xref: /netbsd-src/sys/netinet/sctp_output.c (revision 53b02e147d4ed531c0d2a5ca9b3e8026ba3e99b5)
1 /*	$NetBSD: sctp_output.c,v 1.28 2021/12/05 04:56:40 msaitoh Exp $ */
2 /*	$KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 #include <sys/cdefs.h>
33 __KERNEL_RCSID(0, "$NetBSD: sctp_output.c,v 1.28 2021/12/05 04:56:40 msaitoh Exp $");
34 
35 #ifdef _KERNEL_OPT
36 #include "opt_ipsec.h"
37 #include "opt_inet.h"
38 #include "opt_sctp.h"
39 #endif /* _KERNEL_OPT */
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/domain.h>
46 #include <sys/protosw.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/proc.h>
50 #include <sys/kernel.h>
51 #include <sys/sysctl.h>
52 #include <sys/resourcevar.h>
53 #include <sys/uio.h>
54 #ifdef INET6
55 #include <sys/domain.h>
56 #endif
57 
58 #include <machine/limits.h>
59 #include <machine/cpu.h>
60 
61 #include <net/if.h>
62 #include <net/if_types.h>
63 
64 #include <net/route.h>
65 
66 #include <netinet/in.h>
67 #include <netinet/in_systm.h>
68 #include <netinet/ip.h>
69 #include <netinet/in_pcb.h>
70 #include <netinet/in_var.h>
71 #include <netinet/ip_var.h>
72 
73 #ifdef INET6
74 #include <netinet/ip6.h>
75 #include <netinet6/ip6_var.h>
76 #include <netinet6/scope6_var.h>
77 #include <netinet6/nd6.h>
78 
79 #include <netinet6/in6_pcb.h>
80 
81 #include <netinet/icmp6.h>
82 
83 #endif /* INET6 */
84 
85 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__)
86 #ifndef in6pcb
87 #define in6pcb		inpcb
88 #endif
89 #endif
90 
91 #include <netinet/sctp_pcb.h>
92 
93 #ifdef IPSEC
94 #include <netipsec/ipsec.h>
95 #include <netipsec/key.h>
96 #endif /* IPSEC */
97 
98 #include <netinet/sctp_var.h>
99 #include <netinet/sctp_header.h>
100 #include <netinet/sctputil.h>
101 #include <netinet/sctp_pcb.h>
102 #include <netinet/sctp_output.h>
103 #include <netinet/sctp_uio.h>
104 #include <netinet/sctputil.h>
105 #include <netinet/sctp_hashdriver.h>
106 #include <netinet/sctp_timer.h>
107 #include <netinet/sctp_asconf.h>
108 #include <netinet/sctp_indata.h>
109 
110 #ifdef SCTP_DEBUG
111 extern uint32_t sctp_debug_on;
112 #endif
113 
114 extern int sctp_peer_chunk_oh;
115 
116 static int
117 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
118 {
119 	struct cmsghdr cmh;
120 	int tlen, at;
121 
122 	tlen = control->m_len;
123 	at = 0;
124 	/*
125 	 * Independent of how many mbufs, find the c_type inside the control
126 	 * structure and copy out the data.
127 	 */
128 	while (at < tlen) {
129 		if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
130 			/* not enough room for one more we are done. */
131 			return (0);
132 		}
133 		m_copydata(control, at, sizeof(cmh), (void *)&cmh);
134 		if ((cmh.cmsg_len + at) > tlen) {
135 			/*
136 			 * this is real messed up since there is not enough
137 			 * data here to cover the cmsg header. We are done.
138 			 */
139 			return (0);
140 		}
141 		if ((cmh.cmsg_level == IPPROTO_SCTP) &&
142 		    (c_type == cmh.cmsg_type)) {
143 			/* found the one we want, copy it out */
144 			at += CMSG_ALIGN(sizeof(struct cmsghdr));
145 			if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
146 				/*
147 				 * space of cmsg_len after header not
148 				 * big enough
149 				 */
150 				return (0);
151 			}
152 			m_copydata(control, at, cpsize, data);
153 			return (1);
154 		 } else {
155 			at += CMSG_ALIGN(cmh.cmsg_len);
156 			if (cmh.cmsg_len == 0) {
157 				break;
158 			}
159 		}
160 	}
161 	/* not found */
162 	return (0);
163 }
164 
165 static struct mbuf *
166 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
167 {
168 	struct sctp_paramhdr *parmh;
169 	struct mbuf *mret;
170 	int len;
171 	if (ifa->ifa_addr->sa_family == AF_INET) {
172 		len = sizeof(struct sctp_ipv4addr_param);
173 	} else if (ifa->ifa_addr->sa_family == AF_INET6) {
174 		len = sizeof(struct sctp_ipv6addr_param);
175 	} else {
176 		/* unknown type */
177 		return (m);
178 	}
179 
180 	if (M_TRAILINGSPACE(m) >= len) {
181 		/* easy side we just drop it on the end */
182 		parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
183 		mret = m;
184 	} else {
185 		/* Need more space */
186 		mret = m;
187 		while (mret->m_next != NULL) {
188 			mret = mret->m_next;
189 		}
190 		MGET(mret->m_next, M_DONTWAIT, MT_DATA);
191 		if (mret->m_next == NULL) {
192 			/* We are hosed, can't add more addresses */
193 			return (m);
194 		}
195 		mret = mret->m_next;
196 		parmh = mtod(mret, struct sctp_paramhdr *);
197 	}
198 	/* now add the parameter */
199 	if (ifa->ifa_addr->sa_family == AF_INET) {
200 		struct sctp_ipv4addr_param *ipv4p;
201 		struct sockaddr_in *sin;
202 		sin = (struct sockaddr_in *)ifa->ifa_addr;
203 		ipv4p = (struct sctp_ipv4addr_param *)parmh;
204 		parmh->param_type = htons(SCTP_IPV4_ADDRESS);
205 		parmh->param_length = htons(len);
206 		ipv4p->addr = sin->sin_addr.s_addr;
207 		mret->m_len += len;
208 	} else if (ifa->ifa_addr->sa_family == AF_INET6) {
209 		struct sctp_ipv6addr_param *ipv6p;
210 		struct sockaddr_in6 *sin6;
211 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
212 		ipv6p = (struct sctp_ipv6addr_param *)parmh;
213 		parmh->param_type = htons(SCTP_IPV6_ADDRESS);
214 		parmh->param_length = htons(len);
215 		memcpy(ipv6p->addr, &sin6->sin6_addr,
216 		    sizeof(ipv6p->addr));
217 		/* clear embedded scope in the address */
218 		in6_clearscope((struct in6_addr *)ipv6p->addr);
219 		mret->m_len += len;
220 	} else {
221 		return (m);
222 	}
223 	return (mret);
224 }
225 
226 
227 
228 static struct mbuf *
229 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
230     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
231 {
232 	struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
233 	struct sctp_state_cookie *stc;
234 	struct sctp_paramhdr *ph;
235 	uint8_t *signature;
236 	int sig_offset;
237 	uint16_t cookie_sz;
238 
239 	mret = NULL;
240 
241 	MGET(mret, M_DONTWAIT, MT_DATA);
242 	if (mret == NULL) {
243 		return (NULL);
244 	}
245 	copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT);
246 	if (copy_init == NULL) {
247 		sctp_m_freem(mret);
248 		return (NULL);
249 	}
250 	copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
251 	    M_DONTWAIT);
252 	if (copy_initack == NULL) {
253 		sctp_m_freem(mret);
254 		sctp_m_freem(copy_init);
255 		return (NULL);
256 	}
257 	/* easy side we just drop it on the end */
258 	ph = mtod(mret, struct sctp_paramhdr *);
259 	mret->m_len = sizeof(struct sctp_state_cookie) +
260 	    sizeof(struct sctp_paramhdr);
261 	stc = (struct sctp_state_cookie *)((vaddr_t)ph +
262 	    sizeof(struct sctp_paramhdr));
263 	ph->param_type = htons(SCTP_STATE_COOKIE);
264 	ph->param_length = 0;	/* fill in at the end */
265 	/* Fill in the stc cookie data */
266 	*stc = *stc_in;
267 
268 	/* tack the INIT and then the INIT-ACK onto the chain */
269 	cookie_sz = 0;
270 	m_at = mret;
271 	for (m_at = mret; m_at; m_at = m_at->m_next) {
272 		cookie_sz += m_at->m_len;
273 		if (m_at->m_next == NULL) {
274 			m_at->m_next = copy_init;
275 			break;
276 		}
277 	}
278 
279 	for (m_at = copy_init; m_at; m_at = m_at->m_next) {
280 		cookie_sz += m_at->m_len;
281 		if (m_at->m_next == NULL) {
282 			m_at->m_next = copy_initack;
283 			break;
284 		}
285 	}
286 
287 	for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
288 		cookie_sz += m_at->m_len;
289 		if (m_at->m_next == NULL) {
290 			break;
291 		}
292 	}
293 	MGET(sig, M_DONTWAIT, MT_DATA);
294 	if (sig == NULL) {
295 		/* no space */
296 		sctp_m_freem(mret);
297 		sctp_m_freem(copy_init);
298 		sctp_m_freem(copy_initack);
299 		return (NULL);
300 	}
301 	sig->m_len = 0;
302 	m_at->m_next = sig;
303 	sig_offset = 0;
304 	signature = (uint8_t *)(mtod(sig, vaddr_t) + sig_offset);
305 	/* Time to sign the cookie */
306 	sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
307 	    (int)(inp->sctp_ep.current_secret_number)],
308 	    SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
309 	    (uint8_t *)signature);
310 	sig->m_len += SCTP_SIGNATURE_SIZE;
311 	cookie_sz += SCTP_SIGNATURE_SIZE;
312 
313 	ph->param_length = htons(cookie_sz);
314 	return (mret);
315 }
316 
317 
318 static struct sockaddr_in *
319 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
320 {
321 	struct sockaddr_in *sin;
322 	/*
323 	 * Here we determine if its a prefered address. A
324 	 * prefered address means it is the same scope or
325 	 * higher scope then the destination.
326 	 *  L = loopback, P = private, G = global
327 	 * -----------------------------------------
328 	 *  src    |      dest     |    result
329 	 *-----------------------------------------
330 	 *   L     |       L       |    yes
331 	 *-----------------------------------------
332 	 *   P     |       L       |    yes
333 	 *-----------------------------------------
334 	 *   G     |       L       |    yes
335 	 *-----------------------------------------
336 	 *   L     |       P       |    no
337 	 *-----------------------------------------
338 	 *   P     |       P       |    yes
339 	 *-----------------------------------------
340 	 *   G     |       P       |    no
341 	 *-----------------------------------------
342 	 *   L     |       G       |    no
343 	 *-----------------------------------------
344 	 *   P     |       G       |    no
345 	 *-----------------------------------------
346 	 *   G     |       G       |    yes
347 	 *-----------------------------------------
348 	 */
349 
350 	if (ifa->ifa_addr->sa_family != AF_INET) {
351 		/* forget non-v4 */
352 		return (NULL);
353 	}
354 	/* Ok the address may be ok */
355 	sin = (struct sockaddr_in *)ifa->ifa_addr;
356 	if (sin->sin_addr.s_addr == 0) {
357 		return (NULL);
358 	}
359 	*sin_local = *sin_loop = 0;
360 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
361 	    (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
362 		*sin_loop = 1;
363 		*sin_local = 1;
364 	}
365 	if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
366 		*sin_local = 1;
367 	}
368 	if (!loopscope && *sin_loop) {
369 		/* Its a loopback address and we don't have loop scope */
370 		return (NULL);
371 	}
372 	if (!ipv4_scope && *sin_local) {
373 		/* Its a private address, and we don't have private address scope */
374 		return (NULL);
375 	}
376 	if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
377 		/* its a global src and a private dest */
378 		return (NULL);
379 	}
380 	/* its a prefered address */
381 	return (sin);
382 }
383 
384 static struct sockaddr_in *
385 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
386 {
387 	struct sockaddr_in *sin;
388 	/*
389 	 * Here we determine if its a acceptable address. A
390 	 * acceptable address means it is the same scope or
391 	 * higher scope but we can allow for NAT which means
392 	 * its ok to have a global dest and a private src.
393 	 *
394 	 *  L = loopback, P = private, G = global
395 	 * -----------------------------------------
396 	 *  src    |      dest     |    result
397 	 *-----------------------------------------
398 	 *   L     |       L       |    yes
399 	 *-----------------------------------------
400 	 *   P     |       L       |    yes
401 	 *-----------------------------------------
402 	 *   G     |       L       |    yes
403 	 *-----------------------------------------
404 	 *   L     |       P       |    no
405 	 *-----------------------------------------
406 	 *   P     |       P       |    yes
407 	 *-----------------------------------------
408 	 *   G     |       P       |    yes - probably this won't work.
409 	 *-----------------------------------------
410 	 *   L     |       G       |    no
411 	 *-----------------------------------------
412 	 *   P     |       G       |    yes
413 	 *-----------------------------------------
414 	 *   G     |       G       |    yes
415 	 *-----------------------------------------
416 	 */
417 
418 	if (ifa->ifa_addr->sa_family != AF_INET) {
419 		/* forget non-v4 */
420 		return (NULL);
421 	}
422 	/* Ok the address may be ok */
423 	sin = (struct sockaddr_in *)ifa->ifa_addr;
424 	if (sin->sin_addr.s_addr == 0) {
425 		return (NULL);
426 	}
427 	*sin_local = *sin_loop = 0;
428 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
429 	    (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
430 		*sin_loop = 1;
431 		*sin_local = 1;
432 	}
433 	if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
434 		*sin_local = 1;
435 	}
436 	if (!loopscope && *sin_loop) {
437 		/* Its a loopback address and we don't have loop scope */
438 		return (NULL);
439 	}
440 	/* its an acceptable address */
441 	return (sin);
442 }
443 
444 /*
445  * This treats the address list on the ep as a restricted list
446  * (negative list). If a the passed address is listed, then
447  * the address is NOT allowed on the association.
