can't find it?
7302                                  */
7303                                 if ((stcb) &&
7304                                     (addr != NULL)) {
7305                                         /* Must locate the net structure */
7306                                         if (addr)
7307                                                 net = sctp_findnet(stcb, addr);
7308                                 }
7309                                 if (net == NULL)
7310                                         net = stcb->asoc.primary_destination;
7311                         }
7312                         use_rcvinfo = 1;
7313                 }
7314         }
7315         if (stcb == NULL) {
7316                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7317                         SCTP_INP_RLOCK(inp);
7318                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
7319                         if (stcb)
7320                                 SCTP_TCB_LOCK(stcb);
7321                         SCTP_INP_RUNLOCK(inp);
7322                         if (stcb == NULL) {
7323                                 crit_exit();
7324                                 if (create_lock_applied) {
7325                                         SCTP_ASOC_CREATE_UNLOCK(inp);
7326                                         create_lock_applied = 0;
7327                                 }
7328                                 if (control) {
7329                                         sctppcbinfo.mbuf_track--;
7330                                         sctp_m_freem(control);
7331                                         control = NULL;
7332                                 }
7333                                 sctp_m_freem(m);
7334                                 return (ENOTCONN);
7335                         }
7336                         if (addr == NULL) {
7337                                 net = stcb->asoc.primary_destination;
7338                         } else {
7339                                 net = sctp_findnet(stcb, addr);
7340                                 if (net == NULL) {
7341                                         net = stcb->asoc.primary_destination;
7342                                 }
7343                         }
7344                 } else {
7345                         if (addr != NULL) {
7346                                 SCTP_INP_WLOCK(inp);
7347                                 SCTP_INP_INCR_REF(inp);
7348                                 SCTP_INP_WUNLOCK(inp);
7349                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7350                                 if (stcb == NULL) {
7351                                         SCTP_INP_WLOCK(inp);
7352                                         SCTP_INP_DECR_REF(inp);
7353                                         SCTP_INP_WUNLOCK(inp);
7354                                 }
7355                         }
7356                 }
7357         }
7358         if ((stcb == NULL) &&
7359             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7360                 if (control) {
7361                         sctppcbinfo.mbuf_track--;
7362                         sctp_m_freem(control);
7363                         control = NULL;
7364                 }
7365                 if (create_lock_applied) {
7366                         SCTP_ASOC_CREATE_UNLOCK(inp);
7367                         create_lock_applied = 0;
7368                 }
7369                 sctp_m_freem(m);
7370                 crit_exit();
7371                 return (ENOTCONN);
7372         } else if ((stcb == NULL) &&
7373                    (addr == NULL)) {
7374                 if (control) {
7375                         sctppcbinfo.mbuf_track--;
7376                         sctp_m_freem(control);
7377                         control = NULL;
7378                 }
7379                 if (create_lock_applied) {
7380                         SCTP_ASOC_CREATE_UNLOCK(inp);
7381                         create_lock_applied = 0;
7382                 }
7383                 sctp_m_freem(m);
7384                 crit_exit();
7385                 return (ENOENT);
7386         } else if (stcb == NULL) {
7387                 /* UDP mode, we must go ahead and start the INIT process */
7388                 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7389                         /* Strange user to do this */
7390                         if (control) {
7391                                 sctppcbinfo.mbuf_track--;
7392                                 sctp_m_freem(control);
7393                                 control = NULL;
7394                         }
7395                         if (create_lock_applied) {
7396                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7397                                 create_lock_applied = 0;
7398                         }
7399                         sctp_m_freem(m);
7400                         crit_exit();
7401                         return (ENOENT);
7402                 }
7403                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7404                 if (stcb == NULL) {
7405                         if (control) {
7406                                 sctppcbinfo.mbuf_track--;
7407                                 sctp_m_freem(control);
7408                                 control = NULL;
7409                         }
7410                         if (create_lock_applied) {
7411                                 SCTP_ASOC_CREATE_UNLOCK(inp);
7412                                 create_lock_applied = 0;
7413                         }
7414                         sctp_m_freem(m);
7415                         crit_exit();
7416                         return (error);
7417                 }
7418                 if (create_lock_applied) {
7419                         SCTP_ASOC_CREATE_UNLOCK(inp);
7420                         create_lock_applied = 0;
7421                 } else {
7422                         kprintf("Huh-1, create lock should have been applied!\n");
7423                 }
7424                 queue_only = 1;
7425                 asoc = &stcb->asoc;
7426                 asoc->state = SCTP_STATE_COOKIE_WAIT;
7427                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7428                 if (control) {
7429                         /* see if a init structure exists in cmsg headers */
7430                         struct sctp_initmsg initm;
7431                         int i;
7432                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
7433                                            sizeof(initm))) {
7434                                 /* we have an INIT override of the default */
7435                                 if (initm.sinit_max_attempts)
7436                                         asoc->max_init_times = initm.sinit_max_attempts;
7437                                 if (initm.sinit_num_ostreams)
7438                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
7439                                 if (initm.sinit_max_instreams)
7440                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
7441                                 if (initm.sinit_max_init_timeo)
7442                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7443                         }
7444                         if (asoc->streamoutcnt < asoc->pre_open_streams) {
7445                                 /* Default is NOT correct */
7446 #ifdef SCTP_DEBUG
7447                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7448                                         kprintf("Ok, defout:%d pre_open:%d\n",
7449                                                asoc->streamoutcnt, asoc->pre_open_streams);
7450                                 }
7451 #endif
7452                                 FREE(asoc->strmout, M_PCB);
7453                                 asoc->strmout = NULL;
7454                                 asoc->streamoutcnt = asoc->pre_open_streams;
7455                                 MALLOC(asoc->strmout, struct sctp_stream_out *,
7456                                        asoc->streamoutcnt *
7457                                        sizeof(struct sctp_stream_out), M_PCB,
7458                                        MB_WAIT);
7459                                 for (i = 0; i < asoc->streamoutcnt; i++) {
7460                                         /*
7461                                          * inbound side must be set to 0xffff,
7462                                          * also NOTE when we get the INIT-ACK
7463                                          * back (for INIT sender) we MUST
7464                                          * reduce the count (streamoutcnt) but
7465                                          * first check if we sent to any of the
7466                                          * upper streams that were dropped (if
7467                                          * some were). Those that were dropped
7468                                          * must be notified to the upper layer
7469                                          * as failed to send.
7470                                          */
7471                                         asoc->strmout[i].next_sequence_sent = 0x0;
7472                                         TAILQ_INIT(&asoc->strmout[i].outqueue);
7473                                         asoc->strmout[i].stream_no = i;
7474                                         asoc->strmout[i].next_spoke.tqe_next = 0;
7475                                         asoc->strmout[i].next_spoke.tqe_prev = 0;
7476                                 }
7477                         }
7478                 }
7479                 sctp_send_initiate(inp, stcb);
7480                 /*
7481                  * we may want to dig in after this call and adjust the MTU
7482                  * value. It defaulted to 1500 (constant) but the ro structure
7483                  * may now have an update and thus we may need to change it
7484                  * BEFORE we append the message.
7485                  */
7486                 net = stcb->asoc.primary_destination;
7487         } else {
7488                 if (create_lock_applied) {
7489                         SCTP_ASOC_CREATE_UNLOCK(inp);
7490                         create_lock_applied = 0;
7491                 }
7492                 asoc = &stcb->asoc;
7493                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7494                     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7495                         queue_only = 1;
7496                 }
7497                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7498                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7499                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7500                     (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7501                         if (control) {
7502                                 sctppcbinfo.mbuf_track--;
7503                                 sctp_m_freem(control);
7504                                 control = NULL;
7505                         }
7506                         if ((use_rcvinfo) &&
7507                             (srcv.sinfo_flags & MSG_ABORT)) {
7508                                 sctp_msg_append(stcb, net, m, &srcv, flags);
7509                                 error = 0;
7510                         } else {
7511                                 if (m)
7512                                         sctp_m_freem(m);
7513                                 error = ECONNRESET;
7514                         }
7515                         crit_exit();
7516                         SCTP_TCB_UNLOCK(stcb);
7517                         return (error);
7518                 }
7519         }
7520         if (create_lock_applied) {
7521                 /* we should never hit here with the create lock applied
7522                  *
7523                  */
7524                 SCTP_ASOC_CREATE_UNLOCK(inp);
7525                 create_lock_applied = 0;
7526         }
7527
7528
7529         if (use_rcvinfo == 0) {
7530                 srcv = stcb->asoc.def_send;
7531         }
7532 #ifdef SCTP_DEBUG
7533         else {
7534                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7535                         kprintf("stream:%d\n", srcv.sinfo_stream);
7536                         kprintf("flags:%x\n", (u_int)srcv.sinfo_flags);
7537                         kprintf("ppid:%d\n", srcv.sinfo_ppid);
7538                         kprintf("context:%d\n", srcv.sinfo_context);
7539                 }
7540         }
7541 #endif
7542         if (control) {
7543                 sctppcbinfo.mbuf_track--;
7544                 sctp_m_freem(control);
7545                 control = NULL;
7546         }
7547         if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7548                 /* we take the override or the unconfirmed */
7549                 ;
7550         } else {
7551                 net = stcb->asoc.primary_destination;
7552         }
7553         if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7554                 SCTP_TCB_UNLOCK(stcb);
7555                 crit_exit();
7556                 return (error);
7557         }
7558         if (net->flight_size > net->cwnd) {
7559                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7560                 queue_only = 1;
7561         } else if (asoc->ifp_had_enobuf) {
7562                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7563                 queue_only = 1;
7564         } else {
7565                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7566                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7567                            SCTP_MED_OVERHEAD);
7568
7569                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7570                     (stcb->asoc.total_flight > 0) &&
7571                     (un_sent < (int)stcb->asoc.smallest_mtu)
7572                         ) {
7573
7574                         /* Ok, Nagle is set on and we have
7575                          * data outstanding. Don't send anything
7576                          * and let the SACK drive out the data.
7577                          */
7578                         sctp_pegs[SCTP_NAGLE_NOQ]++;
7579                         queue_only = 1;
7580                 } else {
7581                         sctp_pegs[SCTP_NAGLE_OFF]++;
7582                 }
7583         }
7584         if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7585                 /* we can attempt to send too.*/
7586 #ifdef SCTP_DEBUG
7587                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7588                         kprintf("USR Send calls sctp_chunk_output\n");
7589                 }
7590 #endif
7591 #ifdef SCTP_AUDITING_ENABLED
7592                 sctp_audit_log(0xC0, 1);
7593                 sctp_auditing(6, inp, stcb, net);
7594 #endif
7595                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7596                 sctp_chunk_output(inp, stcb, 0);
7597 #ifdef SCTP_AUDITING_ENABLED
7598                 sctp_audit_log(0xC0, 2);
7599                 sctp_auditing(7, inp, stcb, net);
7600 #endif
7601
7602         }
7603 #ifdef SCTP_DEBUG
7604         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7605                 kprintf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7606         }
7607 #endif
7608         SCTP_TCB_UNLOCK(stcb);
7609         crit_exit();
7610         return (0);
7611 }
7612
7613 void
7614 send_forward_tsn(struct sctp_tcb *stcb,
7615                  struct sctp_association *asoc)
7616 {
7617         struct sctp_tmit_chunk *chk;
7618         struct sctp_forward_tsn_chunk *fwdtsn;
7619
7620         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7621                 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7622                         /* mark it to unsent */
7623                         chk->sent = SCTP_DATAGRAM_UNSENT;
7624                         chk->snd_count = 0;
7625                         /* Do we correct its output location? */
7626                         if (chk->whoTo != asoc->primary_destination) {
7627                                 sctp_free_remote_addr(chk->whoTo);
7628                                 chk->whoTo = asoc->primary_destination;
7629                                 chk->whoTo->ref_count++;
7630                         }
7631                         goto sctp_fill_in_rest;
7632                 }
7633         }
7634         /* Ok if we reach here we must build one */
7635         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7636         if (chk == NULL) {
7637                 return;
7638         }
7639         sctppcbinfo.ipi_count_chunk++;
7640         sctppcbinfo.ipi_gencnt_chunk++;
7641         chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7642         chk->asoc = asoc;
7643         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
7644         if (chk->data == NULL) {
7645                 chk->whoTo->ref_count--;
7646                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7647                 sctppcbinfo.ipi_count_chunk--;
7648                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7649                         panic("Chunk count is negative");
7650                 }
7651                 sctppcbinfo.ipi_gencnt_chunk++;
7652                 return;
7653         }
7654         chk->data->m_data += SCTP_MIN_OVERHEAD;
7655         chk->sent = SCTP_DATAGRAM_UNSENT;
7656         chk->snd_count = 0;
7657         chk->whoTo = asoc->primary_destination;
7658         chk->whoTo->ref_count++;
7659         TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7660         asoc->ctrl_queue_cnt++;
7661  sctp_fill_in_rest:
7662         /* Here we go through and fill out the part that
7663          * deals with stream/seq of the ones we skip.
7664          */
7665         chk->data->m_pkthdr.len = chk->data->m_len = 0;
7666         {
7667                 struct sctp_tmit_chunk *at, *tp1, *last;
7668                 struct sctp_strseq *strseq;
7669                 unsigned int cnt_of_space, i, ovh;
7670                 unsigned int space_needed;
7671                 unsigned int cnt_of_skipped = 0;
7672                 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7673                         if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7674                                 /* no more to look at */
7675                                 break;
7676                         }
7677                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7678                                 /* We don't report these */
7679                                 continue;
7680                         }
7681                         cnt_of_skipped++;
7682                 }
7683                 space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7684                                 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7685                 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7686                     ((chk->data->m_flags & M_EXT) == 0)) {
7687                         /* Need a M_EXT, get one and move
7688                          * fwdtsn to data area.
7689                          */
7690                         MCLGET(chk->data, MB_DONTWAIT);
7691                 }
7692                 cnt_of_space = M_TRAILINGSPACE(chk->data);
7693
7694                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7695                         ovh = SCTP_MIN_OVERHEAD;
7696                 } else {
7697                         ovh = SCTP_MIN_V4_OVERHEAD;
7698                 }
7699                 if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7700                         /* trim to a mtu size */
7701                         cnt_of_space = asoc->smallest_mtu - ovh;
7702                 }
7703                 if (cnt_of_space < space_needed) {
7704                         /* ok we must trim down the chunk by lowering
7705                          * the advance peer ack point.
7706                          */
7707                         cnt_of_skipped = (cnt_of_space-
7708                                           ((sizeof(struct sctp_forward_tsn_chunk))/
7709                                             sizeof(struct sctp_strseq)));
7710                         /* Go through and find the TSN that
7711                          * will be the one we report.
7712                          */
7713                         at = TAILQ_FIRST(&asoc->sent_queue);
7714                         for (i = 0; i < cnt_of_skipped; i++) {
7715                                 tp1 = TAILQ_NEXT(at, sctp_next);
7716                                 at = tp1;
7717                         }
7718                         last = at;
7719                         /* last now points to last one I can report, update peer ack point */
7720                         asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7721                         space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7722                 }
7723                 chk->send_size = space_needed;
7724                 /* Setup the chunk */
7725                 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7726                 fwdtsn->ch.chunk_length = htons(chk->send_size);
7727                 fwdtsn->ch.chunk_flags = 0;
7728                 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7729                 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7730                 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7731                                   (cnt_of_skipped * sizeof(struct sctp_strseq)));
7732                 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7733                 fwdtsn++;
7734                 /* Move pointer to after the fwdtsn and transfer to
7735                  * the strseq pointer.
7736                  */
7737                 strseq = (struct sctp_strseq *)fwdtsn;
7738                 /*
7739                  * Now populate the strseq list. This is done blindly
7740                  * without pulling out duplicate stream info. This is
7741                  * inefficent but won't harm the process since the peer
7742                  * will look at these in sequence and will thus release
7743                  * anything. It could mean we exceed the PMTU and chop
7744                  * off some that we could have included.. but this is
7745                  * unlikely (aka 1432/4 would mean 300+ stream seq's would
7746                  * have to be reported in one FWD-TSN. With a bit of work
7747                  * we can later FIX this to optimize and pull out duplcates..
7748                  * but it does add more overhead. So for now... not!
7749                  */
7750                 at = TAILQ_FIRST(&asoc->sent_queue);
7751                 for (i = 0; i < cnt_of_skipped; i++) {
7752                         tp1 = TAILQ_NEXT(at, sctp_next);
7753                         if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7754                                 /* We don't report these */
7755                                 i--;
7756                                 at = tp1;
7757                                 continue;
7758                         }
7759                         strseq->stream = ntohs(at->rec.data.stream_number);
7760                         strseq->sequence = ntohs(at->rec.data.stream_seq);
7761                         strseq++;
7762                         at = tp1;
7763                 }
7764         }
7765         return;
7766
7767 }
7768
7769 void
7770 sctp_send_sack(struct sctp_tcb *stcb)
7771 {
7772         /*
7773          * Queue up a SACK in the control queue. We must first check to
7774          * see if a SACK is somehow on the control queue. If so, we will
7775          * take and and remove the old one.
7776          */
7777         struct sctp_association *asoc;
7778         struct sctp_tmit_chunk *chk, *a_chk;
7779         struct sctp_sack_chunk *sack;
7780         struct sctp_gap_ack_block *gap_descriptor;
7781         uint32_t *dup;
7782         int start;
7783         unsigned int i, maxi, seeing_ones, m_size;
7784         unsigned int num_gap_blocks, space;
7785
7786         start = maxi = 0;
7787         seeing_ones = 1;
7788         a_chk = NULL;
7789         asoc = &stcb->asoc;
7790         if (asoc->last_data_chunk_from == NULL) {
7791                 /* Hmm we never received anything */
7792                 return;
7793         }
7794         sctp_set_rwnd(stcb, asoc);
7795         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7796                 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7797                         /* Hmm, found a sack already on queue, remove it */
7798                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7799                         asoc->ctrl_queue_cnt++;
7800                         a_chk = chk;
7801                         if (a_chk->data)
7802                                 sctp_m_freem(a_chk->data);
7803                         a_chk->data = NULL;
7804                         sctp_free_remote_addr(a_chk->whoTo);
7805                         a_chk->whoTo = NULL;
7806                         break;
7807                 }
7808         }
7809         if (a_chk == NULL) {
7810                 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7811                 if (a_chk == NULL) {
7812                         /* No memory so we drop the idea, and set a timer */
7813                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7814                                         stcb->sctp_ep, stcb, NULL);
7815                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7816                                          stcb->sctp_ep, stcb, NULL);
7817                         return;
7818                 }
7819                 sctppcbinfo.ipi_count_chunk++;
7820                 sctppcbinfo.ipi_gencnt_chunk++;
7821                 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7822         }
7823         a_chk->asoc = asoc;
7824         a_chk->snd_count = 0;
7825         a_chk->send_size = 0;   /* fill in later */
7826         a_chk->sent = SCTP_DATAGRAM_UNSENT;
7827         m_size = (asoc->mapping_array_size << 3);
7828
7829         if ((asoc->numduptsns) ||
7830             (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7831                 ) {
7832                 /* Ok, we have some duplicates or the destination for the
7833                  * sack is unreachable, lets see if we can select an alternate
7834                  * than asoc->last_data_chunk_from
7835                  */
7836                 if ((!(asoc->last_data_chunk_from->dest_state &
7837                       SCTP_ADDR_NOT_REACHABLE)) &&
7838                     (asoc->used_alt_onsack > 2)) {
7839                         /* We used an alt last time, don't this time */
7840                         a_chk->whoTo = NULL;
7841                 } else {
7842                         asoc->used_alt_onsack++;
7843                         a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7844                 }
7845                 if (a_chk->whoTo == NULL) {
7846                         /* Nope, no alternate */
7847                         a_chk->whoTo = asoc->last_data_chunk_from;
7848                         asoc->used_alt_onsack = 0;
7849                 }
7850         } else {
7851                 /* No duplicates so we use the last
7852                  * place we received data from.
7853                  */
7854 #ifdef SCTP_DEBUG
7855                 if (asoc->last_data_chunk_from == NULL) {
7856                         kprintf("Huh, last_data_chunk_from is null when we want to sack??\n");
7857                 }
7858 #endif
7859                 asoc->used_alt_onsack = 0;
7860                 a_chk->whoTo = asoc->last_data_chunk_from;
7861         }
7862         if (a_chk->whoTo)
7863                 a_chk->whoTo->ref_count++;
7864
7865         /* Ok now lets formulate a MBUF with our sack */
7866         MGETHDR(a_chk->data, MB_DONTWAIT, MT_DATA);
7867         if ((a_chk->data == NULL) ||
7868             (a_chk->whoTo == NULL)) {
7869                 /* rats, no mbuf memory */
7870                 if (a_chk->data) {
7871                         /* was a problem with the destination */
7872                         sctp_m_freem(a_chk->data);
7873                         a_chk->data = NULL;
7874                 }
7875                 a_chk->whoTo->ref_count--;
7876                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7877                 sctppcbinfo.ipi_count_chunk--;
7878                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7879                         panic("Chunk count is negative");
7880                 }
7881                 sctppcbinfo.ipi_gencnt_chunk++;
7882                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7883                                 stcb->sctp_ep, stcb, NULL);
7884                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7885                                  stcb->sctp_ep, stcb, NULL);
7886                 return;
7887         }
7888         /* First count the number of gap ack blocks we need */
7889         if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7890                 /* We know if there are none above the cum-ack we
7891                  * have everything with NO gaps
7892                  */
7893                 num_gap_blocks = 0;
7894         } else {
7895                 /* Ok we must count how many gaps we
7896                  * have.
7897                  */
7898                 num_gap_blocks = 0;
7899                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7900                         maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7901                 } else {
7902                         maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7903                 }
7904                 if (maxi > m_size) {
7905                         /* impossible but who knows, someone is playing with us  :> */
7906 #ifdef SCTP_DEBUG
7907                         kprintf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7908                                maxi,
7909                                m_size,
7910                                asoc->highest_tsn_inside_map,
7911                                asoc->mapping_array_base_tsn,
7912                                asoc->cumulative_tsn
7913                                );
7914 #endif
7915                         num_gap_blocks = 0;
7916                         goto no_gaps_now;
7917                 }
7918                 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7919                         start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7920                 } else {
7921                         /* Set it so we start at 0 */
7922                         start = -1;
7923                 }
7924                 /* Ok move start up one to look at the NEXT past the cum-ack */
7925                 start++;
7926                 for (i = start; i <= maxi; i++) {
7927                         if (seeing_ones) {
7928                                 /* while seeing ones I must
7929                                  * transition back to 0 before
7930                                  * finding the next gap and
7931                                  * counting the segment.
7932                                  */
7933                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7934                                         seeing_ones = 0;
7935                                 }
7936                         } else {
7937                                 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7938                                         seeing_ones = 1;
7939                                         num_gap_blocks++;
7940                                 }
7941                         }
7942                 }
7943         no_gaps_now:
7944                 if (num_gap_blocks == 0) {
7945                         /*
7946                          * Traveled all of the bits and NO one,
7947                          * must have reneged
7948                          */
7949                         if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
7950                            asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
7951 #ifdef SCTP_MAP_LOGGING
7952                            sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
7953 #endif
7954                         }
7955                 }
7956         }
7957
7958         /* Now calculate the space needed */
7959         space = (sizeof(struct sctp_sack_chunk) +
7960                  (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7961                  (asoc->numduptsns * sizeof(int32_t))
7962                 );
7963         if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
7964                 /* Reduce the size of the sack to fit */
7965                 int calc, fit;
7966                 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
7967                 calc -= sizeof(struct sctp_gap_ack_block);
7968                 fit = calc/sizeof(struct sctp_gap_ack_block);
7969                 if (fit > (int)num_gap_blocks) {
7970                         /* discard some dups */
7971                         asoc->numduptsns = (fit - num_gap_blocks);
7972                 } else {
7973                         /* discard all dups and some gaps */
7974                         num_gap_blocks = fit;
7975                         asoc->numduptsns = 0;
7976                 }
7977                 /* recalc space */
7978                 space = (sizeof(struct sctp_sack_chunk) +
7979                          (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7980                          (asoc->numduptsns * sizeof(int32_t))
7981                         );
7982
7983         }
7984
7985         if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
7986                 /* We need a cluster */
7987                 MCLGET(a_chk->data, MB_DONTWAIT);
7988                 if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
7989                         /* can't get a cluster
7990                          * give up and try later.
7991                          */
7992                         if (a_chk->data)
7993                                 sctp_m_freem(a_chk->data);
7994                         a_chk->data = NULL;
7995                         a_chk->whoTo->ref_count--;
7996                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7997                         sctppcbinfo.ipi_count_chunk--;
7998                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7999                                 panic("Chunk count is negative");
8000                         }
8001                         sctppcbinfo.ipi_gencnt_chunk++;
8002                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
8003                                         stcb->sctp_ep, stcb, NULL);
8004                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
8005                                          stcb->sctp_ep, stcb, NULL);
8006                         return;
8007                 }
8008         }
8009
8010         /* ok, lets go through and fill it in */
8011         a_chk->data->m_data += SCTP_MIN_OVERHEAD;
8012         sack = mtod(a_chk->data, struct sctp_sack_chunk *);
8013         sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
8014         sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
8015         sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
8016         sack->sack.a_rwnd = htonl(asoc->my_rwnd);
8017         asoc->my_last_reported_rwnd = asoc->my_rwnd;
8018         sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
8019         sack->sack.num_dup_tsns = htons(asoc->numduptsns);
8020
8021         a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
8022                             (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8023                             (asoc->numduptsns * sizeof(int32_t)));
8024         a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
8025         sack->ch.chunk_length = htons(a_chk->send_size);
8026
8027         gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
8028         seeing_ones = 0;
8029         for (i = start; i <= maxi; i++) {
8030                 if (num_gap_blocks == 0) {
8031                         break;
8032                 }
8033                 if (seeing_ones) {
8034                         /* while seeing Ones I must
8035                          * transition back to 0 before
8036                          * finding the next gap
8037                          */
8038                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
8039                                 gap_descriptor->end = htons(((uint16_t)(i-start)));
8040                                 gap_descriptor++;
8041                                 seeing_ones = 0;
8042                                 num_gap_blocks--;
8043                         }
8044                 } else {
8045                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
8046                                 gap_descriptor->start = htons(((uint16_t)(i+1-start)));
8047                                 /* advance struct to next pointer */
8048                                 seeing_ones = 1;
8049                         }
8050                 }
8051         }
8052         if (num_gap_blocks) {
8053                 /* special case where the array is all 1's
8054                  * to the end of the array.