448  */
449 int
450 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
451 {
452 	struct sctp_laddr *laddr;
453 #ifdef SCTP_DEBUG
454 	int cnt=0;
455 #endif
456 	if (stcb == NULL) {
457 		/* There are no restrictions, no TCB :-) */
458 		return (0);
459 	}
460 #ifdef SCTP_DEBUG
461 	LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
462 		cnt++;
463 	}
464 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
465 		printf("There are %d addresses on the restricted list\n", cnt);
466 	}
467 	cnt = 0;
468 #endif
469 	LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
470 		if (laddr->ifa == NULL) {
471 #ifdef SCTP_DEBUG
472 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
473 				printf("Help I have fallen and I can't get up!\n");
474 			}
475 #endif
476 			continue;
477 		}
478 #ifdef SCTP_DEBUG
479 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
480 			cnt++;
481 			printf("Restricted address[%d]:", cnt);
482 			sctp_print_address(laddr->ifa->ifa_addr);
483 		}
484 #endif
485 		if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
486 			/* Yes it is on the list */
487 			return (1);
488 		}
489 	}
490 	return (0);
491 }
492 
493 static int
494 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
495 {
496 	struct sctp_laddr *laddr;
497 
498 	if (ifa == NULL)
499 		return (0);
500 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
501 		if (laddr->ifa == NULL) {
502 #ifdef SCTP_DEBUG
503 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
504 				printf("Help I have fallen and I can't get up!\n");
505 			}
506 #endif
507 			continue;
508 		}
509 		if (laddr->ifa->ifa_addr == NULL)
510 			continue;
511 		if (laddr->ifa == ifa)
512 			/* same pointer */
513 			return (1);
514 		if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
515 			/* skip non compatible address comparison */
516 			continue;
517 		}
518 		if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
519 			/* Yes it is restricted */
520 			return (1);
521 		}
522 	}
523 	return (0);
524 }
525 
526 
527 
528 static struct in_addr
529 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
530 				 struct rtentry *rt,
531 				 uint8_t ipv4_scope,
532 				 uint8_t loopscope)
533 {
534 	struct in_addr ans;
535 	struct sctp_laddr *laddr;
536 	struct sockaddr_in *sin;
537 	struct ifnet *ifn;
538 	struct ifaddr *ifa;
539 	uint8_t sin_loop, sin_local;
540 
541 	/* first question, is the ifn we will emit on
542 	 * in our list, if so, we want that one.
543 	 */
544 	ifn = rt->rt_ifp;
545 	if (ifn) {
546 		/* is a prefered one on the interface we route out? */
547 		IFADDR_READER_FOREACH(ifa, ifn) {
548 			sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
549 			if (sin == NULL)
550 				continue;
551 			if (sctp_is_addr_in_ep(inp, ifa)) {
552 				return (sin->sin_addr);
553 			}
554 		}
555 		/* is an acceptable one on the interface we route out? */
556 		IFADDR_READER_FOREACH(ifa, ifn) {
557 			sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
558 			if (sin == NULL)
559 				continue;
560 			if (sctp_is_addr_in_ep(inp, ifa)) {
561 				return (sin->sin_addr);
562 			}
563 		}
564 	}
565 	/* ok, what about a prefered address in the inp */
566 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
567 	     laddr && (laddr != inp->next_addr_touse);
568 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
569 		if (laddr->ifa == NULL) {
570 			/* address has been removed */
571 			continue;
572 		}
573 		sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
574 		if (sin == NULL)
575 			continue;
576 		return (sin->sin_addr);
577 
578 	}
579 	/* ok, what about an acceptable address in the inp */
580 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
581 	     laddr && (laddr != inp->next_addr_touse);
582 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
583 		if (laddr->ifa == NULL) {
584 			/* address has been removed */
585 			continue;
586 		}
587 		sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
588 		if (sin == NULL)
589 			continue;
590 		return (sin->sin_addr);
591 
592 	}
593 
594 	/* no address bound can be a source for the destination we are in trouble */
595 #ifdef SCTP_DEBUG
596 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
597 		printf("Src address selection for EP, no acceptable src address found for address\n");
598 	}
599 #endif
600 	memset(&ans, 0, sizeof(ans));
601 	return (ans);
602 }
603 
604 
605 
606 static struct in_addr
607 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
608 				  struct sctp_tcb *stcb,
609 				  struct sctp_nets *net,
610 				  struct rtentry *rt,
611  			          uint8_t ipv4_scope,
612 				  uint8_t loopscope,
613 				  int non_asoc_addr_ok)
614 {
615 	/*
616 	 * Here we have two cases, bound all asconf
617 	 * allowed. bound all asconf not allowed.
618 	 *
619 	 */
620 	struct sctp_laddr *laddr, *starting_point;
621 	struct in_addr ans;
622 	struct ifnet *ifn;
623 	struct ifaddr *ifa;
624 	uint8_t sin_loop, sin_local, start_at_beginning=0;
625 	struct sockaddr_in *sin;
626 
627 	/* first question, is the ifn we will emit on
628 	 * in our list, if so, we want that one.
629 	 */
630 	ifn = rt->rt_ifp;
631 
632  	if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
633 		/*
634 		 * Here we use the list of addresses on the endpoint. Then
635 		 * the addresses listed on the "restricted" list is just that,
636 		 * address that have not been added and can't be used (unless
637 		 * the non_asoc_addr_ok is set).
638 		 */
639 #ifdef SCTP_DEBUG
640 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
641 			printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
642 		}
643 #endif
644 		/* first question, is the ifn we will emit on
645 		 * in our list, if so, we want that one.
646 		 */
647 		if (ifn) {
648 			/* first try for an prefered address on the ep */
649 			IFADDR_READER_FOREACH(ifa, ifn) {
650 				if (sctp_is_addr_in_ep(inp, ifa)) {
651 					sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
652 					if (sin == NULL)
653 						continue;
654 					if ((non_asoc_addr_ok == 0) &&
655 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
656 						/* on the no-no list */
657 						continue;
658 					}
659 					return (sin->sin_addr);
660 				}
661 			}
662 			/* next try for an acceptable address on the ep */
663 			IFADDR_READER_FOREACH(ifa, ifn) {
664 				if (sctp_is_addr_in_ep(inp, ifa)) {
665 					sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
666 					if (sin == NULL)
667 						continue;
668 					if ((non_asoc_addr_ok == 0) &&
669 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
670 						/* on the no-no list */
671 						continue;
672 					}
673 					return (sin->sin_addr);
674 				}
675 			}
676 
677 		}
678 		/* if we can't find one like that then we must
679 		 * look at all addresses bound to pick one at
680 		 * first prefereable then secondly acceptable.
681 		 */
682 		starting_point = stcb->asoc.last_used_address;
683 	sctpv4_from_the_top:
684 		if (stcb->asoc.last_used_address == NULL) {
685 			start_at_beginning=1;
686 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
687 		}
688 		/* search beginning with the last used address */
689 		for (laddr = stcb->asoc.last_used_address; laddr;
690 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
691 			if (laddr->ifa == NULL) {
692 				/* address has been removed */
693 				continue;
694 			}
695 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
696 			if (sin == NULL)
697 				continue;
698 			if ((non_asoc_addr_ok == 0) &&
699 			    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
700 				/* on the no-no list */
701 				continue;
702 			}
703 			return (sin->sin_addr);
704 
705 		}
706 		if (start_at_beginning == 0) {
707 			stcb->asoc.last_used_address = NULL;
708 			goto sctpv4_from_the_top;
709 		}
710 		/* now try for any higher scope than the destination */
711 		stcb->asoc.last_used_address = starting_point;
712 		start_at_beginning = 0;
713 	sctpv4_from_the_top2:
714 		if (stcb->asoc.last_used_address == NULL) {
715 			start_at_beginning=1;
716 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
717 		}
718 		/* search beginning with the last used address */
719 		for (laddr = stcb->asoc.last_used_address; laddr;
720 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
721 			if (laddr->ifa == NULL) {
722 				/* address has been removed */
723 				continue;
724 			}
725 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
726 			if (sin == NULL)
727 				continue;
728 			if ((non_asoc_addr_ok == 0) &&
729 			    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
730 				/* on the no-no list */
731 				continue;
732 			}
733 			return (sin->sin_addr);
734 		}
735 		if (start_at_beginning == 0) {
736 			stcb->asoc.last_used_address = NULL;
737 			goto sctpv4_from_the_top2;
738 		}
739 	} else {
740 		/*
741 		 * Here we have an address list on the association, thats the
742 		 * only valid source addresses that we can use.
743 		 */
744 #ifdef SCTP_DEBUG
745 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
746 			printf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
747 		}
748 #endif
749 		/* First look at all addresses for one that is on
750 		 * the interface we route out
751 		 */
752 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
753 			     sctp_nxt_addr) {
754 			if (laddr->ifa == NULL) {
755 				/* address has been removed */
756 				continue;
757 			}
758 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
759 			if (sin == NULL)
760 				continue;
761 			/* first question, is laddr->ifa an address associated with the emit interface */
762 			if (ifn) {
763 				IFADDR_READER_FOREACH(ifa, ifn) {
764 					if (laddr->ifa == ifa) {
765 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
766 						return (sin->sin_addr);
767 					}
768 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
769 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
770 						return (sin->sin_addr);
771 					}
772 				}
773 			}
774 		}
775 		/* what about an acceptable one on the interface? */
776 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
777 			     sctp_nxt_addr) {
778 			if (laddr->ifa == NULL) {
779 				/* address has been removed */
780 				continue;
781 			}
782 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
783 			if (sin == NULL)
784 				continue;
785 			/* first question, is laddr->ifa an address associated with the emit interface */
786 			if (ifn) {
787 				IFADDR_READER_FOREACH(ifa, ifn) {
788 					if (laddr->ifa == ifa) {
789 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
790 						return (sin->sin_addr);
791 					}
792 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
793 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
794 						return (sin->sin_addr);
795 					}
796 				}
797 			}
798 		}
799 		/* ok, next one that is preferable in general */
800 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
801 			     sctp_nxt_addr) {
802 			if (laddr->ifa == NULL) {
803 				/* address has been removed */
804 				continue;
805 			}
806 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
807 			if (sin == NULL)
808 				continue;
809 			return (sin->sin_addr);
810 		}
811 
812 		/* last, what about one that is acceptable */
813 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
814 			     sctp_nxt_addr) {
815 			if (laddr->ifa == NULL) {
816 				/* address has been removed */
817 				continue;
818 			}
819 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
820 			if (sin == NULL)
821 				continue;
822 			return (sin->sin_addr);
823 		}
824 	}
825 	memset(&ans, 0, sizeof(ans));
826 	return (ans);
827 }
828 
829 static struct sockaddr_in *
830 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
831 						    uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
832 {
833 	struct ifaddr *ifa;
834 	struct sockaddr_in *sin;
835 	uint8_t sin_loop, sin_local;
836 	int num_eligible_addr = 0;
837 	IFADDR_READER_FOREACH(ifa, ifn) {
838 		sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
839 		if (sin == NULL)
840 			continue;
841 		if (stcb) {
842 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
843 				/* It is restricted for some reason.. probably
844 				 * not yet added.
845 				 */
846 				continue;
847 			}
848 		}
849 		if (cur_addr_num == num_eligible_addr) {
850 			return (sin);
851 		}
852 	}
853 	return (NULL);
854 }
855 
856 
857 static int
858 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
859 				     uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
860 {
861 	struct ifaddr *ifa;
862 	struct sockaddr_in *sin;
863 	int num_eligible_addr = 0;
864 
865 	IFADDR_READER_FOREACH(ifa, ifn) {
866 		sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
867 		if (sin == NULL)
868 			continue;
869 		if (stcb) {
870 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
871 				/* It is restricted for some reason.. probably
872 				 * not yet added.
873 				 */
874 				continue;
875 			}
876 		}
877 		num_eligible_addr++;
878 	}
879 	return (num_eligible_addr);
880 
881 }
882 
883 static struct in_addr
884 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
885 			struct sctp_tcb *stcb,
886 			struct sctp_nets *net,
887 			struct rtentry *rt,
888 			uint8_t ipv4_scope,
889 			uint8_t loopscope,
890 			int non_asoc_addr_ok)
891 {
892 	int cur_addr_num=0, num_prefered=0;
893 	uint8_t sin_loop, sin_local;
894 	struct ifnet *ifn;
895 	struct sockaddr_in *sin;
896 	struct in_addr ans;
897 	struct ifaddr *ifa;
898 	int s;
899 	/*
900 	 * For v4 we can use (in boundall) any address in the association. If
901 	 * non_asoc_addr_ok is set we can use any address (at least in theory).
902 	 * So we look for prefered addresses first. If we find one, we use it.
903 	 * Otherwise we next try to get an address on the interface, which we
904 	 * should be able to do (unless non_asoc_addr_ok is false and we are
905 	 * routed out that way). In these cases where we can't use the address
906 	 * of the interface we go through all the ifn's looking for an address
907 	 * we can use and fill that in. Punting means we send back address
908 	 * 0, which will probably cause problems actually since then IP will
909 	 * fill in the address of the route ifn, which means we probably already
910 	 * rejected it.. i.e. here comes an abort :-<.
911 	 */
912 	ifn = rt->rt_ifp;
913 	if (net) {
914 		cur_addr_num = net->indx_of_eligible_next_to_use;
915 	}
916 	if (ifn == NULL) {
917  		goto bound_all_v4_plan_c;
918 	}
919 	num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
920 #ifdef SCTP_DEBUG
921 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
922 		printf("Found %d prefered source addresses\n", num_prefered);
923 	}
924 #endif
925 	if (num_prefered == 0) {
926 		/* no eligible addresses, we must use some other
927 		 * interface address if we can find one.
928 		 */
929  		goto bound_all_v4_plan_b;
930 	}
931 	/* Ok we have num_eligible_addr set with how many we can use,
932 	 * this may vary from call to call due to addresses being deprecated etc..
933 	 */
934 	if (cur_addr_num >= num_prefered) {
935 		cur_addr_num = 0;
936 	}
937 	/* select the nth address from the list (where cur_addr_num is the nth) and
938 	 * 0 is the first one, 1 is the second one etc...
939 	 */
940 #ifdef SCTP_DEBUG
941 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
942 		printf("cur_addr_num:%d\n", cur_addr_num);
943 	}
944 #endif
945 	sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
946 								   ipv4_scope, cur_addr_num);
947 
948 	/* if sin is NULL something changed??, plan_a now */
949 	if (sin) {
950 		return (sin->sin_addr);
951 	}
952 
953 	/*
954 	 * plan_b: Look at the interface that we emit on
955 	 *         and see if we can find an acceptable address.