8055                  */
8056                 gap_descriptor->end = htons(((uint16_t)((i-start))));
8057                 gap_descriptor++;
8058         }
8059         /* now we must add any dups we are going to report. */
8060         if (asoc->numduptsns) {
8061                 dup = (uint32_t *)gap_descriptor;
8062                 for (i = 0; i < asoc->numduptsns; i++) {
8063                         *dup = htonl(asoc->dup_tsns[i]);
8064                         dup++;
8065                 }
8066                 asoc->numduptsns = 0;
8067         }
8068         /* now that the chunk is prepared queue it to the control
8069          * chunk queue.
8070          */
8071         TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
8072         asoc->ctrl_queue_cnt++;
8073         sctp_pegs[SCTP_PEG_SACKS_SENT]++;
8074         return;
8075 }
8076
8077 void
8078 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
8079 {
8080         struct mbuf *m_abort;
8081         struct sctp_abort_msg *abort_m;
8082         int sz;
8083         abort_m = NULL;
8084         MGETHDR(m_abort, MB_DONTWAIT, MT_HEADER);
8085         if (m_abort == NULL) {
8086                 /* no mbuf's */
8087                 return;
8088         }
8089         m_abort->m_data += SCTP_MIN_OVERHEAD;
8090         abort_m = mtod(m_abort, struct sctp_abort_msg *);
8091         m_abort->m_len = sizeof(struct sctp_abort_msg);
8092         m_abort->m_next = operr;
8093         sz = 0;
8094         if (operr) {
8095                 struct mbuf *n;
8096                 n = operr;
8097                 while (n) {
8098                         sz += n->m_len;
8099                         n = n->m_next;
8100                 }
8101         }
8102         abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8103         abort_m->msg.ch.chunk_flags = 0;
8104         abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8105                                              sz);
8106         abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8107         abort_m->sh.dest_port = stcb->rport;
8108         abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8109         abort_m->sh.checksum = 0;
8110         m_abort->m_pkthdr.len = m_abort->m_len + sz;
8111         m_abort->m_pkthdr.rcvif = 0;
8112         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8113             stcb->asoc.primary_destination,
8114             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
8115             m_abort, 1, 0, NULL, 0);
8116 }
8117
8118 int
8119 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8120                             struct sctp_nets *net)
8121
8122 {
8123         /* formulate and SEND a SHUTDOWN-COMPLETE */
8124         struct mbuf *m_shutdown_comp;
8125         struct sctp_shutdown_complete_msg *comp_cp;
8126
8127         m_shutdown_comp = NULL;
8128         MGETHDR(m_shutdown_comp, MB_DONTWAIT, MT_HEADER);
8129         if (m_shutdown_comp == NULL) {
8130                 /* no mbuf's */
8131                 return (-1);
8132         }
8133         m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8134         comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8135         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8136         comp_cp->shut_cmp.ch.chunk_flags = 0;
8137         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8138         comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8139         comp_cp->sh.dest_port = stcb->rport;
8140         comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8141         comp_cp->sh.checksum = 0;
8142
8143         m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8144         m_shutdown_comp->m_pkthdr.rcvif = 0;
8145         sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8146             (struct sockaddr *)&net->ro._l_addr, m_shutdown_comp,
8147             1, 0, NULL, 0);
8148         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8149             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8150                 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8151                 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
8152                 soisdisconnected(stcb->sctp_ep->sctp_socket);
8153         }
8154         return (0);
8155 }
8156
8157 int
8158 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8159 {
8160         /* formulate and SEND a SHUTDOWN-COMPLETE */
8161         struct mbuf *mout;
8162         struct ip *iph, *iph_out;
8163         struct ip6_hdr *ip6, *ip6_out;
8164         int offset_out;
8165         struct sctp_shutdown_complete_msg *comp_cp;
8166
8167         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
8168         if (mout == NULL) {
8169                 /* no mbuf's */
8170                 return (-1);
8171         }
8172         iph = mtod(m, struct ip *);
8173         iph_out = NULL;
8174         ip6_out = NULL;
8175         offset_out = 0;
8176         if (iph->ip_v == IPVERSION) {
8177                 mout->m_len = sizeof(struct ip) +
8178                     sizeof(struct sctp_shutdown_complete_msg);
8179                 mout->m_next = NULL;
8180                 iph_out = mtod(mout, struct ip *);
8181
8182                 /* Fill in the IP header for the ABORT */
8183                 iph_out->ip_v = IPVERSION;
8184                 iph_out->ip_hl = (sizeof(struct ip)/4);
8185                 iph_out->ip_tos = (u_char)0;
8186                 iph_out->ip_id = 0;
8187                 iph_out->ip_off = 0;
8188                 iph_out->ip_ttl = MAXTTL;
8189                 iph_out->ip_p = IPPROTO_SCTP;
8190                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8191                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8192
8193                 /* let IP layer calculate this */
8194                 iph_out->ip_sum = 0;
8195                 offset_out += sizeof(*iph_out);
8196                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8197                     (caddr_t)iph_out + offset_out);
8198         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8199                 ip6 = (struct ip6_hdr *)iph;
8200                 mout->m_len = sizeof(struct ip6_hdr) +
8201                     sizeof(struct sctp_shutdown_complete_msg);
8202                 mout->m_next = NULL;
8203                 ip6_out = mtod(mout, struct ip6_hdr *);
8204
8205                 /* Fill in the IPv6 header for the ABORT */
8206                 ip6_out->ip6_flow = ip6->ip6_flow;
8207                 ip6_out->ip6_hlim = ip6_defhlim;
8208                 ip6_out->ip6_nxt = IPPROTO_SCTP;
8209                 ip6_out->ip6_src = ip6->ip6_dst;
8210                 ip6_out->ip6_dst = ip6->ip6_src;
8211                 ip6_out->ip6_plen = mout->m_len;
8212                 offset_out += sizeof(*ip6_out);
8213                 comp_cp = (struct sctp_shutdown_complete_msg *)(
8214                     (caddr_t)ip6_out + offset_out);
8215         } else {
8216                 /* Currently not supported. */
8217                 return (-1);
8218         }
8219
8220         /* Now copy in and fill in the ABORT tags etc. */
8221         comp_cp->sh.src_port = sh->dest_port;
8222         comp_cp->sh.dest_port = sh->src_port;
8223         comp_cp->sh.checksum = 0;
8224         comp_cp->sh.v_tag = sh->v_tag;
8225         comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8226         comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8227         comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8228
8229         mout->m_pkthdr.len = mout->m_len;
8230         /* add checksum */
8231         if ((sctp_no_csum_on_loopback) &&
8232            (m->m_pkthdr.rcvif) &&
8233            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
8234                 comp_cp->sh.checksum =  0;
8235         } else {
8236                 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8237         }
8238
8239         /* zap the rcvif, it should be null */
8240         mout->m_pkthdr.rcvif = 0;
8241         /* zap the stack pointer to the route */
8242         if (iph_out != NULL) {
8243                 struct route ro;
8244
8245                 bzero(&ro, sizeof ro);
8246 #ifdef SCTP_DEBUG
8247                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8248                         kprintf("sctp_shutdown_complete2 calling ip_output:\n");
8249                         sctp_print_address_pkt(iph_out, &comp_cp->sh);
8250                 }
8251 #endif
8252                 /* set IPv4 length */
8253 #if defined(__FreeBSD__)
8254                 iph_out->ip_len = mout->m_pkthdr.len;
8255 #else
8256                 iph_out->ip_len = htons(mout->m_pkthdr.len);
8257 #endif
8258                 /* out it goes */
8259                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
8260 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
8261     || defined(__NetBSD__) || defined(__DragonFly__)
8262                     , NULL
8263 #endif
8264                     );
8265                 /* Free the route if we got one back */
8266                 if (ro.ro_rt)
8267                         RTFREE(ro.ro_rt);
8268         } else if (ip6_out != NULL) {
8269 #ifdef NEW_STRUCT_ROUTE
8270                 struct route ro;
8271 #else
8272                 struct route_in6 ro;
8273 #endif
8274
8275                 bzero(&ro, sizeof(ro));
8276 #ifdef SCTP_DEBUG
8277                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8278                         kprintf("sctp_shutdown_complete2 calling ip6_output:\n");
8279                         sctp_print_address_pkt((struct ip *)ip6_out,
8280                             &comp_cp->sh);
8281                 }
8282 #endif
8283                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
8284 #if defined(__NetBSD__)
8285                            , NULL
8286 #endif
8287 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
8288                            , NULL
8289 #endif
8290                     );
8291                 /* Free the route if we got one back */
8292                 if (ro.ro_rt)
8293                         RTFREE(ro.ro_rt);
8294         }
8295         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8296         return (0);
8297 }
8298
8299 static struct sctp_nets *
8300 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8301 {
8302         struct sctp_nets *net, *hnet;
8303         int ms_goneby, highest_ms, state_overide=0;
8304
8305         SCTP_GETTIME_TIMEVAL(now);
8306         highest_ms = 0;
8307         hnet = NULL;
8308         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8309                 if (
8310                         ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8311                         (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8312                         ) {
8313                         /* Skip this guy from consideration if HB is off AND its confirmed*/
8314 #ifdef SCTP_DEBUG
8315                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8316                                 kprintf("Skipping net:%p state:%d nohb/out-of-scope\n",
8317                                        net, net->dest_state);
8318                         }
8319 #endif
8320                         continue;
8321                 }
8322                 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
8323                         /* skip this dest net from consideration */
8324 #ifdef SCTP_DEBUG
8325                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8326                                 kprintf("Skipping net:%p reachable NOT\n",
8327                                        net);
8328                         }
8329 #endif
8330                         continue;
8331                 }
8332                 if (net->last_sent_time.tv_sec) {
8333                         /* Sent to so we subtract */
8334                         ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8335                 } else
8336                         /* Never been sent to */
8337                         ms_goneby = 0x7fffffff;
8338 #ifdef SCTP_DEBUG
8339                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8340                         kprintf("net:%p ms_goneby:%d\n",
8341                                net, ms_goneby);
8342                 }
8343 #endif
8344                 /* When the address state is unconfirmed but still considered reachable, we
8345                  * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8346                  * state, thenw we cut it back to HB at a more normal pace.
8347                  */
8348                 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8349                         state_overide = 1;
8350                 } else {
8351                         state_overide = 0;
8352                 }
8353
8354                 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8355                     (ms_goneby > highest_ms)) {
8356                         highest_ms = ms_goneby;
8357                         hnet = net;
8358 #ifdef SCTP_DEBUG
8359                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8360                                 kprintf("net:%p is the new high\n",
8361                                        net);
8362                         }
8363 #endif
8364                 }
8365         }
8366         if (hnet &&
8367            ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8368                 state_overide = 1;
8369         } else {
8370                 state_overide = 0;
8371         }
8372
8373         if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8374                 /* Found the one with longest delay bounds
8375                  * OR it is unconfirmed and still not marked
8376                  * unreachable.
8377                  */
8378 #ifdef SCTP_DEBUG
8379                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8380                         kprintf("net:%p is the hb winner -",
8381                                 hnet);
8382                         if (hnet)
8383                                 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr);
8384                         else
8385                                 kprintf(" none\n");
8386                 }
8387 #endif
8388                 /* update the timer now */
8389                 hnet->last_sent_time = *now;
8390                 return (hnet);
8391         }
8392         /* Nothing to HB */
8393         return (NULL);
8394 }
8395
8396 int
8397 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8398 {
8399         struct sctp_tmit_chunk *chk;
8400         struct sctp_nets *net;
8401         struct sctp_heartbeat_chunk *hb;
8402         struct timeval now;
8403         struct sockaddr_in *sin;
8404         struct sockaddr_in6 *sin6;
8405
8406         if (user_req == 0) {
8407                 net = sctp_select_hb_destination(stcb, &now);
8408                 if (net == NULL) {
8409                         /* All our busy none to send to, just
8410                          * start the timer again.
8411                          */
8412                         if (stcb->asoc.state == 0) {
8413                                 return (0);
8414                         }
8415                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8416                                          stcb->sctp_ep,
8417                                          stcb,
8418                                          net);
8419                         return (0);
8420                 }
8421 #ifndef SCTP_USE_ALLMAN_BURST
8422                 else {
8423                         /* found one idle.. decay cwnd on this one
8424                          * by 1/2 if none outstanding.
8425                          */
8426
8427                         if (net->flight_size == 0) {
8428                                 net->cwnd /= 2;
8429                                 if (net->addr_is_local) {
8430                                         if (net->cwnd < (net->mtu *4)) {
8431                                                 net->cwnd = net->mtu * 4;
8432                                         }
8433                                 } else {
8434                                         if (net->cwnd < (net->mtu * 2)) {
8435                                                 net->cwnd = net->mtu * 2;
8436                                         }
8437                                 }
8438
8439                         }
8440
8441                 }
8442 #endif
8443         } else {
8444                 net = u_net;
8445                 if (net == NULL) {
8446                         return (0);
8447                 }
8448                 SCTP_GETTIME_TIMEVAL(&now);
8449         }
8450         sin = (struct sockaddr_in *)&net->ro._l_addr;
8451         if (sin->sin_family != AF_INET) {
8452                 if (sin->sin_family != AF_INET6) {
8453                         /* huh */
8454                         return (0);
8455                 }
8456         }
8457         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8458         if (chk == NULL) {
8459 #ifdef SCTP_DEBUG
8460                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8461                         kprintf("Gak, can't get a chunk for hb\n");
8462                 }
8463 #endif
8464                 return (0);
8465         }
8466         sctppcbinfo.ipi_gencnt_chunk++;
8467         sctppcbinfo.ipi_count_chunk++;
8468         chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8469         chk->asoc = &stcb->asoc;
8470         chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8471         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8472         if (chk->data == NULL) {
8473                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8474                 sctppcbinfo.ipi_count_chunk--;
8475                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8476                         panic("Chunk count is negative");
8477                 }
8478                 sctppcbinfo.ipi_gencnt_chunk++;
8479                 return (0);
8480         }
8481         chk->data->m_data += SCTP_MIN_OVERHEAD;
8482         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8483         chk->sent = SCTP_DATAGRAM_UNSENT;
8484         chk->snd_count = 0;
8485         chk->whoTo = net;
8486         chk->whoTo->ref_count++;
8487         /* Now we have a mbuf that we can fill in with the details */
8488         hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8489
8490         /* fill out chunk header */
8491         hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8492         hb->ch.chunk_flags = 0;
8493         hb->ch.chunk_length = htons(chk->send_size);
8494         /* Fill out hb parameter */
8495         hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8496         hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8497         hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8498         hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8499         /* Did our user request this one, put it in */
8500         hb->heartbeat.hb_info.user_req = user_req;
8501         hb->heartbeat.hb_info.addr_family = sin->sin_family;
8502         hb->heartbeat.hb_info.addr_len = sin->sin_len;
8503         if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8504                 /* we only take from the entropy pool if the address is
8505                  * not confirmed.