956 	 */
957  bound_all_v4_plan_b:
958 	IFADDR_READER_FOREACH(ifa, ifn) {
959 		sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
960 		if (sin == NULL)
961 			continue;
962 		if (stcb) {
963 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
964 				/* It is restricted for some reason.. probably
965 				 * not yet added.
966 				 */
967 				continue;
968 			}
969 		}
970 		return (sin->sin_addr);
971 	}
972 	/*
973 	 * plan_c: Look at all interfaces and find a prefered
974 	 *         address. If we reache here we are in trouble I think.
975 	 */
976  bound_all_v4_plan_c:
977 	s = pserialize_read_enter();
978 	IFNET_READER_FOREACH(ifn) {
979 		if (ifn == inp->next_ifn_touse)
980 			break;
981 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
982 			/* wrong base scope */
983 			continue;
984 		}
985 		if (ifn == rt->rt_ifp)
986 			/* already looked at this guy */
987 			continue;
988 		num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
989 								    loopscope, ipv4_scope, &sin_loop, &sin_local);
990 #ifdef SCTP_DEBUG
991 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
992 			printf("Found ifn:%p %d prefered source addresses\n", ifn, num_prefered);
993 		}
994 #endif
995 		if (num_prefered == 0) {
996 			/*
997 			 * None on this interface.
998 			 */
999 			continue;
1000 		}
1001 		/* Ok we have num_eligible_addr set with how many we can use,
1002 		 * this may vary from call to call due to addresses being deprecated etc..
1003 		 */
1004 		if (cur_addr_num >= num_prefered) {
1005 			cur_addr_num = 0;
1006 		}
1007 		sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1008 									  ipv4_scope, cur_addr_num);
1009 		if (sin == NULL)
1010 			continue;
1011 		pserialize_read_exit(s);
1012 		return (sin->sin_addr);
1013 
1014 	}
1015 	pserialize_read_exit(s);
1016 
1017 	/*
1018 	 * plan_d: We are in deep trouble. No prefered address on
1019 	 *         any interface. And the emit interface does not
1020 	 *         even have an acceptable address. Take anything
1021 	 *         we can get! If this does not work we are
1022 	 *         probably going to emit a packet that will
1023 	 *         illicit an ABORT, falling through.
1024 	 */
1025 
1026 	s = pserialize_read_enter();
1027 	IFNET_READER_FOREACH(ifn) {
1028 		if (ifn == inp->next_ifn_touse)
1029 			break;
1030 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1031 			/* wrong base scope */
1032 			continue;
1033 		}
1034 		if (ifn == rt->rt_ifp)
1035 			/* already looked at this guy */
1036 			continue;
1037 
1038 		IFADDR_READER_FOREACH(ifa, ifn) {
1039 			sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1040 			if (sin == NULL)
1041 				continue;
1042 			if (stcb) {
1043 				if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1044 					/* It is restricted for some reason.. probably
1045 					 * not yet added.
1046 					 */
1047 					continue;
1048 				}
1049 			}
1050 			pserialize_read_exit(s);
1051 			return (sin->sin_addr);
1052 		}
1053 	}
1054 	pserialize_read_exit(s);
1055 	/*
1056 	 * Ok we can find NO address to source from that is
1057 	 * not on our negative list. It is either the special
1058 	 * ASCONF case where we are sourceing from a intf that
1059 	 * has been ifconfig'd to a different address (i.e.
1060 	 * it holds a ADD/DEL/SET-PRIM and the proper lookup
1061 	 * address. OR we are hosed, and this baby is going
1062 	 * to abort the association.
1063 	 */
1064 	if (non_asoc_addr_ok) {
1065 		return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1066 	} else {
1067 		memset(&ans, 0, sizeof(ans));
1068 		return (ans);
1069 	}
1070 }
1071 
1072 
1073 
1074 /* tcb may be NULL */
1075 struct in_addr
1076 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1077     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1078     int non_asoc_addr_ok)
1079 {
1080 	struct in_addr ans;
1081 	const struct sockaddr_in *to;
1082 	struct rtentry *rt;
1083 	uint8_t ipv4_scope, loopscope;
1084 
1085 	/*
1086 	 * Rules:
1087 	 * - Find the route if needed, cache if I can.
1088 	 * - Look at interface address in route, Is it
1089 	 *   in the bound list. If so we have the best source.
1090 	 * - If not we must rotate amongst the addresses.
1091 	 *
1092 	 * Cavets and issues
1093 	 *
1094 	 * Do we need to pay attention to scope. We can have
1095 	 * a private address or a global address we are sourcing
1096 	 * or sending to. So if we draw it out
1097 	 *      source     *      dest   *  result
1098 	 *  ------------------------------------------
1099 	 *  a   Private    *     Global  *  NAT?
1100 	 *  ------------------------------------------
1101 	 *  b   Private    *     Private *  No problem
1102 	 *  ------------------------------------------
1103 	 *  c   Global     *     Private *  Huh, How will this work?
1104 	 *  ------------------------------------------
1105 	 *  d   Global     *     Global  *  No Problem
1106 	 *  ------------------------------------------
1107 	 *
1108 	 * And then we add to that what happens if there are multiple
1109 	 * addresses assigned to an interface. Remember the ifa on a
1110 	 * ifn is a linked list of addresses. So one interface can
1111 	 * have more than one IPv4 address. What happens if we
1112 	 * have both a private and a global address? Do we then
1113 	 * use context of destination to sort out which one is
1114 	 * best? And what about NAT's sending P->G may get you
1115 	 * a NAT translation, or should you select the G thats
1116 	 * on the interface in preference.
1117 	 *
1118 	 * Decisions:
1119 	 *
1120 	 *  - count the number of addresses on the interface.
1121 	 *  - if its one, no problem except case <c>. For <a>
1122 	 *    we will assume a NAT out there.
1123 	 *  - if there are more than one, then we need to worry
1124 	 *    about scope P or G. We should prefer G -> G and
1125 	 *    P -> P if possible. Then as a secondary fall back
1126 	 *    to mixed types G->P being a last ditch one.
1127 	 *  - The above all works for bound all, but bound
1128 	 *    specific we need to use the same concept but instead
1129 	 *    only consider the bound addresses. If the bound set
1130 	 *    is NOT assigned to the interface then we must use
1131 	 *    rotation amongst them.
1132 	 *
1133 	 * Notes: For v4, we can always punt and let ip_output
1134 	 * decide by sending back a source of 0.0.0.0
1135 	 */
1136 
1137 	/*
1138 	 * Need a route to cache.
1139 	 *
1140 	 */
1141 	rt = rtcache_validate(ro);
1142 	if (rt == NULL) {
1143 		/* No route to host .. punt */
1144 		memset(&ans, 0, sizeof(ans));
1145 		return (ans);
1146 	} else {
1147 		to = satocsin(rtcache_getdst(ro));
1148 	}
1149 	/* Setup our scopes */
1150 	if (stcb) {
1151 		ipv4_scope = stcb->asoc.ipv4_local_scope;
1152 		loopscope = stcb->asoc.loopback_scope;
1153 	} else {
1154 		/* Scope based on outbound address */
1155 		if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1156 			ipv4_scope = 1;
1157 			loopscope = 0;
1158 		} else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1159 			ipv4_scope = 1;
1160 			loopscope = 1;
1161 		} else {
1162 			ipv4_scope = 0;
1163 			loopscope = 0;
1164 		}
1165 	}
1166 #ifdef SCTP_DEBUG
1167 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1168 		printf("Scope setup loop:%d ipv4_scope:%d\n",
1169 		       loopscope, ipv4_scope);
1170 	}
1171 #endif
1172 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1173 		/*
1174 		 * When bound to all if the address list is set
1175 		 * it is a negative list. Addresses being added
1176 		 * by asconf.
1177 		 */
1178 		ans = sctp_choose_v4_boundall(inp, stcb, net, rt,
1179 		    ipv4_scope, loopscope, non_asoc_addr_ok);
1180 		goto out;
1181         }
1182 	/*
1183  	 * Three possiblities here:
1184 	 *
1185 	 * a) stcb is NULL, which means we operate only from
1186 	 *    the list of addresses (ifa's) bound to the assoc and
1187 	 *    we care not about the list.
1188 	 * b) stcb is NOT-NULL, which means we have an assoc structure and
1189 	 *    auto-asconf is on. This means that the list of addresses is
1190          *    a NOT list. We use the list from the inp, but any listed address
1191 	 *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1192 	 *    set we CAN use an address NOT available (i.e. being added). Its
1193 	 *    a negative list.
1194 	 * c) stcb is NOT-NULL, which means we have an assoc structure and
1195 	 *    auto-asconf is off. This means that the list of addresses is
1196          *    the ONLY addresses I can use.. its positive.
1197 	 *
1198 	 *    Note we collapse b & c into the same function just like in
1199 	 *    the v6 address selection.
1200 	 */
1201 	if (stcb) {
1202 		ans = sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1203 		    rt, ipv4_scope, loopscope, non_asoc_addr_ok);
1204 		goto out;
1205 	} else {
1206 		ans = sctp_choose_v4_boundspecific_inp(inp, rt,
1207 		    ipv4_scope, loopscope);
1208 		goto out;
1209 	}
1210 	/* this should not be reached */
1211 	memset(&ans, 0, sizeof(ans));
1212 out:
1213 	rtcache_unref(rt, ro);
1214 	return ans;
1215 }
1216 
1217 
1218 
1219 static struct sockaddr_in6 *
1220 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1221 {
1222 	struct in6_ifaddr *ifa6;
1223 	struct sockaddr_in6 *sin6;
1224 
1225 	if (ifa->ifa_addr->sa_family != AF_INET6) {
1226 		/* forget non-v6 */
1227 		return (NULL);
1228 	}
1229 	ifa6 = (struct in6_ifaddr *)ifa;
1230 	/* ok to use deprecated addresses? */
1231 	if (!ip6_use_deprecated) {
1232 		if (IFA6_IS_DEPRECATED(ifa6)) {
1233 			/* can't use this type */
1234 			return (NULL);
1235 		}
1236 	}
1237 	/* are we ok, with the current state of this address? */
1238 	if (ifa6->ia6_flags &
1239 	    (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1240 		/* Can't use these types */
1241 		return (NULL);
1242 	}
1243 	/* Ok the address may be ok */
1244 	sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1245 	*sin_local = *sin_loop = 0;
1246 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1247 	    (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1248 		*sin_loop = 1;
1249 	}
1250 	if (!loopscope && *sin_loop) {
1251 		/* Its a loopback address and we don't have loop scope */
1252 		return (NULL);
1253 	}
1254 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1255 		/* we skip unspecifed addresses */
1256 		return (NULL);
1257 	}
1258 
1259 	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1260 		*sin_local = 1;
1261 	}
1262 	if (!loc_scope && *sin_local) {
1263 		/* Its a link local address, and we don't have link local scope */
1264 		return (NULL);
1265 	}
1266 	return (sin6);
1267 }
1268 
1269 
1270 static struct sockaddr_in6 *
1271 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1272 				  struct sctp_tcb *stcb,
1273 				  struct sctp_nets *net,
1274 				  struct rtentry *rt,
1275  			          uint8_t loc_scope,
1276 				  uint8_t loopscope,
1277 				  int non_asoc_addr_ok)
1278 {
1279 	/*
1280 	 *   Each endpoint has a list of local addresses associated
1281 	 *   with it. The address list is either a "negative list" i.e.
1282 	 *   those addresses that are NOT allowed to be used as a source OR
1283 	 *   a "postive list" i.e. those addresses that CAN be used.
1284 	 *
1285 	 *   Its a negative list if asconf is allowed. What we do
1286 	 *   in this case is use the ep address list BUT we have
1287 	 *   to cross check it against the negative list.
1288 	 *
1289 	 *   In the case where NO asconf is allowed, we have just
1290 	 *   a straight association level list that we must use to
1291 	 *   find a source address.
1292 	 */
1293 	struct sctp_laddr *laddr, *starting_point;
1294 	struct sockaddr_in6 *sin6;
1295 	int sin_loop, sin_local;
1296 	int start_at_beginning=0;
1297 	struct ifnet *ifn;
1298 	struct ifaddr *ifa;
1299 
1300 	ifn = rt->rt_ifp;
1301 	if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1302 #ifdef SCTP_DEBUG
1303 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1304 			printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1305 		}
1306 #endif
1307 		/* first question, is the ifn we will emit on
1308 		 * in our list, if so, we want that one.