8506                  */
8507                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8508                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8509         } else {
8510                 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8511                 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8512         }
8513         if (sin->sin_family == AF_INET) {
8514                 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8515         } else if (sin->sin_family == AF_INET6) {
8516                 /* We leave the scope the way it is in our lookup table. */
8517                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
8518                 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8519         } else {
8520                 /* huh compiler bug */
8521 #ifdef SCTP_DEBUG
8522                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8523                         kprintf("Compiler bug bleeds a mbuf and a chunk\n");
8524                 }
8525 #endif
8526                 return (0);
8527         }
8528         /* ok we have a destination that needs a beat */
8529         /* lets do the theshold management Qiaobing style */
8530         if (user_req == 0) {
8531                 if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8532                                               stcb->asoc.max_send_times)) {
8533                         /* we have lost the association, in a way this
8534                          * is quite bad since we really are one less time
8535                          * since we really did not send yet. This is the
8536                          * down side to the Q's style as defined in the RFC
8537                          * and not my alternate style defined in the RFC.
8538                          */
8539                         if (chk->data != NULL) {
8540                                 sctp_m_freem(chk->data);
8541                                 chk->data = NULL;
8542                         }
8543                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8544                         sctppcbinfo.ipi_count_chunk--;
8545                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8546                                 panic("Chunk count is negative");
8547                         }
8548                         sctppcbinfo.ipi_gencnt_chunk++;
8549                         return (-1);
8550                 }
8551         }
8552         net->hb_responded = 0;
8553 #ifdef SCTP_DEBUG
8554         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8555                 kprintf("Inserting chunk for HB\n");
8556         }
8557 #endif
8558         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8559         stcb->asoc.ctrl_queue_cnt++;
8560         sctp_pegs[SCTP_HB_SENT]++;
8561         /*
8562          * Call directly med level routine to put out the chunk. It will
8563          * always tumble out control chunks aka HB but it may even tumble
8564          * out data too.
8565          */
8566         if (user_req == 0) {
8567                 /* Ok now lets start the HB timer if it is NOT a user req */
8568                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8569                                  stcb, net);
8570         }
8571         return (1);
8572 }
8573
8574 void
8575 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8576                    uint32_t high_tsn)
8577 {
8578         struct sctp_association *asoc;
8579         struct sctp_ecne_chunk *ecne;
8580         struct sctp_tmit_chunk *chk;
8581         asoc = &stcb->asoc;
8582         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8583                 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8584                         /* found a previous ECN_ECHO update it if needed */
8585                         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8586                         ecne->tsn = htonl(high_tsn);
8587                         return;
8588                 }
8589         }
8590         /* nope could not find one to update so we must build one */
8591         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8592         if (chk == NULL) {
8593                 return;
8594         }
8595         sctp_pegs[SCTP_ECNE_SENT]++;
8596         sctppcbinfo.ipi_count_chunk++;
8597         sctppcbinfo.ipi_gencnt_chunk++;
8598         chk->rec.chunk_id = SCTP_ECN_ECHO;
8599         chk->asoc = &stcb->asoc;
8600         chk->send_size = sizeof(struct sctp_ecne_chunk);
8601         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8602         if (chk->data == NULL) {
8603                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8604                 sctppcbinfo.ipi_count_chunk--;
8605                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8606                         panic("Chunk count is negative");
8607                 }
8608                 sctppcbinfo.ipi_gencnt_chunk++;
8609                 return;
8610         }
8611         chk->data->m_data += SCTP_MIN_OVERHEAD;
8612         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8613         chk->sent = SCTP_DATAGRAM_UNSENT;
8614         chk->snd_count = 0;
8615         chk->whoTo = net;
8616         chk->whoTo->ref_count++;
8617         ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8618         ecne->ch.chunk_type = SCTP_ECN_ECHO;
8619         ecne->ch.chunk_flags = 0;
8620         ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8621         ecne->tsn = htonl(high_tsn);
8622         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8623         asoc->ctrl_queue_cnt++;
8624 }
8625
8626 void
8627 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8628                          struct mbuf *m, int iphlen, int bad_crc)
8629 {
8630         struct sctp_association *asoc;
8631         struct sctp_pktdrop_chunk *drp;
8632         struct sctp_tmit_chunk *chk;
8633         uint8_t *datap;
8634         int len;
8635         unsigned int small_one;
8636         struct ip *iph;
8637
8638         long spc;
8639         asoc = &stcb->asoc;
8640         if (asoc->peer_supports_pktdrop == 0) {
8641                 /* peer must declare support before I
8642                  * send one.
8643                  */
8644                 return;
8645         }
8646         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8647         if (chk == NULL) {
8648                 return;
8649         }
8650         sctppcbinfo.ipi_count_chunk++;
8651         sctppcbinfo.ipi_gencnt_chunk++;
8652
8653         iph = mtod(m, struct ip *);
8654         if (iph == NULL) {
8655                 return;
8656         }
8657         if (iph->ip_v == IPVERSION) {
8658                 /* IPv4 */
8659 #if defined(__FreeBSD__)
8660                 len = chk->send_size = iph->ip_len;
8661 #else
8662                 len = chk->send_size = (iph->ip_len - iphlen);
8663 #endif
8664         } else {
8665                 struct ip6_hdr *ip6h;
8666                 /* IPv6 */
8667                 ip6h = mtod(m, struct ip6_hdr *);
8668                 len = chk->send_size = htons(ip6h->ip6_plen);
8669         }
8670         if ((len+iphlen) > m->m_pkthdr.len) {
8671                 /* huh */
8672                 chk->send_size = len = m->m_pkthdr.len - iphlen;
8673         }
8674         chk->asoc = &stcb->asoc;
8675         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8676         if (chk->data == NULL) {
8677         jump_out:
8678                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8679                 sctppcbinfo.ipi_count_chunk--;
8680                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8681                         panic("Chunk count is negative");
8682                 }
8683                 sctppcbinfo.ipi_gencnt_chunk++;
8684                 return;
8685         }
8686         if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8687                 MCLGET(chk->data, MB_DONTWAIT);
8688                 if ((chk->data->m_flags & M_EXT) == 0) {
8689                         /* Give up */
8690                         sctp_m_freem(chk->data);
8691                         chk->data = NULL;
8692                         goto jump_out;
8693                 }
8694         }
8695         chk->data->m_data += SCTP_MIN_OVERHEAD;
8696         drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8697         if (drp == NULL) {
8698                 sctp_m_freem(chk->data);
8699                 chk->data = NULL;
8700                 goto jump_out;
8701         }
8702         small_one = asoc->smallest_mtu;
8703         if (small_one > MCLBYTES) {
8704                 /* Only one cluster worth of data MAX */
8705                 small_one = MCLBYTES;
8706         }
8707         chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8708                           sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8709         if (chk->book_size > small_one) {
8710                 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8711                 drp->trunc_len = htons(chk->send_size);
8712                 chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8713                                              sizeof(struct sctp_pktdrop_chunk) +
8714                                              sizeof(struct sctphdr));
8715                 len = chk->send_size;
8716         } else {
8717                 /* no truncation needed */
8718                 drp->ch.chunk_flags = 0;
8719                 drp->trunc_len = htons(0);
8720         }
8721         if (bad_crc) {
8722                 drp->ch.chunk_flags |= SCTP_BADCRC;
8723         }
8724         chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8725         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8726         chk->sent = SCTP_DATAGRAM_UNSENT;
8727         chk->snd_count = 0;
8728         if (net) {
8729                 /* we should hit here */
8730                 chk->whoTo = net;
8731         } else {
8732                 chk->whoTo = asoc->primary_destination;
8733         }
8734         chk->whoTo->ref_count++;
8735         chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8736         drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8737         drp->ch.chunk_length = htons(chk->send_size);
8738         spc = stcb->sctp_socket->so_rcv.ssb_hiwat;
8739         if (spc < 0) {
8740                 spc = 0;
8741         }
8742         drp->bottle_bw = htonl(spc);
8743         drp->current_onq = htonl(asoc->size_on_delivery_queue +
8744                                  asoc->size_on_reasm_queue +
8745                                  asoc->size_on_all_streams +
8746                                  asoc->my_rwnd_control_len +
8747                                  stcb->sctp_socket->so_rcv.ssb_cc);
8748         drp->reserved = 0;
8749         datap = drp->data;
8750         m_copydata(m, iphlen, len, datap);
8751         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8752         asoc->ctrl_queue_cnt++;
8753 }
8754
8755 void
8756 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8757 {
8758         struct sctp_association *asoc;
8759         struct sctp_cwr_chunk *cwr;
8760         struct sctp_tmit_chunk *chk;
8761
8762         asoc = &stcb->asoc;
8763         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8764                 if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8765                         /* found a previous ECN_CWR update it if needed */
8766                         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8767                         if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8768                                               MAX_TSN)) {
8769                                 cwr->tsn = htonl(high_tsn);
8770                         }
8771                         return;
8772                 }
8773         }
8774         /* nope could not find one to update so we must build one */
8775         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8776         if (chk == NULL) {
8777                 return;
8778         }
8779         sctppcbinfo.ipi_count_chunk++;
8780         sctppcbinfo.ipi_gencnt_chunk++;
8781         chk->rec.chunk_id = SCTP_ECN_CWR;
8782         chk->asoc = &stcb->asoc;
8783         chk->send_size = sizeof(struct sctp_cwr_chunk);
8784         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8785         if (chk->data == NULL) {
8786                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8787                 sctppcbinfo.ipi_count_chunk--;
8788                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8789                         panic("Chunk count is negative");
8790                 }
8791                 sctppcbinfo.ipi_gencnt_chunk++;
8792                 return;
8793         }
8794         chk->data->m_data += SCTP_MIN_OVERHEAD;
8795         chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8796         chk->sent = SCTP_DATAGRAM_UNSENT;
8797         chk->snd_count = 0;
8798         chk->whoTo = net;
8799         chk->whoTo->ref_count++;
8800         cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8801         cwr->ch.chunk_type = SCTP_ECN_CWR;
8802         cwr->ch.chunk_flags = 0;
8803         cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8804         cwr->tsn = htonl(high_tsn);
8805         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8806         asoc->ctrl_queue_cnt++;
8807 }
8808 static void
8809 sctp_reset_the_streams(struct sctp_tcb *stcb,
8810      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8811 {
8812         int i;
8813
8814         if (req->reset_flags & SCTP_RESET_ALL) {
8815                 for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8816                         stcb->asoc.strmout[i].next_sequence_sent = 0;
8817                 }
8818         } else if (number_entries) {
8819                 for (i=0; i<number_entries; i++) {
8820                         if (list[i] >= stcb->asoc.streamoutcnt) {
8821                                 /* no such stream */
8822                                 continue;
8823                         }
8824                         stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8825                 }
8826         }
8827         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8828 }
8829
8830 void
8831 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8832      struct sctp_stream_reset_request *req)
8833 {
8834         struct sctp_association *asoc;
8835         struct sctp_stream_reset_resp *strack;
8836         struct sctp_tmit_chunk *chk;
8837         uint32_t seq;
8838         int number_entries, i;
8839         uint8_t two_way=0, not_peer=0;
8840         uint16_t *list=NULL;
8841
8842         asoc = &stcb->asoc;
8843         if (req->reset_flags & SCTP_RESET_ALL)
8844                 number_entries = 0;
8845         else
8846                 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8847
8848         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8849         if (chk == NULL) {
8850                 return;
8851         }
8852         sctppcbinfo.ipi_count_chunk++;
8853         sctppcbinfo.ipi_gencnt_chunk++;
8854         chk->rec.chunk_id = SCTP_STREAM_RESET;
8855         chk->asoc = &stcb->asoc;
8856         chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8857         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8858         if (chk->data == NULL) {
8859         strresp_jump_out:
8860                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8861                 sctppcbinfo.ipi_count_chunk--;
8862                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8863                         panic("Chunk count is negative");
8864                 }
8865                 sctppcbinfo.ipi_gencnt_chunk++;
8866                 return;
8867         }
8868         chk->data->m_data += SCTP_MIN_OVERHEAD;
8869         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8870         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8871                 MCLGET(chk->data, MB_DONTWAIT);
8872                 if ((chk->data->m_flags & M_EXT) == 0) {
8873                         /* Give up */
8874                         sctp_m_freem(chk->data);
8875                         chk->data = NULL;
8876                         goto strresp_jump_out;
8877                 }
8878                 chk->data->m_data += SCTP_MIN_OVERHEAD;
8879         }
8880         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8881                 /* can't do it, no room */
8882                 /* Give up */
8883                 sctp_m_freem(chk->data);
8884                 chk->data = NULL;
8885                 goto strresp_jump_out;
8886
8887         }
8888         chk->sent = SCTP_DATAGRAM_UNSENT;
8889         chk->snd_count = 0;
8890         chk->whoTo = asoc->primary_destination;
8891         chk->whoTo->ref_count++;
8892         strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8893
8894         strack->ch.chunk_type = SCTP_STREAM_RESET;
8895         strack->ch.chunk_flags = 0;
8896         strack->ch.chunk_length = htons(chk->send_size);
8897
8898         memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8899
8900         strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8901         strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8902
8903
8904
8905         if (chk->send_size % 4) {
8906                 /* need a padding for the end */
8907                 int pad;
8908                 uint8_t *end;
8909                 end = (uint8_t *)((caddr_t)strack + chk->send_size);
8910                 pad = chk->send_size % 4;
8911                 for (i = 0; i < pad; i++) {
8912                         end[i] = 0;
8913                 }
8914                 chk->send_size += pad;
8915         }
8916
8917         /* actual response */
8918         if (req->reset_flags & SCTP_RESET_YOUR) {
8919                 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8920         } else {
8921                 strack->sr_resp.reset_flags = 0;
8922         }
8923
8924         /* copied from reset request */
8925         strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8926         seq = ntohl(req->reset_req_seq);
8927
8928         list = req->list_of_streams;
8929         /* copy the un-converted network byte order streams */
8930         for (i=0; i<number_entries; i++) {
8931                 strack->sr_resp.list_of_streams[i] = list[i];
8932         }
8933         if (asoc->str_reset_seq_in == seq) {
8934                 /* is it the next expected? */
8935                 asoc->str_reset_seq_in++;
8936                 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8937                 asoc->str_reset_sending_seq = asoc->sending_seq;
8938                 if (number_entries) {
8939                         int i;
8940                         uint16_t temp;
8941                         /* convert them to host byte order */
8942                         for (i=0 ; i<number_entries; i++) {
8943                                 temp = ntohs(list[i]);
8944                                 list[i] = temp;
8945                         }
8946                 }
8947                 if (req->reset_flags & SCTP_RESET_YOUR) {
8948                         /* reset my outbound streams */
8949                         sctp_reset_the_streams(stcb, req , number_entries, list);
8950                 }
8951                 if (req->reset_flags & SCTP_RECIPRICAL) {
8952                         /* reset peer too */
8953                         sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
8954                 }
8955
8956         } else {
8957                 /* no its a retran so I must just ack and do nothing */
8958                 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
8959         }
8960         strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
8961         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8962                           chk,
8963                           sctp_next);
8964         asoc->ctrl_queue_cnt++;
8965 }
8966
8967
8968 void
8969 sctp_send_str_reset_req(struct sctp_tcb *stcb,
8970      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
8971 {
8972         /* Send a stream reset request. The number_entrys may be 0 and list NULL
8973          * if the request is to reset all streams. If two_way is true then we
8974          * not only request a RESET of the received streams but we also
8975          * request the peer to send a reset req to us too.