1309 		 */
1310 		if (ifn) {
1311 			IFADDR_READER_FOREACH(ifa, ifn) {
1312 				if (sctp_is_addr_in_ep(inp, ifa)) {
1313 					sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1314 					if (sin6 == NULL)
1315 						continue;
1316 					if ((non_asoc_addr_ok == 0) &&
1317 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1318 						/* on the no-no list */
1319 						continue;
1320 					}
1321 					return (sin6);
1322 				}
1323 			}
1324 		}
1325 		starting_point = stcb->asoc.last_used_address;
1326 		/* First try for matching scope */
1327 	sctp_from_the_top:
1328 		if (stcb->asoc.last_used_address == NULL) {
1329 			start_at_beginning=1;
1330 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1331 		}
1332 		/* search beginning with the last used address */
1333 		for (laddr = stcb->asoc.last_used_address; laddr;
1334 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1335 			if (laddr->ifa == NULL) {
1336 				/* address has been removed */
1337 				continue;
1338 			}
1339 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1340 			if (sin6 == NULL)
1341 				continue;
1342 			if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1343 				/* on the no-no list */
1344 				continue;
1345 			}
1346 			/* is it of matching scope ? */
1347 			if ((loopscope == 0) &&
1348 			    (loc_scope == 0) &&
1349 			    (sin_loop == 0) &&
1350 			    (sin_local == 0)) {
1351 				/* all of global scope we are ok with it */
1352 				return (sin6);
1353 			}
1354 			if (loopscope && sin_loop)
1355 				/* both on the loopback, thats ok */
1356 				return (sin6);
1357 			if (loc_scope && sin_local)
1358 				/* both local scope */
1359 				return (sin6);
1360 
1361 		}
1362 		if (start_at_beginning == 0) {
1363 			stcb->asoc.last_used_address = NULL;
1364 			goto sctp_from_the_top;
1365 		}
1366 		/* now try for any higher scope than the destination */
1367 		stcb->asoc.last_used_address = starting_point;
1368 		start_at_beginning = 0;
1369 	sctp_from_the_top2:
1370 		if (stcb->asoc.last_used_address == NULL) {
1371 			start_at_beginning=1;
1372 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1373 		}
1374 		/* search beginning with the last used address */
1375 		for (laddr = stcb->asoc.last_used_address; laddr;
1376 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1377 			if (laddr->ifa == NULL) {
1378 				/* address has been removed */
1379 				continue;
1380 			}
1381 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1382 			if (sin6 == NULL)
1383 				continue;
1384 			if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1385 				/* on the no-no list */
1386 				continue;
1387 			}
1388 			return (sin6);
1389 		}
1390 		if (start_at_beginning == 0) {
1391 			stcb->asoc.last_used_address = NULL;
1392 			goto sctp_from_the_top2;
1393 		}
1394 	} else {
1395 #ifdef SCTP_DEBUG
1396 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1397 			printf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
1398 		}
1399 #endif
1400 		/* First try for interface output match */
1401 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1402 			     sctp_nxt_addr) {
1403 			if (laddr->ifa == NULL) {
1404 				/* address has been removed */
1405 				continue;
1406 			}
1407 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1408 			if (sin6 == NULL)
1409 				continue;
1410 			/* first question, is laddr->ifa an address associated with the emit interface */
1411 			if (ifn) {
1412 				IFADDR_READER_FOREACH(ifa, ifn) {
1413 					if (laddr->ifa == ifa) {
1414 						sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1415 						return (sin6);
1416 					}
1417 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1418 						sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1419 						return (sin6);
1420 					}
1421 				}
1422 			}
1423 		}
1424 		/* Next try for matching scope */
1425 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1426 			     sctp_nxt_addr) {
1427 			if (laddr->ifa == NULL) {
1428 				/* address has been removed */
1429 				continue;
1430 			}
1431 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1432 			if (sin6 == NULL)
1433 				continue;
1434 
1435 			if ((loopscope == 0) &&
1436 			    (loc_scope == 0) &&
1437 			    (sin_loop == 0) &&
1438 			    (sin_local == 0)) {
1439 				/* all of global scope we are ok with it */
1440 				return (sin6);
1441 			}
1442 			if (loopscope && sin_loop)
1443 				/* both on the loopback, thats ok */
1444 				return (sin6);
1445 			if (loc_scope && sin_local)
1446 				/* both local scope */
1447 				return (sin6);
1448 		}
1449 		/* ok, now try for a higher scope in the source address */
1450 		/* First try for matching scope */
1451 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1452 			     sctp_nxt_addr) {
1453 			if (laddr->ifa == NULL) {
1454 				/* address has been removed */
1455 				continue;
1456 			}
1457 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1458 			if (sin6 == NULL)
1459 				continue;
1460 			return (sin6);
1461 		}
1462 	}
1463 	return (NULL);
1464 }
1465 
1466 static struct sockaddr_in6 *
1467 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1468 				 struct rtentry *rt,
1469 				 uint8_t loc_scope,
1470 				 uint8_t loopscope)
1471 {
1472 	/*
1473 	 * Here we are bound specific and have only
1474 	 * an inp. We must find an address that is bound
1475 	 * that we can give out as a src address. We
1476 	 * prefer two addresses of same scope if we can
1477 	 * find them that way.
1478 	 */
1479 	struct sctp_laddr *laddr;
1480 	struct sockaddr_in6 *sin6;
1481 	struct ifnet *ifn;
1482 	struct ifaddr *ifa;
1483 	int sin_loop, sin_local;
1484 
1485 	/* first question, is the ifn we will emit on
1486 	 * in our list, if so, we want that one.
1487 	 */
1488 
1489 	ifn = rt->rt_ifp;
1490 	if (ifn) {
1491 		IFADDR_READER_FOREACH(ifa, ifn) {
1492 			sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1493 			if (sin6 == NULL)
1494 				continue;
1495 			if (sctp_is_addr_in_ep(inp, ifa)) {
1496 				return (sin6);
1497 			}
1498 		}
1499 	}
1500 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1501 	     laddr && (laddr != inp->next_addr_touse);
1502 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1503 		if (laddr->ifa == NULL) {
1504 			/* address has been removed */
1505 			continue;
1506 		}
1507 		sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1508 		if (sin6 == NULL)
1509 			continue;
1510 
1511 		if ((loopscope == 0) &&
1512 		    (loc_scope == 0) &&
1513 		    (sin_loop == 0) &&
1514 		    (sin_local == 0)) {
1515 			/* all of global scope we are ok with it */
1516 			return (sin6);
1517 		}
1518 		if (loopscope && sin_loop)
1519 			/* both on the loopback, thats ok */
1520 			return (sin6);
1521 		if (loc_scope && sin_local)
1522 			/* both local scope */
1523 			return (sin6);
1524 
1525 	}
1526 	/* if we reach here, we could not find two addresses
1527 	 * of the same scope to give out. Lets look for any higher level
1528 	 * scope for a source address.
1529 	 */
1530 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1531 	     laddr && (laddr != inp->next_addr_touse);
1532 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1533 		if (laddr->ifa == NULL) {
1534 			/* address has been removed */
1535 			continue;
1536 		}
1537 		sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1538 		if (sin6 == NULL)
1539 			continue;
1540 		return (sin6);
1541 	}
1542 	/* no address bound can be a source for the destination */
1543 #ifdef SCTP_DEBUG
1544 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1545 		printf("Src address selection for EP, no acceptable src address found for address\n");
1546 	}
1547 #endif
1548 	return (NULL);
1549 }
1550 
1551 
1552 static struct sockaddr_in6 *
1553 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1554 					   uint8_t loc_scope, int cur_addr_num, int match_scope)
1555 {
1556 	struct ifaddr *ifa;
1557 	struct sockaddr_in6 *sin6;
1558 	int sin_loop, sin_local;
1559 	int num_eligible_addr = 0;
1560 
1561 	IFADDR_READER_FOREACH(ifa, ifn) {
1562 		sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1563 		if (sin6 == NULL)
1564 			continue;
1565 		if (stcb) {
1566 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1567 				/* It is restricted for some reason.. probably
1568 				 * not yet added.
1569 				 */
1570 				continue;
1571 			}
1572 		}
1573 		if (match_scope) {
1574 			/* Here we are asked to match scope if possible */
1575 			if (loopscope && sin_loop)
1576 				/* src and destination are loopback scope */
1577 				return (sin6);
1578 			if (loc_scope && sin_local)
1579 				/* src and destination are local scope */
1580 				return (sin6);
1581 			if ((loopscope == 0) &&
1582 			    (loc_scope == 0)  &&
1583 			    (sin_loop == 0) &&
1584 			    (sin_local == 0)) {
1585 				/* src and destination are global scope */
1586 				return (sin6);
1587 			}
1588 			continue;
1589 		}
1590 		if (num_eligible_addr == cur_addr_num) {
1591 			/* this is it */
1592 			return (sin6);
1593 		}
1594 		num_eligible_addr++;
1595 	}
1596 	return (NULL);
1597 }
1598 
1599 
1600 static int
1601 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1602 				     int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1603 {
1604 	struct ifaddr *ifa;
1605 	struct sockaddr_in6 *sin6;
1606 	int num_eligible_addr = 0;
1607 	int sin_loop, sin_local;
1608 
1609 	IFADDR_READER_FOREACH(ifa, ifn) {
1610 		sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1611 		if (sin6 == NULL)
1612 			continue;
1613 		if (stcb) {
1614 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1615 				/* It is restricted for some reason.. probably
1616 				 * not yet added.
1617 				 */
1618 				continue;
1619 			}
1620 		}
1621 		num_eligible_addr++;
1622 	}
1623 	return (num_eligible_addr);
1624 }
1625 
1626 
1627 static struct sockaddr_in6 *
1628 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1629 			struct sctp_tcb *stcb,
1630 			struct sctp_nets *net,
1631 			struct rtentry *rt,
1632 			uint8_t loc_scope,
1633 			uint8_t loopscope,
1634 			int non_asoc_addr_ok)
1635 {
1636 	/* Ok, we are bound all SO any address
1637 	 * is ok to use as long as it is NOT in the negative
1638 	 * list.
1639 	 */
1640 	int num_eligible_addr;
1641 	int cur_addr_num=0;
1642 	int started_at_beginning=0;
1643 	int match_scope_prefered;
1644 	/* first question is, how many eligible addresses are
1645 	 * there for the destination ifn that we are using that
1646 	 * are within the proper scope?
1647 	 */
1648 	struct ifnet *ifn;
1649 	struct sockaddr_in6 *sin6;
1650 	int s;
1651 
1652 	ifn = rt->rt_ifp;
1653 	if (net) {
1654 		cur_addr_num = net->indx_of_eligible_next_to_use;
1655 	}
1656 	if (cur_addr_num == 0) {
1657 		match_scope_prefered = 1;
1658 	} else {
1659 		match_scope_prefered = 0;
1660 	}
1661 	num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1662 #ifdef SCTP_DEBUG
1663 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1664 		printf("Found %d eligible source addresses\n", num_eligible_addr);
1665 	}
1666 #endif
1667 	if (num_eligible_addr == 0) {
1668 		/* no eligible addresses, we must use some other
1669 		 * interface address if we can find one.
1670 		 */
1671  		goto bound_all_v6_plan_b;
1672 	}
1673 	/* Ok we have num_eligible_addr set with how many we can use,
1674 	 * this may vary from call to call due to addresses being deprecated etc..
1675 	 */
1676 	if (cur_addr_num >= num_eligible_addr) {
1677 		cur_addr_num = 0;
1678 	}
1679 	/* select the nth address from the list (where cur_addr_num is the nth) and
1680 	 * 0 is the first one, 1 is the second one etc...
1681 	 */
1682 #ifdef SCTP_DEBUG
1683 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1684 		printf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1685 		       cur_addr_num, match_scope_prefered);
1686 	}
1687 #endif
1688 	sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1689 							  loc_scope, cur_addr_num, match_scope_prefered);
1690 	if (match_scope_prefered && (sin6 == NULL)) {
1691 		/* retry without the preference for matching scope */
1692 #ifdef SCTP_DEBUG
1693 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1694 		printf("retry with no match_scope_prefered\n");
1695 	}
1696 #endif
1697 		sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1698 								  loc_scope, cur_addr_num, 0);
1699 	}
1700 	if (sin6) {
1701 #ifdef SCTP_DEBUG
1702 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1703 			printf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1704 		}
1705 #endif
1706 		if (net) {
1707 			/* store so we get the next one */
1708 			if (cur_addr_num < 255)
1709 				net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1710 			else
1711 				net->indx_of_eligible_next_to_use = 0;
1712 		}
1713 		return (sin6);
1714 	}
1715 	num_eligible_addr = 0;
1716  bound_all_v6_plan_b:
1717 	/* ok, if we reach here we either fell through
1718 	 * due to something changing during an interrupt (unlikely)
1719 	 * or we have NO eligible source addresses for the ifn
1720 	 * of the route (most likely). We must look at all the other
1721 	 * interfaces EXCEPT rt->rt_ifp and do the same game.
1722 	 */
1723 #ifdef SCTP_DEBUG
1724 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1725 		printf("bound-all Plan B\n");
1726 	}
1727 #endif
1728 	if (inp->next_ifn_touse == NULL) {
1729 		started_at_beginning=1;
1730 		inp->next_ifn_touse = IFNET_READER_FIRST();
1731 #ifdef SCTP_DEBUG
1732 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1733 			printf("Start at first IFN:%p\n", inp->next_ifn_touse);
1734 		}
1735 #endif
1736 	} else {
1737 		inp->next_ifn_touse = IFNET_READER_NEXT(inp->next_ifn_touse);
1738 #ifdef SCTP_DEBUG
1739 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1740 			printf("Resume at IFN:%p\n", inp->next_ifn_touse);
1741 		}
1742 #endif
1743 		if (inp->next_ifn_touse == NULL) {
1744 #ifdef SCTP_DEBUG
1745 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1746 				printf("IFN Resets\n");
1747 			}
1748 #endif
1749 			started_at_beginning=1;
1750 			inp->next_ifn_touse = IFNET_READER_FIRST();
1751 		}
1752 	}
1753 
1754 	s = pserialize_read_enter();
1755 	IFNET_READER_FOREACH(ifn) {
1756 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1757 			/* wrong base scope */
1758 			continue;
1759 		}
1760 		if (loc_scope && (ifn->if_index != loc_scope)) {
1761 			/* by definition the scope (from to->sin6_scopeid)
1762 			 * must match that of the interface. If not then
1763 			 * we could pick a wrong scope for the address.
1764 			 * Usually we don't hit plan-b since the route
1765 			 * handles this. However we can hit plan-b when
1766 			 * we send to local-host so the route is the
1767 			 * loopback interface, but the destination is a
1768 			 * link local.
1769 			 */
1770 			continue;
1771 		}
1772 		if (ifn == rt->rt_ifp) {
1773 			/* already looked at this guy */
1774 			continue;
1775 		}
1776 		/* Address rotation will only work when we are not
1777 		 * rotating sourced interfaces and are using the interface
1778 		 * of the route. We would need to have a per interface index
1779 		 * in order to do proper rotation.
1780 		 */
1781 		num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1782 #ifdef SCTP_DEBUG
1783 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1784 			printf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1785 		}
1786 #endif
1787 		if (num_eligible_addr == 0) {
1788 			/* none we can use */
1789 			continue;
1790 		}
1791 		/* Ok we have num_eligible_addr set with how many we can use,
1792 		 * this may vary from call to call due to addresses being deprecated etc..
1793 		 */
1794 		inp->next_ifn_touse = ifn;
1795 
1796 		/* select the first one we can find with perference for matching scope.
1797 		 */
1798 		sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1799 		if (sin6 == NULL) {
1800 			/* can't find one with matching scope how about a source with higher
1801 			 * scope
1802 			 */
1803  			sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1804 			if (sin6 == NULL)
1805 				/* Hmm, can't find one in the interface now */
1806 				continue;
1807 		}
1808 #ifdef SCTP_DEBUG
1809 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1810 			printf("Selected the %d'th address of ifn:%p\n",
1811 			       cur_addr_num, ifn);
1812 		}
1813 #endif
1814 		pserialize_read_exit(s);
1815 		return (sin6);
1816 	}
1817 	pserialize_read_exit(s);
1818 
1819 	if (started_at_beginning == 0) {
1820 		/* we have not been through all of them yet, force
1821 		 * us to go through them all.
1822 		 */
1823 #ifdef SCTP_DEBUG
1824 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1825 			printf("Force a recycle\n");
1826 		}
1827 #endif
1828 		inp->next_ifn_touse = NULL;
1829 		goto bound_all_v6_plan_b;
1830 	}
1831 	return (NULL);
1832 
1833 }
1834 
1835 /* stcb and net may be NULL */
1836 struct in6_addr
1837 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1838     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1839     int non_asoc_addr_ok)
1840 {
1841 	struct in6_addr ans;
1842 	struct sockaddr_in6 *rt_addr;
1843 	uint8_t loc_scope, loopscope;
1844 	struct sockaddr_in6 to;
1845 	struct rtentry *rt;
1846 
1847 	/*
1848 	 * This routine is tricky standard v6 src address
1849 	 * selection cannot take into account what we have
1850 	 * bound etc, so we can't use it.
1851 	 *
1852 	 * Instead here is what we must do:
1853 	 * 1) Make sure we have a route, if we
1854 	 *    don't have a route we can never reach the peer.
1855 	 * 2) Once we have a route, determine the scope of the
1856 	 *     route. Link local, loopback or global.
1857 	 * 3) Next we divide into three types. Either we
1858 	 *    are bound all.. which means we want to use
1859 	 *    one of the addresses of the interface we are
1860 	 *    going out. <or>
1861 	 * 4a) We have not stcb, which means we are using the
1862 	 *    specific addresses bound on an inp, in this
1863 	 *    case we are similar to the stcb case (4b below)
1864 	 *    accept the list is always a positive list.<or>
1865 	 * 4b) We are bound specific with a stcb, which means we have a
1866 	 *    list of bound addresses and we must see if the
1867 	 *    ifn of the route is actually one of the bound addresses.
1868 	 *    If not, then we must rotate addresses amongst properly
1869 	 *    scoped bound addresses, if so we use the address
1870 	 *    of the interface.
1871 	 * 5) Always, no matter which path we take through the above
1872 	 *    we must be sure the source address we use is allowed to
1873 	 *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1874 	 *    addresses cannot be used.
1875 	 * 6) Addresses that are deprecated MAY be used
1876 	 * 		if (!ip6_use_deprecated) {
1877 	 *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1878 	 *	                  skip the address
1879   	 *	              }
1880 	 *	        }
1881  	 */
1882 
1883 	/*** 1> determine route, if not already done */
1884 	rt = rtcache_validate(ro);
1885 	if (rt == NULL) {
1886 		/*
1887 		 * Need a route to cache.
1888 		 */
1889 		int scope_save;
1890 
1891 		memcpy(&to, rtcache_getdst(ro), sizeof(struct sockaddr));
1892 		scope_save = to.sin6_scope_id;
1893 		to.sin6_scope_id = 0;
1894 
1895 		rt = rtcache_lookup(ro, (struct sockaddr *)&to);
1896 		to.sin6_scope_id = scope_save;
1897 	}
1898 	if (rt == NULL) {
1899 		/*
1900 		 * no route to host. this packet is going no-where.
1901 		 * We probably should make sure we arrange to send back
1902 		 * an error.
1903 		 */
1904 #ifdef SCTP_DEBUG
1905 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1906 			printf("No route to host, this packet cannot be sent!\n");
1907 		}
1908 #endif
1909 		memset(&ans, 0, sizeof(ans));
1910 		return (ans);
1911 	}
1912 
1913 	/*** 2a> determine scope for outbound address/route */
1914 	loc_scope = loopscope = 0;
1915 	/*
1916 	 * We base our scope on the outbound packet scope and route,
1917 	 * NOT the TCB (if there is one). This way in local scope we will only
1918 	 * use a local scope src address when we send to a local address.
1919 	 */
1920 
1921 	if (IN6_IS_ADDR_LOOPBACK(&to.sin6_addr)) {
1922 		/* If the route goes to the loopback address OR
1923 		 * the address is a loopback address, we are loopback
1924 		 * scope.
1925 		 */
1926 #ifdef SCTP_DEBUG
1927 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1928 			printf("Loopback scope is set\n");
1929 		}
1930 #endif
1931 		loc_scope = 0;
1932 		loopscope = 1;
1933 		if (net != NULL) {
1934 			/* mark it as local */
1935 			net->addr_is_local = 1;
1936 		}
1937 
1938 	} else if (IN6_IS_ADDR_LINKLOCAL(&to.sin6_addr)) {
1939 #ifdef SCTP_DEBUG
1940 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1941 			printf("Link local scope is set, id:%d\n", to.sin6_scope_id);
1942 		}
1943 #endif
1944 		if (to.sin6_scope_id)
1945 			loc_scope = to.sin6_scope_id;
1946 		else {
1947 			loc_scope = 1;
1948 		}
1949 		loopscope = 0;
1950 	} else {
1951 #ifdef SCTP_DEBUG
1952 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1953 			printf("Global scope is set\n");
1954 		}
1955 #endif
1956 	}
1957 
1958 	/* now, depending on which way we are bound we call the appropriate
1959 	 * routine to do steps 3-6
1960 	 */
1961 #ifdef SCTP_DEBUG
1962 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1963 		printf("Destination address:");
1964 		sctp_print_address((struct sockaddr *)&to);
1965 	}
1966 #endif
1967 
1968 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1969 #ifdef SCTP_DEBUG
1970 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1971 			printf("Calling bound-all src addr selection for v6\n");
1972 		}
1973 #endif
1974 		rt_addr = sctp_choose_v6_boundall(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok);
1975 	} else {
1976 #ifdef SCTP_DEBUG
1977 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1978 			printf("Calling bound-specific src addr selection for v6\n");
1979 		}
1980 #endif
1981 		if (stcb)
1982 			rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, rt, loc_scope, loopscope,  non_asoc_addr_ok);
1983 		else
1984 			/* we can't have a non-asoc address since we have no association */
1985 			rt_addr = sctp_choose_v6_boundspecific_inp(inp,  rt, loc_scope, loopscope);
1986 	}
1987 	rtcache_unref(rt, ro);
1988 	if (rt_addr == NULL) {
1989 		/* no suitable address? */
1990 		struct in6_addr in6;
1991 #ifdef SCTP_DEBUG
1992 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1993 			printf("V6 packet will reach dead-end no suitable src address\n");
1994 		}
1995 #endif
1996 		memset(&in6, 0, sizeof(in6));
1997 		return (in6);
1998 	}
1999 #ifdef SCTP_DEBUG
2000 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2001 		printf("Source address selected is:");
2002 		sctp_print_address((struct sockaddr *)rt_addr);
2003 	}
2004 #endif
2005 	return (rt_addr->sin6_addr);
2006 }
2007 
2008 static uint8_t
2009 sctp_get_ect(struct sctp_tcb *stcb,
2010 	     struct sctp_tmit_chunk *chk)
2011 {
2012 	uint8_t this_random;
2013 
2014 	/* Huh? */
2015 	if (sctp_ecn == 0)
2016 		return (0);
2017 
2018 	if (sctp_ecn_nonce == 0)
2019 		/* no nonce, always return ECT0 */
2020 		return (SCTP_ECT0_BIT);
2021 
2022 	if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2023 		/* Peer does NOT support it, so we send a ECT0 only */
2024  		return (SCTP_ECT0_BIT);
2025 	}
2026 
2027 	if (chk == NULL)
2028 	   return (SCTP_ECT0_BIT);
2029 
2030 	if (((stcb->asoc.hb_random_idx == 3) &&
2031 	     (stcb->asoc.hb_ect_randombit > 7)) ||
2032 	     (stcb->asoc.hb_random_idx > 3)) {
2033 		uint32_t rndval;
2034 		rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2035 		memcpy(stcb->asoc.hb_random_values, &rndval,
2036 		       sizeof(stcb->asoc.hb_random_values));
2037 		this_random = stcb->asoc.hb_random_values[0];
2038 		stcb->asoc.hb_random_idx = 0;
2039 		stcb->asoc.hb_ect_randombit = 0;
2040 	} else {
2041 		if (stcb->asoc.hb_ect_randombit > 7) {
2042 		  stcb->asoc.hb_ect_randombit = 0;
2043 		  stcb->asoc.hb_random_idx++;
2044 		}
2045 		this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2046 	}
2047 	if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2048 		if (chk != NULL)
2049 			/* ECN Nonce stuff */
2050 			chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2051 		stcb->asoc.hb_ect_randombit++;
2052 		return (SCTP_ECT1_BIT);
2053 	} else {
2054 		stcb->asoc.hb_ect_randombit++;
2055 		return (SCTP_ECT0_BIT);
2056 	}
2057 }
2058 
2059 extern int sctp_no_csum_on_loopback;
2060 
2061 static int
2062 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2063 			   struct sctp_tcb *stcb,    /* may be NULL */
2064 			   struct sctp_nets *net,
2065 			   const struct sockaddr *to,
2066 			   struct mbuf *m,
2067 			   int nofragment_flag,
2068 			   int ecn_ok,
2069 			   struct sctp_tmit_chunk *chk,
2070 			   int out_of_asoc_ok)
2071 	/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2072 {
2073 	/*
2074 	 * Given a mbuf chain (via m_next) that holds a packet header
2075 	 * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2076 	 * - calculate SCTP checksum and fill in
2077 	 * - prepend a IP address header
2078 	 * - if boundall use INADDR_ANY
2079 	 * - if boundspecific do source address selection
2080 	 * - set fragmentation option for ipV4
2081 	 * - On return from IP output, check/adjust mtu size
2082 	 * - of output interface and smallest_mtu size as well.
2083 	 */
2084 	struct sctphdr *sctphdr;
2085 	int o_flgs;
2086 	uint32_t csum;
2087 	int ret;
2088 	unsigned int have_mtu;
2089 	struct route *ro;
2090 	struct rtentry *rt;
2091 
2092 	if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2093 		sctp_m_freem(m);
2094 		return (EFAULT);
2095 	}
2096 	if ((m->m_flags & M_PKTHDR) == 0) {
2097 #ifdef SCTP_DEBUG
2098 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2099 			printf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2100 		}
2101 #endif
2102 		sctp_m_freem(m);
2103 		return (EFAULT);
2104 	}
2105 	/* Calculate the csum and fill in the length of the packet */
2106 	sctphdr = mtod(m, struct sctphdr *);
2107 	have_mtu = 0;
2108 	if (sctp_no_csum_on_loopback &&
2109 	     (stcb) &&
2110 	     (stcb->asoc.loopback_scope)) {
2111 		sctphdr->checksum = 0;
2112 		m->m_pkthdr.len = sctp_calculate_len(m);
2113 	} else {
2114 		sctphdr->checksum = 0;
2115 		csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2116 		sctphdr->checksum = csum;
2117 	}
2118 	if (to->sa_family == AF_INET) {
2119 		struct ip *ip;
2120 		static struct route iproute;
2121 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
2122 		if (m == NULL) {
2123 			/* failed to prepend data, give up */
2124 			return (ENOMEM);
2125 		}
2126 		ip = mtod(m, struct ip *);
2127 		ip->ip_v = IPVERSION;
2128 		ip->ip_hl = (sizeof(struct ip) >> 2);
2129 		if (nofragment_flag) {
2130 			ip->ip_off = htons(IP_DF);
2131 		} else
2132 			ip->ip_off = 0;
2133 
2134 		ip->ip_id = htons(ip_newid(NULL));
2135 		ip->ip_ttl = inp->inp_ip_ttl;
2136 		ip->ip_len = htons(m->m_pkthdr.len);
2137 		if (stcb) {
2138 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2139 				/* Enable ECN */
2140 				ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2141 						      sctp_get_ect(stcb, chk));
2142 			} else {
2143 				/* No ECN */
2144 				ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2145 			}
2146 		} else {
2147 			/* no association at all */
2148 			ip->ip_tos = inp->inp_ip_tos;
2149 		}
2150 		ip->ip_p = IPPROTO_SCTP;
2151 		ip->ip_sum = 0;
2152 #ifdef SCTP_DEBUG
2153 		printf("chunk_output: net %p\n", net);
2154 #endif
2155 		if (net == NULL) {
2156 			ro = &iproute;
2157 			memset(&iproute, 0, sizeof(iproute));
2158 			/* XXX */
2159 			rt = rtcache_lookup(ro, to);
2160 			rtcache_unref(rt, ro);
2161 		} else {
2162 			ro = (struct route *)&net->ro;
2163 		}
2164 		/* Now the address selection part */
2165 		ip->ip_dst.s_addr = satocsin(to)->sin_addr.s_addr;
2166 
2167 		/* call the routine to select the src address */
2168 		if (net) {
2169 			if (net->src_addr_selected == 0) {
2170 				/* Cache the source address */
2171 				((struct sockaddr_in *)&net->_s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2172 				    stcb,
2173 				    ro, net, out_of_asoc_ok);
2174 				rt = rtcache_validate(ro);
2175 				if (rt != NULL) {
2176 					net->src_addr_selected = 1;
2177 				}
2178 				rtcache_unref(rt, ro);
2179 			}
2180 			ip->ip_src = ((struct sockaddr_in *)&net->_s_addr)->sin_addr;
2181 		} else {
2182 			ip->ip_src = sctp_ipv4_source_address_selection(inp,
2183 			    stcb, ro, net, out_of_asoc_ok);
2184 		}
2185 #ifdef SCTP_DEBUG
2186 		printf("src addr %x\n", ip->ip_src.s_addr);
2187 #endif
2188 		/*
2189 		 * If source address selection fails and we find no route then
2190 		 * the ip_output should fail as well with a NO_ROUTE_TO_HOST
2191 		 * type error. We probably should catch that somewhere and
2192 		 * abort the association right away (assuming this is an INIT
2193 		 * being sent).