8976          * Flag combinations in table:
8977          *
8978          *       two_way | not_peer  | = | Flags
8979          *       ------------------------------
8980          *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
8981          *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
8982          *         0     |    1      | = | Not a Valid Request (not anyone)
8983          *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
8984          */
8985         struct sctp_association *asoc;
8986         struct sctp_stream_reset_req *strreq;
8987         struct sctp_tmit_chunk *chk;
8988
8989
8990         asoc = &stcb->asoc;
8991         if (asoc->stream_reset_outstanding) {
8992                 /* Already one pending, must get ACK back
8993                  * to clear the flag.
8994                  */
8995                 return;
8996         }
8997
8998         if ((two_way == 0) && (not_peer == 1)) {
8999                 /* not a valid request */
9000                 return;
9001         }
9002
9003         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9004         if (chk == NULL) {
9005                 return;
9006         }
9007         sctppcbinfo.ipi_count_chunk++;
9008         sctppcbinfo.ipi_gencnt_chunk++;
9009         chk->rec.chunk_id = SCTP_STREAM_RESET;
9010         chk->asoc = &stcb->asoc;
9011         chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
9012         MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
9013         if (chk->data == NULL) {
9014         strreq_jump_out:
9015                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9016                 sctppcbinfo.ipi_count_chunk--;
9017                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9018                         panic("Chunk count is negative");
9019                 }
9020                 sctppcbinfo.ipi_gencnt_chunk++;
9021                 return;
9022         }
9023         chk->data->m_data += SCTP_MIN_OVERHEAD;
9024         chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
9025         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9026                 MCLGET(chk->data, MB_DONTWAIT);
9027                 if ((chk->data->m_flags & M_EXT) == 0) {
9028                         /* Give up */
9029                         sctp_m_freem(chk->data);
9030                         chk->data = NULL;
9031                         goto strreq_jump_out;
9032                 }
9033                 chk->data->m_data += SCTP_MIN_OVERHEAD;
9034         }
9035         if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9036                 /* can't do it, no room */
9037                 /* Give up */
9038                 sctp_m_freem(chk->data);
9039                 chk->data = NULL;
9040                 goto strreq_jump_out;
9041         }
9042         chk->sent = SCTP_DATAGRAM_UNSENT;
9043         chk->snd_count = 0;
9044         chk->whoTo = asoc->primary_destination;
9045         chk->whoTo->ref_count++;
9046
9047         strreq = mtod(chk->data, struct sctp_stream_reset_req *);
9048         strreq->ch.chunk_type = SCTP_STREAM_RESET;
9049         strreq->ch.chunk_flags = 0;
9050         strreq->ch.chunk_length = htons(chk->send_size);
9051
9052         strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
9053         strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
9054
9055         if (chk->send_size % 4) {
9056                 /* need a padding for the end */
9057                 int pad, i;
9058                 uint8_t *end;
9059                 end = (uint8_t *)((caddr_t)strreq + chk->send_size);
9060                 pad = chk->send_size % 4;
9061                 for (i=0; i<pad; i++) {
9062                         end[i] = 0;
9063                 }
9064                 chk->send_size += pad;
9065         }
9066
9067         strreq->sr_req.reset_flags = 0;
9068         if (number_entrys == 0) {
9069                 strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
9070         }
9071         if (two_way == 0) {
9072                 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
9073         } else {
9074                 if (not_peer == 0) {
9075                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
9076                 } else {
9077                         strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
9078                 }
9079         }
9080         memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
9081         strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
9082         if (number_entrys) {
9083                 /* populate the specific entry's */
9084                 int i;
9085                 for (i=0; i < number_entrys; i++) {
9086                         strreq->sr_req.list_of_streams[i] = htons(list[i]);
9087                 }
9088         }
9089         TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9090                           chk,
9091                           sctp_next);
9092         asoc->ctrl_queue_cnt++;
9093         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
9094         asoc->stream_reset_outstanding = 1;
9095 }
9096
9097 void
9098 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
9099     struct mbuf *err_cause)
9100 {
9101         /*
9102          * Formulate the abort message, and send it back down.
9103          */
9104         struct mbuf *mout;
9105         struct sctp_abort_msg *abm;
9106         struct ip *iph, *iph_out;
9107         struct ip6_hdr *ip6, *ip6_out;
9108         int iphlen_out;
9109
9110         /* don't respond to ABORT with ABORT */
9111         if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
9112                 if (err_cause)
9113                         sctp_m_freem(err_cause);
9114                 return;
9115         }
9116         MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
9117         if (mout == NULL) {
9118                 if (err_cause)
9119                         sctp_m_freem(err_cause);
9120                 return;
9121         }
9122         iph = mtod(m, struct ip *);
9123         iph_out = NULL;
9124         ip6_out = NULL;
9125         if (iph->ip_v == IPVERSION) {
9126                 iph_out = mtod(mout, struct ip *);
9127                 mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9128                 mout->m_next = err_cause;
9129
9130                 /* Fill in the IP header for the ABORT */
9131                 iph_out->ip_v = IPVERSION;
9132                 iph_out->ip_hl = (sizeof(struct ip) / 4);
9133                 iph_out->ip_tos = (u_char)0;
9134                 iph_out->ip_id = 0;
9135                 iph_out->ip_off = 0;
9136                 iph_out->ip_ttl = MAXTTL;
9137                 iph_out->ip_p = IPPROTO_SCTP;
9138                 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9139                 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9140                 /* let IP layer calculate this */
9141                 iph_out->ip_sum = 0;
9142
9143                 iphlen_out = sizeof(*iph_out);
9144                 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
9145         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9146                 ip6 = (struct ip6_hdr *)iph;
9147                 ip6_out = mtod(mout, struct ip6_hdr *);
9148                 mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9149                 mout->m_next = err_cause;
9150
9151                 /* Fill in the IP6 header for the ABORT */
9152                 ip6_out->ip6_flow = ip6->ip6_flow;
9153                 ip6_out->ip6_hlim = ip6_defhlim;
9154                 ip6_out->ip6_nxt = IPPROTO_SCTP;
9155                 ip6_out->ip6_src = ip6->ip6_dst;
9156                 ip6_out->ip6_dst = ip6->ip6_src;
9157
9158                 iphlen_out = sizeof(*ip6_out);
9159                 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
9160         } else {
9161                 /* Currently not supported */
9162                 return;
9163         }
9164
9165         abm->sh.src_port = sh->dest_port;
9166         abm->sh.dest_port = sh->src_port;
9167         abm->sh.checksum = 0;
9168         if (vtag == 0) {
9169                 abm->sh.v_tag = sh->v_tag;
9170                 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9171         } else {
9172                 abm->sh.v_tag = htonl(vtag);
9173                 abm->msg.ch.chunk_flags = 0;
9174         }
9175         abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9176
9177         if (err_cause) {
9178                 struct mbuf *m_tmp = err_cause;
9179                 int err_len = 0;
9180                 /* get length of the err_cause chain */
9181                 while (m_tmp != NULL) {
9182                         err_len += m_tmp->m_len;
9183                         m_tmp = m_tmp->m_next;
9184                 }
9185                 mout->m_pkthdr.len = mout->m_len + err_len;
9186                 if (err_len % 4) {
9187                         /* need pad at end of chunk */
9188                         u_int32_t cpthis=0;
9189                         int padlen;
9190                         padlen = 4 - (mout->m_pkthdr.len % 4);
9191                         m_copyback(mout, mout->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9192                 }
9193                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9194         } else {
9195                 mout->m_pkthdr.len = mout->m_len;
9196                 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9197         }
9198
9199         /* add checksum */
9200         if ((sctp_no_csum_on_loopback) &&
9201            (m->m_pkthdr.rcvif) &&
9202            (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9203                 abm->sh.checksum =  0;
9204         } else {
9205                 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9206         }
9207
9208         /* zap the rcvif, it should be null */
9209         mout->m_pkthdr.rcvif = 0;
9210         if (iph_out != NULL) {
9211                 struct route ro;
9212
9213                 /* zap the stack pointer to the route */
9214                 bzero(&ro, sizeof ro);
9215 #ifdef SCTP_DEBUG
9216                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9217                         kprintf("sctp_send_abort calling ip_output:\n");
9218                         sctp_print_address_pkt(iph_out, &abm->sh);
9219                 }
9220 #endif
9221                 /* set IPv4 length */
9222 #if defined(__FreeBSD__)
9223                 iph_out->ip_len = mout->m_pkthdr.len;
9224 #else
9225                 iph_out->ip_len = htons(mout->m_pkthdr.len);
9226 #endif
9227                 /* out it goes */
9228                 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
9229 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9230     || defined(__NetBSD__) || defined(__DragonFly__)
9231                     , NULL
9232 #endif
9233                     );
9234                 /* Free the route if we got one back */
9235                 if (ro.ro_rt)
9236                         RTFREE(ro.ro_rt);
9237         } else if (ip6_out != NULL) {
9238 #ifdef NEW_STRUCT_ROUTE
9239                 struct route ro;
9240 #else
9241                 struct route_in6 ro;
9242 #endif
9243
9244                 /* zap the stack pointer to the route */
9245                 bzero(&ro, sizeof(ro));
9246 #ifdef SCTP_DEBUG
9247                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9248                         kprintf("sctp_send_abort calling ip6_output:\n");
9249                         sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9250                 }
9251 #endif
9252                 ip6_output(mout, NULL, &ro, 0, NULL, NULL
9253 #if defined(__NetBSD__)
9254                         , NULL
9255 #endif
9256 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9257                     , NULL
9258 #endif
9259                     );
9260                 /* Free the route if we got one back */
9261                 if (ro.ro_rt)
9262                         RTFREE(ro.ro_rt);
9263         }
9264         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9265 }
9266
9267 void
9268 sctp_send_operr_to(struct mbuf *m, int iphlen,
9269                    struct mbuf *scm,
9270                    uint32_t vtag)
9271 {
9272         struct sctphdr *ihdr;
9273         int retcode;
9274         struct sctphdr *ohdr;
9275         struct sctp_chunkhdr *ophdr;
9276
9277         struct ip *iph;
9278 #ifdef SCTP_DEBUG
9279         struct sockaddr_in6 lsa6, fsa6;
9280 #endif
9281         uint32_t val;
9282         iph = mtod(m, struct ip *);
9283         ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
9284         if (!(scm->m_flags & M_PKTHDR)) {
9285                 /* must be a pkthdr */
9286                 kprintf("Huh, not a packet header in send_operr\n");
9287                 m_freem(scm);
9288                 return;
9289         }
9290         M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), MB_DONTWAIT);
9291         if (scm == NULL) {
9292                 /* can't send because we can't add a mbuf */
9293                 return;
9294         }
9295         ohdr = mtod(scm, struct sctphdr *);
9296         ohdr->src_port = ihdr->dest_port;
9297         ohdr->dest_port = ihdr->src_port;
9298         ohdr->v_tag = vtag;
9299         ohdr->checksum = 0;
9300         ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9301         ophdr->chunk_type = SCTP_OPERATION_ERROR;
9302         ophdr->chunk_flags = 0;
9303         ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9304         if (scm->m_pkthdr.len % 4) {
9305                 /* need padding */
9306                 u_int32_t cpthis=0;
9307                 int padlen;
9308                 padlen = 4 - (scm->m_pkthdr.len % 4);
9309                 m_copyback(scm, scm->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9310         }
9311         if ((sctp_no_csum_on_loopback) &&
9312             (m->m_pkthdr.rcvif) &&
9313             (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9314                 val = 0;
9315         } else {
9316                 val = sctp_calculate_sum(scm, NULL, 0);
9317         }
9318         ohdr->checksum = val;
9319         if (iph->ip_v == IPVERSION) {
9320                 /* V4 */
9321                 struct ip *out;
9322                 struct route ro;
9323                 M_PREPEND(scm, sizeof(struct ip), MB_DONTWAIT);
9324                 if (scm == NULL)
9325                         return;
9326                 bzero(&ro, sizeof ro);
9327                 out = mtod(scm, struct ip *);
9328                 out->ip_v = iph->ip_v;
9329                 out->ip_hl = (sizeof(struct ip)/4);
9330                 out->ip_tos = iph->ip_tos;
9331                 out->ip_id = iph->ip_id;
9332                 out->ip_off = 0;
9333                 out->ip_ttl = MAXTTL;
9334                 out->ip_p = IPPROTO_SCTP;
9335                 out->ip_sum = 0;
9336                 out->ip_src = iph->ip_dst;
9337                 out->ip_dst = iph->ip_src;
9338 #if defined(__FreeBSD__)
9339                 out->ip_len = scm->m_pkthdr.len;
9340 #else
9341                 out->ip_len = htons(scm->m_pkthdr.len);
9342 #endif
9343                 retcode = ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL
9344 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9345     || defined(__NetBSD__) || defined(__DragonFly__)
9346                     , NULL
9347 #endif
9348                         );
9349                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9350                 /* Free the route if we got one back */
9351                 if (ro.ro_rt)
9352                         RTFREE(ro.ro_rt);
9353         } else {
9354                 /* V6 */
9355 #ifdef NEW_STRUCT_ROUTE
9356                 struct route ro;
9357 #else
9358                 struct route_in6 ro;
9359 #endif
9360                 struct ip6_hdr *out6, *in6;
9361
9362                 M_PREPEND(scm, sizeof(struct ip6_hdr), MB_DONTWAIT);
9363                 if (scm == NULL)
9364                         return;
9365                 bzero(&ro, sizeof ro);
9366                 in6 = mtod(m, struct ip6_hdr *);
9367                 out6 = mtod(scm, struct ip6_hdr *);
9368                 out6->ip6_flow = in6->ip6_flow;
9369                 out6->ip6_hlim = ip6_defhlim;
9370                 out6->ip6_nxt = IPPROTO_SCTP;
9371                 out6->ip6_src = in6->ip6_dst;
9372                 out6->ip6_dst = in6->ip6_src;
9373
9374 #ifdef SCTP_DEBUG
9375                 bzero(&lsa6, sizeof(lsa6));
9376                 lsa6.sin6_len = sizeof(lsa6);
9377                 lsa6.sin6_family = AF_INET6;
9378                 lsa6.sin6_addr = out6->ip6_src;
9379                 bzero(&fsa6, sizeof(fsa6));
9380                 fsa6.sin6_len = sizeof(fsa6);
9381                 fsa6.sin6_family = AF_INET6;
9382                 fsa6.sin6_addr = out6->ip6_dst;
9383                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9384                         kprintf("sctp_operr_to calling ipv6 output:\n");
9385                         kprintf("src: ");
9386                         sctp_print_address((struct sockaddr *)&lsa6);
9387                         kprintf("dst ");
9388                         sctp_print_address((struct sockaddr *)&fsa6);
9389                 }
9390 #endif /* SCTP_DEBUG */
9391                 ip6_output(scm, NULL, &ro, 0, NULL, NULL
9392 #if defined(__NetBSD__)
9393             , NULL
9394 #endif
9395 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9396             , NULL
9397 #endif
9398                 );
9399                 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9400                 /* Free the route if we got one back */
9401                 if (ro.ro_rt)
9402                         RTFREE(ro.ro_rt);
9403         }
9404 }
9405
9406 static int
9407 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9408 {
9409         int left, cancpy, willcpy, error;
9410         left = cpsz;
9411
9412         if (m == NULL) {
9413                 /* TSNH */
9414                 *mbcnt = 0;
9415                 return (ENOMEM);
9416         }
9417         m->m_len = 0;
9418         if ((left+resv_upfront) > (int)MHLEN) {
9419                 MCLGET(m, MB_WAIT);
9420                 if (m == NULL) {
9421                         *mbcnt = 0;
9422                         return (ENOMEM);
9423                 }
9424                 if ((m->m_flags & M_EXT) == 0) {
9425                         *mbcnt = 0;
9426                         return (ENOMEM);
9427                 }
9428                 *mbcnt += m->m_ext.ext_size;
9429         }
9430         *mbcnt += MSIZE;
9431         cancpy = M_TRAILINGSPACE(m);
9432         willcpy = min(cancpy, left);
9433         if ((willcpy + resv_upfront) > cancpy) {
9434                 willcpy -= resv_upfront;
9435         }
9436         while (left > 0) {
9437                 /* Align data to the end */
9438                 if ((m->m_flags & M_EXT) == 0) {
9439                         if (m->m_flags & M_PKTHDR) {
9440                                 MH_ALIGN(m, willcpy);
9441                         } else {
9442                                 M_ALIGN(m, willcpy);
9443                         }
9444                 } else {
9445                         MC_ALIGN(m, willcpy);
9446                 }
9447                 error = uiomove(mtod(m, caddr_t), willcpy, uio);
9448                 if (error) {
9449                         return (error);
9450                 }
9451                 m->m_len = willcpy;
9452                 m->m_nextpkt = 0;
9453                 left -= willcpy;
9454                 if (left > 0) {
9455                         MGET(m->m_next, MB_WAIT, MT_DATA);
9456                         if (m->m_next == NULL) {
9457                                 *mbcnt = 0;
9458                                 return (ENOMEM);
9459                         }
9460                         m = m->m_next;
9461                         m->m_len = 0;
9462                         *mbcnt += MSIZE;
9463                         if (left > (int)MHLEN) {
9464                                 MCLGET(m, MB_WAIT);
9465                                 if (m == NULL) {
9466                                         *mbcnt = 0;
9467                                         return (ENOMEM);
9468                                 }
9469                                 if ((m->m_flags & M_EXT) == 0) {
9470                                         *mbcnt = 0;
9471                                         return (ENOMEM);
9472                                 }
9473                                 *mbcnt += m->m_ext.ext_size;
9474                         }
9475                         cancpy = M_TRAILINGSPACE(m);
9476                         willcpy = min(cancpy, left);
9477                 }
9478         }
9479         return (0);
9480 }
9481
9482 static int
9483 sctp_copy_it_in(struct sctp_inpcb *inp,
9484                 struct sctp_tcb *stcb,
9485                 struct sctp_association *asoc,
9486                 struct sctp_nets *net,
9487                 struct sctp_sndrcvinfo *srcv,
9488                 struct uio *uio,
9489                 int flags)
9490 {
9491         /* This routine must be very careful in
9492          * its work. Protocol processing is
9493          * up and running so care must be taken to
9494          * spl...() when you need to do something
9495          * that may effect the stcb/asoc. The sb is
9496          * locked however. When data is copied the
9497          * protocol processing should be enabled since
9498          * this is a slower operation...
9499          */
9500         struct socket *so;
9501         int error = 0;
9502         int frag_size, mbcnt = 0, mbcnt_e = 0;
9503         unsigned int sndlen;
9504         unsigned int tot_demand;
9505         int tot_out, dataout;
9506         struct sctp_tmit_chunk *chk;
9507         struct mbuf *mm;
9508         struct sctp_stream_out *strq;
9509         uint32_t my_vtag;
9510         int resv_in_first;
9511
9512         crit_enter();
9513         so = stcb->sctp_socket;
9514         chk = NULL;
9515         mm = NULL;
9516
9517         sndlen = uio->uio_resid;
9518         /* lock the socket buf */
9519         SOCKBUF_LOCK(&so->so_snd);
9520         error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
9521         if (error)
9522                 goto out_locked;
9523
9524         /* will it ever fit ? */
9525         if (sndlen > so->so_snd.ssb_hiwat) {
9526                 /* It will NEVER fit */
9527                 error = EMSGSIZE;
9528                 crit_exit();
9529                 goto release;
9530         }
9531         /* Do I need to block? */
9532         if ((so->so_snd.ssb_hiwat <
9533             (sndlen + asoc->total_output_queue_size)) ||
9534             (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9535             (asoc->total_output_mbuf_queue_size >
9536             so->so_snd.ssb_mbmax)
9537         ) {
9538                 /* prune any prsctp bufs out */
9539                 if (asoc->peer_supports_prsctp) {
9540                         sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9541                 }
9542                 /*
9543                  * We store off a pointer to the endpoint.
9544                  * Since on return from this we must check to
9545                  * see if an so_error is set. If so we may have
9546                  * been reset and our stcb destroyed. Returning
9547                  * an error will flow back to the user...
9548                  */
9549                 while ((so->so_snd.ssb_hiwat <
9550                     (sndlen + asoc->total_output_queue_size)) ||
9551                     (asoc->chunks_on_out_queue >
9552                     sctp_max_chunks_on_queue) ||
9553                     (asoc->total_output_mbuf_queue_size >
9554                     so->so_snd.ssb_mbmax)
9555                 ) {
9556                         if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
9557                                 /* Non-blocking io in place */
9558                                 error = EWOULDBLOCK;
9559                                 goto release;
9560                         }
9561                         inp->sctp_tcb_at_block = (void *)stcb;
9562                         inp->error_on_block = 0;
9563 #ifdef SCTP_BLK_LOGGING
9564                         sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9565                             so, asoc);
9566 #endif
9567                         ssb_unlock(&so->so_snd);
9568                         SCTP_TCB_UNLOCK(stcb);
9569                         error = ssb_wait(&so->so_snd);
9570                         SCTP_INP_RLOCK(inp);
9571                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9572                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9573                                 /* Should I really unlock ? */
9574                                 SCTP_INP_RUNLOCK(inp);
9575                                 error = EFAULT;
9576                                 goto out_locked;
9577                         }
9578                         SCTP_TCB_LOCK(stcb);
9579                         SCTP_INP_RUNLOCK(inp);
9580
9581                         inp->sctp_tcb_at_block = 0;
9582 #ifdef SCTP_BLK_LOGGING
9583                         sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9584                             so, asoc);
9585 #endif
9586                         if (inp->error_on_block) {
9587                                 /*
9588                                  * if our asoc was killed, the free code
9589                                  * (in sctp_pcb.c) will save a error in
9590                                  * here for us
9591                                  */
9592                                 error = inp->error_on_block;
9593                                 crit_exit();
9594                                 goto out_locked;
9595                         }
9596                         if (error) {
9597                                 crit_exit();
9598                                 goto out_locked;
9599                         }
9600                         /* did we encounter a socket error? */
9601                         if (so->so_error) {
9602                                 error = so->so_error;
9603                                 crit_exit();
9604                                 goto out_locked;
9605                         }
9606                         error = ssb_lock(&so->so_snd, M_WAITOK);
9607                         if (error) {
9608                                 /* Can't aquire the lock */
9609                                 crit_exit();
9610                                 goto out_locked;
9611                         }
9612 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9613                         if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9614 #else
9615                         if (so->so_state & SS_CANTSENDMORE) {
9616 #endif
9617                                 /* The socket is now set not to sendmore.. its gone */
9618                                 error = EPIPE;
9619                                 crit_exit();
9620                                 goto release;
9621                         }
9622                         if (so->so_error) {
9623                                 error = so->so_error;
9624                                 crit_exit();
9625                                 goto release;
9626                         }
9627                         if (asoc->peer_supports_prsctp) {
9628                                 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9629                         }
9630                 }
9631         }
9632         dataout = tot_out = uio->uio_resid;
9633         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9634                 resv_in_first = SCTP_MED_OVERHEAD;
9635         } else {
9636                 resv_in_first = SCTP_MED_V4_OVERHEAD;
9637         }
9638
9639         /* Are we aborting? */
9640         if (srcv->sinfo_flags & MSG_ABORT) {
9641                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9642                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9643                         /* It has to be up before we abort */
9644                         /* how big is the user initiated abort? */
9645
9646                         /* I wonder about doing a MGET without a splnet set.