2194 		 */
2195 		rt = rtcache_validate(ro);
2196 		if (rt == NULL) {
2197 			/*
2198 			 * src addr selection failed to find a route (or valid
2199 			 * source addr), so we can't get there from here!
2200 			 */
2201 #ifdef SCTP_DEBUG
2202 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2203 				printf("low_level_output: dropped v4 packet- no valid source addr\n");
2204 				printf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2205 			}
2206 #endif /* SCTP_DEBUG */
2207 			if (net) {
2208 				if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2209 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2210 							stcb,
2211 							SCTP_FAILED_THRESHOLD,
2212 							(void *)net);
2213 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
2214 				net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2215 				if (stcb) {
2216 					if (net == stcb->asoc.primary_destination) {
2217 						/* need a new primary */
2218 						struct sctp_nets *alt;
2219 						alt = sctp_find_alternate_net(stcb, net);
2220 						if (alt != net) {
2221 							if (sctp_set_primary_addr(stcb,
2222 									      (struct sockaddr *)NULL,
2223 										 alt) == 0) {
2224 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2225 								net->src_addr_selected = 0;
2226 							}
2227 						}
2228 					}
2229 				}
2230 			}
2231 			sctp_m_freem(m);
2232 			return (EHOSTUNREACH);
2233 		} else {
2234 			have_mtu = rt->rt_ifp->if_mtu;
2235 		}
2236 
2237 		o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2238 #ifdef SCTP_DEBUG
2239 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2240 			printf("Calling ipv4 output routine from low level src addr:%x\n",
2241 			       (u_int)(ntohl(ip->ip_src.s_addr)));
2242 			printf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2243 			printf("RTP route is %p through\n", rt);
2244 			printf("length %d\n", ntohs(ip->ip_len));
2245 		}
2246 #endif
2247 		if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2248 			rt->rt_ifp->if_mtu = net->mtu;
2249 		}
2250 		ret = ip_output(m, inp->ip_inp.inp.inp_options,
2251 				ro, o_flgs, inp->ip_inp.inp.inp_moptions,
2252                                 &inp->ip_inp.inp);
2253 		if ((rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2254 			rt->rt_ifp->if_mtu = have_mtu;
2255 		}
2256 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2257 #ifdef SCTP_DEBUG
2258 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2259 			printf("Ip output returns %d\n", ret);
2260 		}
2261 #endif
2262 		if (net == NULL) {
2263 		} else {
2264 			/* PMTU check versus smallest asoc MTU goes here */
2265 			if (rt != NULL) {
2266 				if (rt->rt_rmx.rmx_mtu &&
2267 				    (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
2268 					sctp_mtu_size_reset(inp, &stcb->asoc,
2269 					    rt->rt_rmx.rmx_mtu);
2270 				}
2271 			} else {
2272 				/* route was freed */
2273 				net->src_addr_selected = 0;
2274 			}
2275 		}
2276 		rtcache_unref(rt, ro);
2277 		return (ret);
2278 	}
2279 #ifdef INET6
2280 	else if (to->sa_family == AF_INET6) {
2281 		struct ip6_hdr *ip6h;
2282 		static struct route ip6route;
2283 		struct ifnet *ifp;
2284 		u_char flowTop;
2285 		uint16_t flowBottom;
2286 		u_char tosBottom, tosTop;
2287 		struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2288 		int prev_scope=0;
2289 		u_short prev_port=0;
2290 
2291 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
2292 		if (m == NULL) {
2293 			/* failed to prepend data, give up */
2294 			return (ENOMEM);
2295 		}
2296 		ip6h = mtod(m, struct ip6_hdr *);
2297 
2298 		/*
2299 		 * We assume here that inp_flow is in host byte order within
2300 		 * the TCB!
2301 		 */
2302 		flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2303 		flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2304 
2305 		tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2306 
2307 		/* protect *sin6 from overwrite */
2308 		memcpy(&tmp, to, sizeof(struct sockaddr_in6));
2309 		sin6 = &tmp;
2310 
2311 		/* KAME hack: embed scopeid */
2312 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
2313 		if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2314 #else
2315 		/*
2316 		 * XXX: appropriate scope zone must be provided or otherwise
2317 		 * ip6_use_defzone must be 1.
2318 		 */
2319 		if (sa6_embedscope(sin6, ip6_use_defzone) != 0)
2320 #endif
2321 			return (EINVAL);
2322 		if (net == NULL) {
2323 			memset(&ip6route, 0, sizeof(ip6route));
2324 			ro = (struct route *)&ip6route;
2325 			/* XXX */
2326 			rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
2327 			rtcache_unref(rt, ro);
2328 		} else {
2329 			ro = (struct route *)&net->ro;
2330 		}
2331 		if (stcb != NULL) {
2332 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2333 				/* Enable ECN */
2334 				tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2335 			} else {
2336 				/* No ECN */
2337 				tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2338 			}
2339 		} else {
2340 			/* we could get no asoc if it is a O-O-T-B packet */
2341 			tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2342 		}
2343 		ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2344 		ip6h->ip6_nxt = IPPROTO_SCTP;
2345 		ip6h->ip6_plen = m->m_pkthdr.len;
2346 		ip6h->ip6_dst = sin6->sin6_addr;
2347 
2348 		/*
2349 		 * Add SRC address selection here:
2350 		 * we can only reuse to a limited degree the kame src-addr-sel,
2351 		 * since we can try their selection but it may not be bound.
2352 		 */
2353 		memset(&lsa6_tmp, 0, sizeof(lsa6_tmp));
2354 		lsa6_tmp.sin6_family = AF_INET6;
2355 		lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2356 		lsa6 = &lsa6_tmp;
2357 		rt = rtcache_validate(ro);
2358 		if (net) {
2359 			if (net->src_addr_selected == 0) {
2360 				/* Cache the source address */
2361 				((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2362 				    stcb, ro, net, out_of_asoc_ok);
2363 
2364 				if (rt != NULL) {
2365 					net->src_addr_selected = 1;
2366 				}
2367 			}
2368 			lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr;
2369 		} else {
2370 			lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2371 			    inp, stcb, ro, net, out_of_asoc_ok);
2372 		}
2373 		lsa6->sin6_port = inp->sctp_lport;
2374 
2375 		if (rt ==  NULL) {
2376 			/*
2377 			 * src addr selection failed to find a route (or valid
2378 			 * source addr), so we can't get there from here!
2379 			 */
2380 #ifdef SCTP_DEBUG
2381 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2382 				printf("low_level_output: dropped v6 pkt- no valid source addr\n");
2383 			}
2384 #endif
2385 			sctp_m_freem(m);
2386 			if (net) {
2387 				if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2388 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2389 							stcb,
2390 							SCTP_FAILED_THRESHOLD,
2391 							(void *)net);
2392 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
2393 				net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2394 				if (stcb) {
2395 					if (net == stcb->asoc.primary_destination) {
2396 						/* need a new primary */
2397 						struct sctp_nets *alt;
2398 						alt = sctp_find_alternate_net(stcb, net);
2399 						if (alt != net) {
2400 							if (sctp_set_primary_addr(stcb,
2401 									      (struct sockaddr *)NULL,
2402 										 alt) == 0) {
2403 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2404 								net->src_addr_selected = 0;
2405 							}
2406 						}
2407 					}
2408 				}
2409 			}
2410 			return (EHOSTUNREACH);
2411 		}
2412 
2413 		ip6h->ip6_src = lsa6->sin6_addr;
2414 
2415 		/*
2416 		 * We set the hop limit now since there is a good chance that
2417 		 * our ro pointer is now filled
2418 		 */
2419 		ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2420 						(ro ?
2421 						 (rt ? (rt->rt_ifp) : (NULL)) :
2422 						 (NULL)));
2423 		o_flgs = 0;
2424 		ifp = rt->rt_ifp;
2425 #ifdef SCTP_DEBUG
2426 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2427 			/* Copy to be sure something bad is not happening */
2428 			sin6->sin6_addr = ip6h->ip6_dst;
2429 			lsa6->sin6_addr = ip6h->ip6_src;
2430 
2431 			printf("Calling ipv6 output routine from low level\n");
2432 			printf("src: ");
2433 			sctp_print_address((struct sockaddr *)lsa6);
2434 			printf("dst: ");
2435 			sctp_print_address((struct sockaddr *)sin6);
2436 		}
2437 #endif /* SCTP_DEBUG */
2438 		if (net) {
2439 			sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
2440 			/* preserve the port and scope for link local send */
2441 			prev_scope = sin6->sin6_scope_id;
2442 			prev_port = sin6->sin6_port;
2443 		}
2444 		/* XXX NOMPSAFE need to hold ifp here */
2445 		rtcache_unref(rt, ro);
2446 		ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2447 				 ro,
2448 				 o_flgs,
2449 				 ((struct in6pcb *)inp)->in6p_moptions,
2450 				 (struct in6pcb *)inp,
2451 				 &ifp);
2452 		if (net) {
2453 			/* for link local this must be done */
2454 			sin6->sin6_scope_id = prev_scope;
2455 			sin6->sin6_port = prev_port;
2456 		}
2457 #ifdef SCTP_DEBUG
2458 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2459 			printf("return from send is %d\n", ret);
2460 		}
2461 #endif /* SCTP_DEBUG_OUTPUT */
2462 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2463 		if (net) {
2464 			/* PMTU check versus smallest asoc MTU goes here */
2465 			rt = rtcache_validate(ro);
2466 			if (rt == NULL) {
2467 				/* Route was freed */
2468 				net->src_addr_selected = 0;
2469 			}
2470 			if (rt != NULL) {
2471 				if (rt->rt_rmx.rmx_mtu &&
2472 				    (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
2473 					sctp_mtu_size_reset(inp,
2474 							    &stcb->asoc,
2475 							    rt->rt_rmx.rmx_mtu);
2476 				}
2477 				rtcache_unref(rt, ro);
2478 			} else if (ifp) {
2479 				if (ifp->if_mtu &&
2480 				    (stcb->asoc.smallest_mtu > ifp->if_mtu)) {
2481 					sctp_mtu_size_reset(inp,
2482 							    &stcb->asoc,
2483 							    ifp->if_mtu);
2484 				}
2485 			}
2486 		}
2487 		return (ret);
2488 	}
2489 #endif
2490 	else {
2491 #ifdef SCTP_DEBUG
2492 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2493 			printf("Unknown protocol (TSNH) type %d\n", ((const struct sockaddr *)to)->sa_family);
2494 		}
2495 #endif
2496 		sctp_m_freem(m);
2497 		return (EFAULT);
2498 	}
2499 }
2500 
2501 static
2502 int sctp_is_address_in_scope(struct ifaddr *ifa,
2503  			     int ipv4_addr_legal,
2504 			     int ipv6_addr_legal,
2505 			     int loopback_scope,
2506 			     int ipv4_local_scope,
2507 			     int local_scope,
2508 			     int site_scope)
2509 {
2510 	if ((loopback_scope == 0) && (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2511 		/* skip loopback if not in scope *
2512 		 */
2513 		return (0);
2514 	}
2515 	if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2516 		struct sockaddr_in *sin;
2517 		sin = (struct sockaddr_in *)ifa->ifa_addr;
2518 		if (sin->sin_addr.s_addr == 0) {
2519 			/* not in scope , unspecified */
2520 			return (0);
2521 		}
2522 		if ((ipv4_local_scope == 0) &&
2523 		    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2524 			/* private address not in scope */
2525 			return (0);
2526 		}
2527 	} else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2528 		struct sockaddr_in6 *sin6;
2529 		struct in6_ifaddr *ifa6;
2530 
2531 		ifa6 = (struct in6_ifaddr *)ifa;
2532 		/* ok to use deprecated addresses? */
2533 		if (!ip6_use_deprecated) {
2534 			if (ifa6->ia6_flags &
2535 			    IN6_IFF_DEPRECATED) {
2536 				return (0);
2537 			}
2538 		}
2539 		if (ifa6->ia6_flags &
2540 		    (IN6_IFF_DETACHED |
2541 		     IN6_IFF_ANYCAST |
2542 		     IN6_IFF_NOTREADY)) {
2543 			return (0);
2544 		}
2545 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2546 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2547 			/* skip unspecifed addresses */
2548 			return (0);
2549 		}
2550 		if (/*(local_scope == 0) && */
2551 		    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2552 			return (0);
2553 		}
2554 		if ((site_scope == 0) &&
2555 		    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2556 			return (0);
2557 		}
2558 	} else {
2559 		return (0);
2560 	}
2561 	return (1);
2562 }
2563 
2564 
2565 void
2566 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2567 {
2568 	struct mbuf *m, *m_at, *m_last;
2569 	struct sctp_nets *net;
2570 	struct sctp_init_msg *initm;
2571 	struct sctp_supported_addr_param *sup_addr;
2572 	struct sctp_ecn_supported_param *ecn;
2573 	struct sctp_prsctp_supported_param *prsctp;
2574 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
2575 	struct sctp_supported_chunk_types_param *pr_supported;
2576 	int cnt_inits_to=0;
2577 	int padval, ret;
2578 
2579 	/* INIT's always go to the primary (and usually ONLY address) */
2580 	m_last = NULL;
2581 	net = stcb->asoc.primary_destination;
2582 	if (net == NULL) {
2583 		net = TAILQ_FIRST(&stcb->asoc.nets);
2584 		if (net == NULL) {
2585 			/* TSNH */
2586 			return;
2587 		}
2588 		/* we confirm any address we send an INIT to */
2589 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2590 		sctp_set_primary_addr(stcb, NULL, net);
2591 	} else {
2592 		/* we confirm any address we send an INIT to */
2593 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2594 	}
2595 #ifdef SCTP_DEBUG
2596 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2597 		printf("Sending INIT to ");
2598 		sctp_print_address (rtcache_getdst(&net->ro));
2599 	}
2600 #endif
2601 	if (rtcache_getdst(&net->ro)->sa_family == AF_INET6) {
2602 		/* special hook, if we are sending to link local
2603 		 * it will not show up in our private address count.