9647                          * it is done that way in the sosend code so I guess
9648                          * it is ok :-0
9649                          */
9650                         MGETHDR(mm, MB_WAIT, MT_DATA);
9651                         if (mm) {
9652                                 struct sctp_paramhdr *ph;
9653
9654                                 tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9655                                 if (tot_demand > MHLEN) {
9656                                         if (tot_demand > MCLBYTES) {
9657                                                 /* truncate user data */
9658                                                 tot_demand = MCLBYTES;
9659                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9660                                         }
9661                                         MCLGET(mm, MB_WAIT);
9662                                         if ((mm->m_flags & M_EXT) == 0) {
9663                                                 /* truncate further */
9664                                                 tot_demand = MHLEN;
9665                                                 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9666                                         }
9667                                 }
9668                                 /* now move forward the data pointer */
9669                                 ph = mtod(mm, struct sctp_paramhdr *);
9670                                 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9671                                 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9672                                 ph++;
9673                                 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9674                                 mm->m_len = mm->m_pkthdr.len;
9675                                 error = uiomove((caddr_t)ph, (int)tot_out, uio);
9676                                 if (error) {
9677                                         /*
9678                                          * Here if we can't get his data we
9679                                          * still abort we just don't get to
9680                                          * send the users note :-0
9681                                          */
9682                                         sctp_m_freem(mm);
9683                                         mm = NULL;
9684                                 }
9685                         }
9686                         ssb_unlock(&so->so_snd);
9687                         SOCKBUF_UNLOCK(&so->so_snd);
9688                         sctp_abort_an_association(stcb->sctp_ep, stcb,
9689                                                   SCTP_RESPONSE_TO_USER_REQ,
9690                                                   mm);
9691                         mm = NULL;
9692                         crit_exit();
9693                         goto out_notlocked;
9694                 }
9695                 crit_exit();
9696                 goto release;
9697         }
9698
9699         /* Now can we send this? */
9700         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9701             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9702             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9703             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9704                 /* got data while shutting down */
9705                 error = ECONNRESET;
9706                 crit_exit();
9707                 goto release;
9708         }
9709         /* Is the stream no. valid? */
9710         if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9711                 /* Invalid stream number */
9712                 error = EINVAL;
9713                 crit_exit();
9714                 goto release;
9715         }
9716         if (asoc->strmout == NULL) {
9717                 /* huh? software error */
9718 #ifdef SCTP_DEBUG
9719                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9720                         kprintf("software error in sctp_copy_it_in\n");
9721                 }
9722 #endif
9723                 error = EFAULT;
9724                 crit_exit();
9725                 goto release;
9726         }
9727         if ((srcv->sinfo_flags & MSG_EOF) &&
9728             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9729             (tot_out == 0)) {
9730                 crit_exit();
9731                 goto zap_by_it_now;
9732         }
9733         if (tot_out == 0) {
9734                 /* not allowed */
9735                 error = EMSGSIZE;
9736                 crit_exit();
9737                 goto release;
9738         }
9739         /* save off the tag */
9740         my_vtag = asoc->my_vtag;
9741         strq = &asoc->strmout[srcv->sinfo_stream];
9742         /* First lets figure out the "chunking" point */
9743         frag_size = sctp_get_frag_point(stcb, asoc);
9744
9745         /* two choices here, it all fits in one chunk or
9746          * we need multiple chunks.
9747          */
9748         crit_exit();
9749         SOCKBUF_UNLOCK(&so->so_snd);
9750         if (tot_out <= frag_size) {
9751                 /* no need to setup a template */
9752                 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9753                 if (chk == NULL) {
9754                         error = ENOMEM;
9755                         SOCKBUF_LOCK(&so->so_snd);
9756                         goto release;
9757                 }
9758                 sctppcbinfo.ipi_count_chunk++;
9759                 sctppcbinfo.ipi_gencnt_chunk++;
9760                 asoc->chunks_on_out_queue++;
9761                 MGETHDR(mm, MB_WAIT, MT_DATA);
9762                 if (mm == NULL) {
9763                         error = ENOMEM;
9764                         goto clean_up;
9765                 }
9766                 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9767                 if (error)
9768                         goto clean_up;
9769                 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9770                 chk->mbcnt = mbcnt_e;
9771                 mbcnt += mbcnt_e;
9772                 mbcnt_e = 0;
9773                 mm->m_pkthdr.len = tot_out;
9774                 chk->data = mm;
9775                 mm = NULL;
9776
9777                 /* the actual chunk flags */
9778                 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9779                 chk->whoTo->ref_count++;
9780
9781                 /* fix up the send_size if it is not present */
9782                 chk->send_size = tot_out;
9783                 chk->book_size = chk->send_size;
9784                 /* ok, we are commited */
9785                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9786                         /* bump the ssn if we are unordered. */
9787                         strq->next_sequence_sent++;
9788                 }
9789                 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9790                         asoc->sent_queue_cnt_removeable++;
9791                 }
9792                 crit_enter();
9793                 if ((asoc->state == 0) ||
9794                     (my_vtag != asoc->my_vtag) ||
9795                     (so != inp->sctp_socket) ||
9796                     (inp->sctp_socket == 0)) {
9797                         /* connection was aborted */
9798                         crit_exit();
9799                         error = ECONNRESET;
9800                         goto clean_up;
9801                 }
9802                 asoc->stream_queue_cnt++;
9803                 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9804                 /* now check if this stream is on the wheel */
9805                 if ((strq->next_spoke.tqe_next == NULL) &&
9806                     (strq->next_spoke.tqe_prev == NULL)) {
9807                         /* Insert it on the wheel since it is not
9808                          * on it currently
9809                          */
9810                         sctp_insert_on_wheel(asoc, strq);
9811                 }
9812                 crit_exit();
9813 clean_up:
9814                 if (error) {
9815                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9816                         sctppcbinfo.ipi_count_chunk--;
9817                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9818                                 panic("Chunk count is negative");
9819                         }
9820                         SOCKBUF_LOCK(&so->so_snd);
9821                         goto release;
9822                 }
9823         } else {
9824                 /* we need to setup a template */
9825                 struct sctp_tmit_chunk template;
9826                 struct sctpchunk_listhead tmp;
9827
9828                 /* setup the template */
9829                 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9830
9831                 /* Prepare the temp list */
9832                 TAILQ_INIT(&tmp);
9833
9834                 /* Template is complete, now time for the work */
9835                 while (tot_out > 0) {
9836                         /* Get a chunk */
9837                         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9838                         if (chk == NULL) {
9839                                 /*
9840                                  * ok we must spin through and dump anything
9841                                  * we have allocated and then jump to the
9842                                  * no_membad
9843                                  */
9844                                 error = ENOMEM;
9845                         }
9846                         sctppcbinfo.ipi_count_chunk++;
9847                         asoc->chunks_on_out_queue++;
9848
9849                         sctppcbinfo.ipi_gencnt_chunk++;
9850                         *chk = template;
9851                         chk->whoTo->ref_count++;
9852                         MGETHDR(chk->data, MB_WAIT, MT_DATA);
9853                         if (chk->data == NULL) {
9854                                 error = ENOMEM;
9855                                 goto temp_clean_up;
9856                         }
9857                         tot_demand = min(tot_out, frag_size);
9858                         error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9859                         if (error)
9860                                 goto temp_clean_up;
9861                         /* now fix the chk->send_size */
9862                         chk->mbcnt = mbcnt_e;
9863                         mbcnt += mbcnt_e;
9864                         mbcnt_e = 0;
9865                         chk->send_size = tot_demand;
9866                         chk->data->m_pkthdr.len = tot_demand;
9867                         chk->book_size = chk->send_size;
9868                         if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9869                                 asoc->sent_queue_cnt_removeable++;
9870                         }
9871                         TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9872                         tot_out -= tot_demand;
9873                 }
9874                 /* Now the tmp list holds all chunks and data */
9875                 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9876                         /* bump the ssn if we are unordered. */
9877                         strq->next_sequence_sent++;
9878                 }
9879                 /* Mark the first/last flags. This will
9880                  * result int a 3 for a single item on the list
9881                  */
9882                 chk = TAILQ_FIRST(&tmp);
9883                 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9884                 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9885                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9886
9887                 /* now move it to the streams actual queue */
9888                 /* first stop protocol processing */
9889                 crit_enter();
9890                 if ((asoc->state == 0) ||
9891                     (my_vtag != asoc->my_vtag) ||
9892                     (so != inp->sctp_socket) ||
9893                     (inp->sctp_socket == 0)) {
9894                         /* connection was aborted */
9895                         crit_exit();
9896                         error = ECONNRESET;
9897                         goto temp_clean_up;
9898                 }
9899                 chk = TAILQ_FIRST(&tmp);
9900                 while (chk) {
9901                         chk->data->m_nextpkt = 0;
9902                         TAILQ_REMOVE(&tmp, chk, sctp_next);
9903                         asoc->stream_queue_cnt++;
9904                         TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9905                         chk = TAILQ_FIRST(&tmp);
9906                 }
9907                 /* now check if this stream is on the wheel */
9908                 if ((strq->next_spoke.tqe_next == NULL) &&
9909                     (strq->next_spoke.tqe_prev == NULL)) {
9910                         /* Insert it on the wheel since it is not
9911                          * on it currently
9912                          */
9913                         sctp_insert_on_wheel(asoc, strq);
9914                 }
9915                 /* Ok now we can allow pping */
9916                 crit_exit();
9917 temp_clean_up:
9918                 if (error) {
9919                         SOCKBUF_LOCK(&so->so_snd);
9920                         chk = TAILQ_FIRST(&tmp);
9921                         while (chk) {
9922                                 if (chk->data) {
9923                                         sctp_m_freem(chk->data);
9924                                         chk->data = NULL;
9925                                 }
9926                                 TAILQ_REMOVE(&tmp, chk, sctp_next);
9927                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9928                                 sctppcbinfo.ipi_count_chunk--;
9929                                 asoc->chunks_on_out_queue--;
9930                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9931                                         panic("Chunk count is negative");
9932                                 }
9933                                 sctppcbinfo.ipi_gencnt_chunk++;
9934                                 chk = TAILQ_FIRST(&tmp);
9935                         }
9936                         goto release;
9937                 }
9938         }
9939 zap_by_it_now:
9940 #ifdef SCTP_MBCNT_LOGGING
9941         sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9942                        asoc->total_output_queue_size,
9943                        dataout,
9944                        asoc->total_output_mbuf_queue_size,
9945                        mbcnt);
9946 #endif
9947         crit_enter();
9948         SOCKBUF_LOCK(&so->so_snd);
9949         asoc->total_output_queue_size += dataout;
9950         asoc->total_output_mbuf_queue_size += mbcnt;
9951         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
9952             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
9953                 so->so_snd.ssb_cc += dataout;
9954                 so->so_snd.ssb_mbcnt += mbcnt;
9955         }
9956         if ((srcv->sinfo_flags & MSG_EOF) &&
9957             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
9958                 ) {
9959                 int some_on_streamwheel = 0;
9960                 error = 0;
9961                 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
9962                         /* Check to see if some data queued */
9963                         struct sctp_stream_out *outs;
9964                         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
9965                                 if (!TAILQ_EMPTY(&outs->outqueue)) {
9966                                         some_on_streamwheel = 1;
9967                                         break;
9968                                 }
9969                         }
9970                 }
9971                 if (TAILQ_EMPTY(&asoc->send_queue) &&
9972                     TAILQ_EMPTY(&asoc->sent_queue) &&
9973                     (some_on_streamwheel == 0)) {
9974                         /* there is nothing queued to send, so I'm done... */
9975                         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
9976                             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
9977                                 /* only send SHUTDOWN the first time through */
9978 #ifdef SCTP_DEBUG
9979                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
9980                                         kprintf("%s:%d sends a shutdown\n",
9981                                                __FILE__,
9982                                                __LINE__
9983                                                 );
9984                                 }
9985 #endif
9986                                 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
9987                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
9988                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
9989                                                  asoc->primary_destination);
9990                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
9991                                                  asoc->primary_destination);
9992                         }
9993                 } else {
9994                         /*
9995                          * we still got (or just got) data to send, so set
9996                          * SHUTDOWN_PENDING
9997                          */
9998                         /*
9999                          * XXX sockets draft says that MSG_EOF should be sent
10000                          * with no data.  currently, we will allow user data
10001                          * to be sent first and move to SHUTDOWN-PENDING
10002                          */
10003                         asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
10004                 }
10005         }
10006         crit_exit();
10007 #ifdef SCTP_DEBUG
10008         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
10009                 kprintf("++total out:%d total_mbuf_out:%d\n",
10010                        (int)asoc->total_output_queue_size,
10011                        (int)asoc->total_output_mbuf_queue_size);
10012         }
10013 #endif
10014
10015 release:
10016         ssb_unlock(&so->so_snd);
10017 out_locked:
10018         SOCKBUF_UNLOCK(&so->so_snd);
10019 out_notlocked:
10020         if (mm)
10021                 sctp_m_freem(mm);
10022         return (error);
10023 }
10024
10025
10026 int
10027 sctp_sosend(struct socket *so,
10028 #ifdef __NetBSD__
10029             struct mbuf *addr_mbuf,
10030 #else
10031             struct sockaddr *addr,
10032 #endif
10033             struct uio *uio,
10034             struct mbuf *top,
10035             struct mbuf *control,
10036 #if defined(__NetBSD__) || defined(__APPLE__)
10037             int flags
10038 #else
10039             int flags,
10040 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10041             struct thread *p
10042 #else
10043             struct proc *p
10044 #endif
10045 #endif
10046 )
10047 {
10048         unsigned int sndlen;
10049         int error, use_rcvinfo;
10050         int queue_only = 0, queue_only_for_init=0;
10051         int un_sent = 0;
10052         int now_filled=0;
10053         struct sctp_inpcb *inp;
10054         struct sctp_tcb *stcb=NULL;
10055         struct sctp_sndrcvinfo srcv;
10056         struct timeval now;
10057         struct sctp_nets *net;
10058         struct sctp_association *asoc;
10059         struct sctp_inpcb *t_inp;
10060         int create_lock_applied = 0;
10061 #if defined(__APPLE__)
10062         struct proc *p = current_proc();
10063 #elif defined(__NetBSD__)
10064         struct proc *p = curproc; /* XXX */
10065         struct sockaddr *addr = NULL;
10066         if (addr_mbuf)
10067                 addr = mtod(addr_mbuf, struct sockaddr *);
10068 #endif
10069
10070         error = use_rcvinfo = 0;
10071         net = NULL;
10072         stcb = NULL;
10073         asoc = NULL;
10074         t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
10075         if (uio)
10076                 sndlen = uio->uio_resid;
10077         else
10078                 sndlen = top->m_pkthdr.len;
10079
10080
10081         crit_enter();
10082
10083         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
10084             (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
10085                 /* The listner can NOT send */
10086                 error = EFAULT;
10087                 crit_exit();
10088                 goto out;
10089         }
10090         if (addr) {
10091                 SCTP_ASOC_CREATE_LOCK(inp);
10092                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
10093                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
10094                         /* Should I really unlock ? */
10095                         error = EFAULT;
10096                         crit_exit();
10097                         goto out;
10098
10099                 }
10100                 create_lock_applied = 1;
10101                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
10102                     (addr->sa_family == AF_INET6)) {
10103                         error = EINVAL;
10104                         crit_exit();
10105                         goto out;
10106                 }
10107         }
10108         /* now we must find the assoc */
10109         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
10110                 SCTP_INP_RLOCK(inp);
10111                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
10112                 if (stcb == NULL) {
10113                         SCTP_INP_RUNLOCK(inp);
10114                         error = ENOTCONN;
10115                         crit_exit();
10116                         goto out;
10117                 }
10118                 SCTP_TCB_LOCK(stcb);
10119                 SCTP_INP_RUNLOCK(inp);
10120                 net = stcb->asoc.primary_destination;
10121         }
10122         /* get control */
10123         if (control) {
10124                 /* process cmsg snd/rcv info (maybe a assoc-id) */
10125                 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10126                                    sizeof(srcv))) {
10127                         /* got one */
10128                         if (srcv.sinfo_flags & MSG_SENDALL) {
10129                                 /* its a sendall */
10130                                 sctppcbinfo.mbuf_track--;
10131                                 sctp_m_freem(control);
10132
10133                                 if (create_lock_applied) {
10134                                         SCTP_ASOC_CREATE_UNLOCK(inp);
10135                                         create_lock_applied = 0;
10136                                 }
10137                                 return (sctp_sendall(inp, uio, top, &srcv));
10138                         }
10139                         use_rcvinfo = 1;
10140                 }
10141         }
10142         if (stcb == NULL) {
10143                 /* Need to do a lookup */
10144                 if (use_rcvinfo && srcv.sinfo_assoc_id) {
10145                         stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
10146                         /*
10147                          * Question: Should I error here if the assoc_id is
10148                          * no longer valid? i.e. I can't find it?