2604 		 */
2605 		if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&net->ro)->sa_data))
2606 			cnt_inits_to = 1;
2607 	}
2608 	if (callout_pending(&net->rxt_timer.timer)) {
2609 		/* This case should not happen */
2610 		return;
2611 	}
2612 	/* start the INIT timer */
2613 	if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2614 		/* we are hosed since I can't start the INIT timer? */
2615 		return;
2616 	}
2617 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
2618 	if (m == NULL) {
2619 		/* No memory, INIT timer will re-attempt. */
2620 		return;
2621 	}
2622 	/* make it into a M_EXT */
2623 	MCLGET(m, M_DONTWAIT);
2624 	if ((m->m_flags & M_EXT) != M_EXT) {
2625 		/* Failed to get cluster buffer */
2626 		sctp_m_freem(m);
2627 		return;
2628 	}
2629 	m->m_data += SCTP_MIN_OVERHEAD;
2630 	m->m_len = sizeof(struct sctp_init_msg);
2631 	/* Now lets put the SCTP header in place */
2632 	initm = mtod(m, struct sctp_init_msg *);
2633 	initm->sh.src_port = inp->sctp_lport;
2634 	initm->sh.dest_port = stcb->rport;
2635 	initm->sh.v_tag = 0;
2636 	initm->sh.checksum = 0;	/* calculate later */
2637 	/* now the chunk header */
2638 	initm->msg.ch.chunk_type = SCTP_INITIATION;
2639 	initm->msg.ch.chunk_flags = 0;
2640 	/* fill in later from mbuf we build */
2641 	initm->msg.ch.chunk_length = 0;
2642 	/* place in my tag */
2643 	initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2644 	/* set up some of the credits. */
2645 	initm->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat,
2646 	    SCTP_MINIMAL_RWND));
2647 
2648 	initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2649 	initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2650 	initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2651 	/* now the address restriction */
2652 	sup_addr = (struct sctp_supported_addr_param *)((vaddr_t)initm +
2653 	    sizeof(*initm));
2654 	sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2655 	/* we support 2 types IPv6/IPv4 */
2656 	sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2657 					  sizeof(uint16_t));
2658 	sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2659 	sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2660 	m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2661 
2662 /*	if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2663 	if (inp->sctp_ep.adaption_layer_indicator) {
2664 		struct sctp_adaption_layer_indication *ali;
2665 		ali = (struct sctp_adaption_layer_indication *)(
2666 		    (vaddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2667 		ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2668 		ali->ph.param_length = htons(sizeof(*ali));
2669 		ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2670 		m->m_len += sizeof(*ali);
2671 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
2672 		    sizeof(*ali));
2673 	} else {
2674 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)sup_addr +
2675 		    sizeof(*sup_addr) + sizeof(uint16_t));
2676 	}
2677 
2678 	/* now any cookie time extensions */
2679 	if (stcb->asoc.cookie_preserve_req) {
2680 		struct sctp_cookie_perserve_param *cookie_preserve;
2681 		cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2682 		cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2683 		cookie_preserve->ph.param_length = htons(
2684 		    sizeof(*cookie_preserve));
2685 		cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2686 		m->m_len += sizeof(*cookie_preserve);
2687 		ecn = (struct sctp_ecn_supported_param *)(
2688 		    (vaddr_t)cookie_preserve + sizeof(*cookie_preserve));
2689 		stcb->asoc.cookie_preserve_req = 0;
2690 	}
2691 
2692 	/* ECN parameter */
2693 	if (sctp_ecn == 1) {
2694 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2695 		ecn->ph.param_length = htons(sizeof(*ecn));
2696 		m->m_len += sizeof(*ecn);
2697 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
2698 		    sizeof(*ecn));
2699 	} else {
2700 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
2701 	}
2702 	/* And now tell the peer we do pr-sctp */
2703 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2704 	prsctp->ph.param_length = htons(sizeof(*prsctp));
2705 	m->m_len += sizeof(*prsctp);
2706 
2707 
2708 	/* And now tell the peer we do all the extensions */
2709 	pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
2710 	   sizeof(*prsctp));
2711 
2712 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2713 	pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2714 	pr_supported->chunk_types[0] = SCTP_ASCONF;
2715 	pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2716 	pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2717 	pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2718 	pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2719 	pr_supported->chunk_types[5] = 0; /* pad */
2720 	pr_supported->chunk_types[6] = 0; /* pad */
2721 	pr_supported->chunk_types[7] = 0; /* pad */
2722 
2723 	m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2724 	/* ECN nonce: And now tell the peer we support ECN nonce */
2725 
2726 	if (sctp_ecn_nonce) {
2727 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
2728 		    sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2729 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2730 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2731 		m->m_len += sizeof(*ecn_nonce);
2732 	}
2733 
2734 	m_at = m;
2735 	/* now the addresses */
2736 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2737 		struct ifnet *ifn;
2738 		struct ifaddr *ifa;
2739 		int cnt;
2740 		int s;
2741 
2742 		cnt = cnt_inits_to;
2743 		s = pserialize_read_enter();
2744 		IFNET_READER_FOREACH(ifn) {
2745 			if ((stcb->asoc.loopback_scope == 0) &&
2746 			    (ifn->if_type == IFT_LOOP)) {
2747 				/*
2748 				 * Skip loopback devices if loopback_scope
2749 				 * not set
2750 				 */
2751 				continue;
2752 			}
2753 			IFADDR_READER_FOREACH(ifa, ifn) {
2754 				if (sctp_is_address_in_scope(ifa,
2755 				    stcb->asoc.ipv4_addr_legal,
2756 				    stcb->asoc.ipv6_addr_legal,
2757 				    stcb->asoc.loopback_scope,
2758 				    stcb->asoc.ipv4_local_scope,
2759 				    stcb->asoc.local_scope,
2760 				    stcb->asoc.site_scope) == 0) {
2761 					continue;
2762 				}
2763 				cnt++;
2764 			}
2765 		}
2766 		pserialize_read_exit(s);
2767 
2768 		if (cnt > 1) {
2769 			s = pserialize_read_enter();
2770 			IFNET_READER_FOREACH(ifn) {
2771 				if ((stcb->asoc.loopback_scope == 0) &&
2772 				    (ifn->if_type == IFT_LOOP)) {
2773 					/*
2774 					 * Skip loopback devices if loopback_scope
2775 					 * not set
2776 					 */
2777 					continue;
2778 				}
2779 				IFADDR_READER_FOREACH(ifa, ifn) {
2780 					if (sctp_is_address_in_scope(ifa,
2781 					    stcb->asoc.ipv4_addr_legal,
2782 					    stcb->asoc.ipv6_addr_legal,
2783 					    stcb->asoc.loopback_scope,
2784 					    stcb->asoc.ipv4_local_scope,
2785 					    stcb->asoc.local_scope,
2786 					    stcb->asoc.site_scope) == 0) {
2787 						continue;
2788 					}
2789 					m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2790 				}
2791 			}
2792 			pserialize_read_exit(s);
2793 		}
2794 	} else {
2795 		struct sctp_laddr *laddr;
2796 		int cnt;
2797 		cnt = cnt_inits_to;
2798 		/* First, how many ? */
2799 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2800 			if (laddr->ifa == NULL) {
2801 				continue;
2802 			}
2803 			if (laddr->ifa->ifa_addr == NULL)
2804 				continue;
2805 			if (sctp_is_address_in_scope(laddr->ifa,
2806 			    stcb->asoc.ipv4_addr_legal,
2807 			    stcb->asoc.ipv6_addr_legal,
2808 			    stcb->asoc.loopback_scope,
2809 			    stcb->asoc.ipv4_local_scope,
2810 			    stcb->asoc.local_scope,
2811 			    stcb->asoc.site_scope) == 0) {
2812 				continue;
2813 			}
2814 			cnt++;
2815 		}
2816 		/* To get through a NAT we only list addresses if
2817 		 * we have more than one. That way if you just
2818 		 * bind a single address we let the source of the init
2819 		 * dictate our address.
2820 		 */
2821 		if (cnt > 1) {
2822 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2823 				if (laddr->ifa == NULL) {
2824 					continue;
2825 				}
2826 				if (laddr->ifa->ifa_addr == NULL) {
2827 					continue;
2828 				}
2829 
2830 				if (sctp_is_address_in_scope(laddr->ifa,
2831 				    stcb->asoc.ipv4_addr_legal,
2832 				    stcb->asoc.ipv6_addr_legal,
2833 				    stcb->asoc.loopback_scope,
2834 				    stcb->asoc.ipv4_local_scope,
2835 				    stcb->asoc.local_scope,
2836 				    stcb->asoc.site_scope) == 0) {
2837 					continue;
2838 				}
2839 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2840 			}
2841 		}
2842 	}
2843 	/* calulate the size and update pkt header and chunk header */
2844 	m->m_pkthdr.len = 0;
2845 	for (m_at = m; m_at; m_at = m_at->m_next) {
2846 		if (m_at->m_next == NULL)
2847 			m_last = m_at;
2848 		m->m_pkthdr.len += m_at->m_len;
2849 	}
2850 	initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2851 	    sizeof(struct sctphdr)));
2852 #ifdef SCTP_DEBUG
2853 	printf("chunk_length %d\n", ntohs(initm->msg.ch.chunk_length));
2854 #endif
2855 	/* We pass 0 here to NOT set IP_DF if its IPv4, we
2856 	 * ignore the return here since the timer will drive
2857 	 * a retranmission.
2858 	 */
2859 
2860 	/* I don't expect this to execute but we will be safe here */
2861 	padval = m->m_pkthdr.len % 4;
2862 	if ((padval) && (m_last)) {
2863 		/* The compiler worries that m_last may not be
2864 		 * set even though I think it is impossible :->
2865 		 * however we add m_last here just in case.
2866 		 */
2867 		ret = sctp_add_pad_tombuf(m_last, (4-padval));
2868 		if (ret) {
2869 			/* Houston we have a problem, no space */
2870 			sctp_m_freem(m);
2871 			return;
2872 		}
2873 		m->m_pkthdr.len += padval;
2874 	}
2875 #ifdef SCTP_DEBUG
2876 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2877 		printf("Calling lowlevel output stcb:%p net:%p\n",
2878 		       stcb, net);
2879 	}
2880 #endif
2881 	ret = sctp_lowlevel_chunk_output(inp, stcb, net,
2882 		  rtcache_getdst(&net->ro), m, 0, 0, NULL, 0);
2883 #ifdef SCTP_DEBUG
2884 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2885 		printf("Low level output returns %d\n", ret);
2886 	}
2887 #endif
2888 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
2889 	SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
2890 }
2891 
2892 struct mbuf *
2893 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
2894     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
2895 {
2896 	/* Given a mbuf containing an INIT or INIT-ACK
2897 	 * with the param_offset being equal to the
2898 	 * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
2899 	 * parse through the parameters to the end of the mbuf verifying
2900 	 * that all parameters are known.
2901 	 *
2902 	 * For unknown parameters build and return a mbuf with
2903 	 * UNRECOGNIZED_PARAMETER errors. If the flags indicate
2904 	 * to stop processing this chunk stop, and set *abort_processing
2905 	 * to 1.
2906 	 *
2907 	 * By having param_offset be pre-set to where parameters begin
2908 	 * it is hoped that this routine may be reused in the future
2909 	 * by new features.
2910 	 */
2911 	struct sctp_paramhdr *phdr, params;
2912 
2913 	struct mbuf *mat, *op_err;
2914 	char tempbuf[2048];
2915 	int at, limit, pad_needed;
2916 	uint16_t ptype, plen;
2917 	int err_at;
2918 
2919 	*abort_processing = 0;
2920 	mat = in_initpkt;
2921 	err_at = 0;
2922 	limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
2923 #ifdef SCTP_DEBUG
2924 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2925 		printf("Limit is %d bytes\n", limit);
2926 	}
2927 #endif
2928 	at = param_offset;
2929 	op_err = NULL;
2930 
2931 	phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
2932 	while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
2933 		ptype = ntohs(phdr->param_type);
2934 		plen = ntohs(phdr->param_length);
2935 		limit -= SCTP_SIZE32(plen);
2936 		if (plen < sizeof(struct sctp_paramhdr)) {
2937 #ifdef SCTP_DEBUG
2938 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2939 			printf("sctp_output.c:Impossible length in parameter < %d\n", plen);
2940 	}
2941 #endif
2942 			*abort_processing = 1;
2943 			break;
2944 		}
2945 		/* All parameters for all chunks that we
2946 		 * know/understand are listed here. We process
2947 		 * them other places and make appropriate
2948 		 * stop actions per the upper bits. However
2949 		 * this is the generic routine processor's can
2950 		 * call to get back an operr.. to either incorporate (init-ack)
2951 		 * or send.
2952 		 */
2953 		if ((ptype == SCTP_HEARTBEAT_INFO) ||
2954 		    (ptype == SCTP_IPV4_ADDRESS) ||
2955 		    (ptype == SCTP_IPV6_ADDRESS) ||
2956 		    (ptype == SCTP_STATE_COOKIE) ||
2957 		    (ptype == SCTP_UNRECOG_PARAM) ||
2958 		    (ptype == SCTP_COOKIE_PRESERVE) ||
2959 		    (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
2960 		    (ptype == SCTP_PRSCTP_SUPPORTED) ||
2961 		    (ptype == SCTP_ADD_IP_ADDRESS) ||
2962 		    (ptype == SCTP_DEL_IP_ADDRESS) ||
2963 		    (ptype == SCTP_ECN_CAPABLE) ||
2964 		    (ptype == SCTP_ULP_ADAPTION) ||
2965 		    (ptype == SCTP_ERROR_CAUSE_IND) ||
2966 		    (ptype == SCTP_SET_PRIM_ADDR) ||
2967 		    (ptype == SCTP_SUCCESS_REPORT) ||
2968 		    (ptype == SCTP_ULP_ADAPTION) ||
2969 		    (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
2970 		    (ptype == SCTP_ECN_NONCE_SUPPORTED)
2971 			) {
2972 			/* no skip it */
2973 			at += SCTP_SIZE32(plen);
2974 		} else if (ptype == SCTP_HOSTNAME_ADDRESS) {
2975 			/* We can NOT handle HOST NAME addresses!! */
2976 #ifdef SCTP_DEBUG
2977 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2978 		printf("Can't handle hostname addresses.. abort processing\n");
2979 	}
2980 #endif
2981 			*abort_processing = 1;
2982 			if (op_err == NULL) {
2983 				/* Ok need to try to get a mbuf */
2984 				MGETHDR(op_err, M_DONTWAIT, MT_DATA);
2985 				if (op_err) {
2986 					op_err->m_len = 0;
2987 					op_err->m_pkthdr.len = 0;
2988 					/* pre-reserve space for ip and sctp header  and chunk hdr*/
2989 					op_err->m_data += sizeof(struct ip6_hdr);
2990 					op_err->m_data += sizeof(struct sctphdr);
2991 					op_err->m_data += sizeof(struct sctp_chunkhdr);
2992 				}
2993 			}
2994 			if (op_err) {
2995 				/* If we have space */
2996 				struct sctp_paramhdr s;
2997 				if (err_at % 4) {
2998 					u_int32_t cpthis=0;
2999 					pad_needed = 4 - (err_at % 4);
3000 					m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
3001 					err_at += pad_needed;
3002 				}
3003 				s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3004 				s.param_length = htons(sizeof(s) + plen);
3005 				m_copyback(op_err, err_at, sizeof(s), (void *)&s);
3006 				err_at += sizeof(s);
3007 				phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3008 				if (phdr == NULL) {
3009 					sctp_m_freem(op_err);
3010 					/* we are out of memory but we
3011 					 * still need to have a look at what to
3012 					 * do (the system is in trouble though).