10149                          */
10150                         if ((stcb) &&
10151                             (addr != NULL)) {
10152                                 /* Must locate the net structure */
10153                                 net = sctp_findnet(stcb, addr);
10154                         }
10155                 }
10156                 if (stcb == NULL) {
10157                         if (addr != NULL) {
10158                                 /* Since we did not use findep we must
10159                                  * increment it, and if we don't find a
10160                                  * tcb decrement it.
10161                                  */
10162                                 SCTP_INP_WLOCK(inp);
10163                                 SCTP_INP_INCR_REF(inp);
10164                                 SCTP_INP_WUNLOCK(inp);
10165                                 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
10166                                 if (stcb == NULL) {
10167                                         SCTP_INP_WLOCK(inp);
10168                                         SCTP_INP_DECR_REF(inp);
10169                                         SCTP_INP_WUNLOCK(inp);
10170                                 }
10171                         }
10172                 }
10173         }
10174         if ((stcb == NULL) &&
10175             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
10176                 error = ENOTCONN;
10177                 crit_exit();
10178                 goto out;
10179         } else if ((stcb == NULL) && (addr == NULL)) {
10180                 error = ENOENT;
10181                 crit_exit();
10182                 goto out;
10183         } else if (stcb == NULL) {
10184                 /* UDP style, we must go ahead and start the INIT process */
10185                 if ((use_rcvinfo) &&
10186                     (srcv.sinfo_flags & MSG_ABORT)) {
10187                         /* User asks to abort a non-existant asoc */
10188                         error = ENOENT;
10189                         crit_exit();
10190                         goto out;
10191                 }
10192                 /* get an asoc/stcb struct */
10193                 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
10194                 if (stcb == NULL) {
10195                         /* Error is setup for us in the call */
10196                         crit_exit();
10197                         goto out;
10198                 }
10199                 if (create_lock_applied) {
10200                         SCTP_ASOC_CREATE_UNLOCK(inp);
10201                         create_lock_applied = 0;
10202                 } else {
10203                         kprintf("Huh-3? create lock should have been on??\n");
10204                 }
10205                 /* Turn on queue only flag to prevent data from being sent */
10206                 queue_only = 1;
10207                 asoc = &stcb->asoc;
10208                 asoc->state = SCTP_STATE_COOKIE_WAIT;
10209                 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
10210                 if (control) {
10211                         /* see if a init structure exists in cmsg headers */
10212                         struct sctp_initmsg initm;
10213                         int i;
10214                         if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
10215                                 /* we have an INIT override of the default */
10216                                 if (initm.sinit_max_attempts)
10217                                         asoc->max_init_times = initm.sinit_max_attempts;
10218                                 if (initm.sinit_num_ostreams)
10219                                         asoc->pre_open_streams = initm.sinit_num_ostreams;
10220                                 if (initm.sinit_max_instreams)
10221                                         asoc->max_inbound_streams = initm.sinit_max_instreams;
10222                                 if (initm.sinit_max_init_timeo)
10223                                         asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10224                                 if (asoc->streamoutcnt < asoc->pre_open_streams) {
10225                                         /* Default is NOT correct */
10226 #ifdef SCTP_DEBUG
10227                                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10228                                                 kprintf("Ok, defout:%d pre_open:%d\n",
10229                                                        asoc->streamoutcnt, asoc->pre_open_streams);
10230                                         }
10231 #endif
10232                                         FREE(asoc->strmout, M_PCB);
10233                                         asoc->strmout = NULL;
10234                                         asoc->streamoutcnt = asoc->pre_open_streams;
10235
10236                                         /* What happesn if this fails? .. we panic ...*/
10237                                         MALLOC(asoc->strmout,
10238                                                struct sctp_stream_out *,
10239                                                asoc->streamoutcnt *
10240                                                sizeof(struct sctp_stream_out),
10241                                                M_PCB, MB_WAIT);
10242                                         for (i = 0; i < asoc->streamoutcnt; i++) {
10243                                                 /*
10244                                                  * inbound side must be set to 0xffff,
10245                                                  * also NOTE when we get the INIT-ACK
10246                                                  * back (for INIT sender) we MUST
10247                                                  * reduce the count (streamoutcnt) but
10248                                                  * first check if we sent to any of the
10249                                                  * upper streams that were dropped (if
10250                                                  * some were). Those that were dropped
10251                                                  * must be notified to the upper layer
10252                                                  * as failed to send.
10253                                                  */
10254                                                 asoc->strmout[i].next_sequence_sent = 0x0;
10255                                                 TAILQ_INIT(&asoc->strmout[i].outqueue);
10256                                                 asoc->strmout[i].stream_no = i;
10257                                                 asoc->strmout[i].next_spoke.tqe_next = 0;
10258                                                 asoc->strmout[i].next_spoke.tqe_prev = 0;
10259                                         }
10260                                 }
10261                         }
10262
10263                 }
10264                 /* out with the INIT */
10265                 queue_only_for_init = 1;
10266                 sctp_send_initiate(inp, stcb);
10267                 /*
10268                  * we may want to dig in after this call and adjust the MTU
10269                  * value. It defaulted to 1500 (constant) but the ro structure
10270                  * may now have an update and thus we may need to change it
10271                  * BEFORE we append the message.
10272                  */
10273                 net = stcb->asoc.primary_destination;
10274                 asoc = &stcb->asoc;
10275         } else {
10276                 asoc = &stcb->asoc;
10277         }
10278         if (create_lock_applied) {
10279                 SCTP_ASOC_CREATE_UNLOCK(inp);
10280                 create_lock_applied = 0;
10281         }
10282         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10283             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10284                 queue_only = 1;
10285         }
10286         if (use_rcvinfo == 0) {
10287                 /* Grab the default stuff from the asoc */
10288                 srcv = stcb->asoc.def_send;
10289         }
10290         /* we are now done with all control */
10291         if (control) {
10292                 sctp_m_freem(control);
10293                 control = NULL;
10294         }
10295
10296         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10297             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10298             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10299             (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10300                 if ((use_rcvinfo) &&
10301                     (srcv.sinfo_flags & MSG_ABORT)) {
10302                         ;
10303                 } else {
10304                         error = ECONNRESET;
10305                         crit_exit();
10306                         goto out;
10307                 }
10308         }
10309         /* Ok, we will attempt a msgsnd :> */
10310         if (p)
10311 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10312                 p->td_lwp->lwp_ru.ru_msgsnd++;
10313 #else
10314         p->p_stats->p_ru.ru_msgsnd++;
10315 #endif
10316
10317         if (stcb) {
10318                 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10319                         /* we take the override or the unconfirmed */
10320                         ;
10321                 } else {
10322                         net = stcb->asoc.primary_destination;
10323                 }
10324         }
10325
10326         if (top == NULL) {
10327                 /* Must copy it all in from user land. The
10328                  * socket buf is locked but we don't suspend
10329                  * protocol processing until we are ready to
10330                  * send/queue it.
10331                  */
10332                 crit_exit();
10333                 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10334                 if (error)
10335                         goto out;
10336         } else {
10337                 /* Here we must either pull in the user data to chunk
10338                  * buffers, or use top to do a msg_append.
10339                  */
10340                 error = sctp_msg_append(stcb, net, top, &srcv, flags);
10341                 crit_exit();
10342                 if (error)
10343                         goto out;
10344                 /* zap the top since it is now being used */
10345                 top = 0;
10346         }
10347
10348         if (net->flight_size > net->cwnd) {
10349                 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10350                 queue_only = 1;
10351
10352         } else if (asoc->ifp_had_enobuf) {
10353                 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10354                 queue_only = 1;
10355         } else {
10356                 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10357                            ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10358                            SCTP_MED_OVERHEAD);
10359
10360                 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10361                     (stcb->asoc.total_flight > 0) &&
10362                     (un_sent < (int)stcb->asoc.smallest_mtu)) {
10363
10364                         /* Ok, Nagle is set on and we have data outstanding. Don't
10365                          * send anything and let SACKs drive out the data unless we
10366                          * have a "full" segment to send.
10367                          */
10368                         sctp_pegs[SCTP_NAGLE_NOQ]++;
10369                         queue_only = 1;
10370                 } else {
10371                         sctp_pegs[SCTP_NAGLE_OFF]++;
10372                 }
10373         }
10374         if (queue_only_for_init) {
10375                 /* It is possible to have a turn around of the
10376                  * INIT/INIT-ACK/COOKIE before I have a chance to
10377                  * copy in the data. In such a case I DO want to
10378                  * send it out by reversing the queue only flag.
10379                  */
10380                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10381                     (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10382                         /* yep, reverse it */
10383                         queue_only = 0;
10384                 }
10385         }
10386
10387         if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10388                 /* we can attempt to send too.*/
10389 #ifdef SCTP_DEBUG
10390                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10391                         kprintf("USR Send calls sctp_chunk_output\n");
10392                 }
10393 #endif
10394                 crit_enter();
10395                 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10396                 sctp_chunk_output(inp, stcb, 0);
10397                 crit_exit();
10398         } else if ((queue_only == 0) &&
10399                    (stcb->asoc.peers_rwnd == 0) &&
10400                    (stcb->asoc.total_flight == 0)) {
10401                 /* We get to have a probe outstanding */
10402                 crit_enter();
10403                 sctp_from_user_send = 1;
10404                 sctp_chunk_output(inp, stcb, 0);
10405                 sctp_from_user_send = 0;
10406                 crit_exit();
10407
10408         } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10409                 int num_out, reason, cwnd_full;
10410                 /* Here we do control only */
10411                 crit_enter();
10412                 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10413                                       &reason, 1, &cwnd_full, 1, &now, &now_filled);
10414                 crit_exit();
10415         }
10416 #ifdef SCTP_DEBUG
10417         if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10418                 kprintf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10419                        queue_only, stcb->asoc.peers_rwnd, un_sent,
10420                        stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10421                        stcb->asoc.total_output_queue_size);
10422         }
10423 #endif
10424  out:
10425         if (create_lock_applied) {
10426                 SCTP_ASOC_CREATE_UNLOCK(inp);
10427                 create_lock_applied = 0;
10428         }
10429         if (stcb)
10430                 SCTP_TCB_UNLOCK(stcb);
10431         if (top)
10432                 sctp_m_freem(top);
10433         if (control)
10434                 sctp_m_freem(control);
10435         return (error);
10436 }