3013 					 */
3014 					return (NULL);
3015 				}
3016 				m_copyback(op_err, err_at, plen, (void *)phdr);
3017 				err_at += plen;
3018 			}
3019 			return (op_err);
3020 		} else {
3021 			/* we do not recognize the parameter
3022 			 * figure out what we do.
3023 			 */
3024 #ifdef SCTP_DEBUG
3025 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3026 				printf("Got parameter type %x - unknown\n",
3027 				       (u_int)ptype);
3028 			}
3029 #endif
3030 			if ((ptype & 0x4000) == 0x4000) {
3031 				/* Report bit is set?? */
3032 #ifdef SCTP_DEBUG
3033 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3034 					printf("Report bit is set\n");
3035 				}
3036 #endif
3037 				if (op_err == NULL) {
3038 					/* Ok need to try to get an mbuf */
3039 					MGETHDR(op_err, M_DONTWAIT, MT_DATA);
3040 					if (op_err) {
3041 						op_err->m_len = 0;
3042 						op_err->m_pkthdr.len = 0;
3043 						op_err->m_data += sizeof(struct ip6_hdr);
3044 						op_err->m_data += sizeof(struct sctphdr);
3045 						op_err->m_data += sizeof(struct sctp_chunkhdr);
3046 					}
3047 				}
3048 				if (op_err) {
3049 					/* If we have space */
3050 					struct sctp_paramhdr s;
3051 					if (err_at % 4) {
3052 						u_int32_t cpthis=0;
3053 						pad_needed = 4 - (err_at % 4);
3054 						m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
3055 						err_at += pad_needed;
3056  					}
3057 					s.param_type = htons(SCTP_UNRECOG_PARAM);
3058 					s.param_length = htons(sizeof(s) + plen);
3059 					m_copyback(op_err, err_at, sizeof(s), (void *)&s);
3060 					err_at += sizeof(s);
3061 					if (plen > sizeof(tempbuf)) {
3062 						plen = sizeof(tempbuf);
3063 					}
3064 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3065 					if (phdr == NULL) {
3066 						sctp_m_freem(op_err);
3067 						/* we are out of memory but we
3068 						 * still need to have a look at what to
3069 						 * do (the system is in trouble though).
3070 						 */
3071 						goto more_processing;
3072 					}
3073 					m_copyback(op_err, err_at, plen, (void *)phdr);
3074 					err_at += plen;
3075 				}
3076 			}
3077 		more_processing:
3078 			if ((ptype & 0x8000) == 0x0000) {
3079 #ifdef SCTP_DEBUG
3080 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3081 					printf("Abort bit is now setting1\n");
3082 				}
3083 #endif
3084 				return (op_err);
3085 			} else {
3086 				/* skip this chunk and continue processing */
3087 				at += SCTP_SIZE32(plen);
3088 			}
3089 
3090 		}
3091 		phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3092 	}
3093 	return (op_err);
3094 }
3095 
3096 static int
3097 sctp_are_there_new_addresses(struct sctp_association *asoc,
3098     struct mbuf *in_initpkt, int iphlen, int offset)
3099 {
3100 	/*
3101 	 * Given a INIT packet, look through the packet to verify that
3102 	 * there are NO new addresses. As we go through the parameters
3103 	 * add reports of any un-understood parameters that require an
3104 	 * error.  Also we must return (1) to drop the packet if we see
3105 	 * a un-understood parameter that tells us to drop the chunk.
3106 	 */
3107 	struct sockaddr_in sin4, *sa4;
3108 	struct sockaddr_in6 sin6, *sa6;
3109 	struct sockaddr *sa_touse;
3110 	struct sockaddr *sa;
3111 	struct sctp_paramhdr *phdr, params;
3112 	struct ip *iph;
3113 	struct mbuf *mat;
3114 	uint16_t ptype, plen;
3115 	uint8_t fnd;
3116 	struct sctp_nets *net;
3117 
3118 	memset(&sin4, 0, sizeof(sin4));
3119 	memset(&sin6, 0, sizeof(sin6));
3120 	sin4.sin_family = AF_INET;
3121 	sin4.sin_len = sizeof(sin4);
3122 	sin6.sin6_family = AF_INET6;
3123 	sin6.sin6_len = sizeof(sin6);
3124 
3125 	sa_touse = NULL;
3126 	/* First what about the src address of the pkt ? */
3127 	iph = mtod(in_initpkt, struct ip *);
3128 	if (iph->ip_v == IPVERSION) {
3129 		/* source addr is IPv4 */
3130 		sin4.sin_addr = iph->ip_src;
3131 		sa_touse = (struct sockaddr *)&sin4;
3132 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3133 		/* source addr is IPv6 */
3134 		struct ip6_hdr *ip6h;
3135 		ip6h = mtod(in_initpkt, struct ip6_hdr *);
3136 		sin6.sin6_addr = ip6h->ip6_src;
3137 		sa_touse = (struct sockaddr *)&sin6;
3138 	} else {
3139 		return (1);
3140 	}
3141 
3142 	fnd = 0;
3143 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3144 		sa = (struct sockaddr *)&net->ro.ro_sa;
3145 		if (sa->sa_family == sa_touse->sa_family) {
3146 			if (sa->sa_family == AF_INET) {
3147 			    sa4 = (struct sockaddr_in *)sa;
3148 				if (sa4->sin_addr.s_addr ==
3149 				    sin4.sin_addr.s_addr) {
3150 					fnd = 1;
3151 					break;
3152 				}
3153 			} else if (sa->sa_family == AF_INET6) {
3154 				sa6 = (struct sockaddr_in6 *)sa;
3155 				if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3156 				    &sin6.sin6_addr)) {
3157 					fnd = 1;
3158 					break;
3159 				}
3160 			}
3161 		}
3162 	}
3163 	if (fnd == 0) {
3164 		/* New address added! no need to look further. */
3165 		return (1);
3166 	}
3167 	/* Ok so far lets munge through the rest of the packet */
3168 	mat = in_initpkt;
3169 	sa_touse = NULL;
3170 	offset += sizeof(struct sctp_init_chunk);
3171 	phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3172 	while (phdr) {
3173 		ptype = ntohs(phdr->param_type);
3174 		plen = ntohs(phdr->param_length);
3175 		if (ptype == SCTP_IPV4_ADDRESS) {
3176 			struct sctp_ipv4addr_param *p4, p4_buf;
3177 
3178 			phdr = sctp_get_next_param(mat, offset,
3179 			    (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3180 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
3181 			    phdr == NULL) {
3182                                 return (1);
3183                         }
3184 			p4 = (struct sctp_ipv4addr_param *)phdr;
3185 			sin4.sin_addr.s_addr = p4->addr;
3186 			sa_touse = (struct sockaddr *)&sin4;
3187 		} else if (ptype == SCTP_IPV6_ADDRESS) {
3188 			struct sctp_ipv6addr_param *p6, p6_buf;
3189 
3190 			phdr = sctp_get_next_param(mat, offset,
3191 			    (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3192 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
3193 			    phdr == NULL) {
3194                                 return (1);
3195                         }
3196 			p6 = (struct sctp_ipv6addr_param *)phdr;
3197 			memcpy((void *)&sin6.sin6_addr, p6->addr,
3198 			    sizeof(p6->addr));
3199 			sa_touse = (struct sockaddr *)&sin4;
3200 		}
3201 
3202 		if (sa_touse) {
3203 			/* ok, sa_touse points to one to check */
3204 			fnd = 0;
3205 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3206 				sa = (struct sockaddr *)&net->ro.ro_sa;
3207 				if (sa->sa_family != sa_touse->sa_family) {
3208 					continue;
3209 				}
3210 				if (sa->sa_family == AF_INET) {
3211 					sa4 = (struct sockaddr_in *)sa;
3212 					if (sa4->sin_addr.s_addr ==
3213 					    sin4.sin_addr.s_addr) {
3214 						fnd = 1;
3215 						break;
3216 					}
3217 				} else if (sa->sa_family == AF_INET6) {
3218 					sa6 = (struct sockaddr_in6 *)sa;
3219 					if (SCTP6_ARE_ADDR_EQUAL(
3220 					    &sa6->sin6_addr, &sin6.sin6_addr)) {
3221 						fnd = 1;
3222 						break;
3223 					}
3224 				}
3225 			}
3226 			if (!fnd) {
3227 				/* New addr added! no need to look further */
3228 				return (1);
3229 			}
3230 		}
3231 		offset += SCTP_SIZE32(plen);
3232 		phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3233 	}
3234 	return (0);
3235 }
3236 
3237 /*
3238  * Given a MBUF chain that was sent into us containing an
3239  * INIT. Build a INIT-ACK with COOKIE and send back.
3240  * We assume that the in_initpkt has done a pullup to
3241  * include IPv6/4header, SCTP header and initial part of
3242  * INIT message (i.e. the struct sctp_init_msg).
3243  */
3244 void
3245 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3246     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3247     struct sctp_init_chunk *init_chk)
3248 {
3249 	struct sctp_association *asoc;
3250 	struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3251 	struct sctp_init_msg *initackm_out;
3252 	struct sctp_ecn_supported_param *ecn;
3253 	struct sctp_prsctp_supported_param *prsctp;
3254 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
3255 	struct sctp_supported_chunk_types_param *pr_supported;
3256 	struct sockaddr_storage store;
3257 	struct sockaddr_in *sin;
3258 	struct sockaddr_in6 *sin6;
3259 	struct route *ro;
3260 	struct ip *iph;
3261 	struct ip6_hdr *ip6;
3262 	const struct sockaddr *to;
3263 	struct sctp_state_cookie stc;
3264 	struct sctp_nets *net=NULL;
3265 	int cnt_inits_to=0;
3266 	uint16_t his_limit, i_want;
3267 	int abort_flag, padval, sz_of;
3268 	struct rtentry *rt;
3269 
3270 	if (stcb) {
3271 		asoc = &stcb->asoc;
3272 	} else {
3273 		asoc = NULL;
3274 	}
3275 	m_last = NULL;
3276 	if ((asoc != NULL) &&
3277 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3278 	    (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3279 		/* new addresses, out of here in non-cookie-wait states */
3280 		/*
3281 		 * Send a ABORT, we don't add the new address error clause though
3282 		 * we even set the T bit and copy in the 0 tag.. this looks no
3283 		 * different than if no listner was present.
3284 		 */
3285 		sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3286 		return;
3287 	}
3288 	abort_flag = 0;
3289 	op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3290 	    (offset+sizeof(struct sctp_init_chunk)),
3291 	    &abort_flag, (struct sctp_chunkhdr *)init_chk);
3292 	if (abort_flag) {
3293 		sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3294 		return;
3295 	}
3296 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
3297 	if (m == NULL) {
3298 		/* No memory, INIT timer will re-attempt. */
3299 		if (op_err)
3300 			sctp_m_freem(op_err);
3301 		return;
3302 	}
3303 	MCLGET(m, M_DONTWAIT);
3304 	if ((m->m_flags & M_EXT) != M_EXT) {
3305 		/* Failed to get cluster buffer */
3306 		if (op_err)
3307 			sctp_m_freem(op_err);
3308 		sctp_m_freem(m);
3309 		return;
3310 	}
3311 	m->m_data += SCTP_MIN_OVERHEAD;
3312 	m_reset_rcvif(m);
3313 	m->m_len = sizeof(struct sctp_init_msg);
3314 
3315 	/* the time I built cookie */
3316 	SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3317 
3318 	/* populate any tie tags */
3319 	if (asoc != NULL) {
3320 		/* unlock before tag selections */
3321 		SCTP_TCB_UNLOCK(stcb);
3322 		if (asoc->my_vtag_nonce == 0)
3323 			asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3324 		stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3325 
3326 		if (asoc->peer_vtag_nonce == 0)
3327 			asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3328 		stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3329 
3330 		stc.cookie_life = asoc->cookie_life;
3331 		net = asoc->primary_destination;
3332 		/* now we must relock */
3333 		SCTP_INP_RLOCK(inp);
3334 		/* we may be in trouble here if the inp got freed
3335 		 * most likely this set of tests will protect
3336 		 * us but there is a chance not.
3337 		 */
3338 		if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3339 			if (op_err)
3340 				sctp_m_freem(op_err);
3341 			sctp_m_freem(m);
3342 			sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3343 			return;
3344 		}
3345 		SCTP_TCB_LOCK(stcb);
3346 		SCTP_INP_RUNLOCK(stcb->sctp_ep);
3347 	} else {
3348 		stc.tie_tag_my_vtag = 0;
3349 		stc.tie_tag_peer_vtag = 0;
3350 		/* life I will award this cookie */
3351 		stc.cookie_life = inp->sctp_ep.def_cookie_life;
3352 	}
3353 
3354 	/* copy in the ports for later check */
3355 	stc.myport = sh->dest_port;
3356 	stc.peerport = sh->src_port;
3357 
3358 	/*
3359 	 * If we wanted to honor cookie life extensions, we would add
3360 	 * to stc.cookie_life. For now we should NOT honor any extension
3361 	 */
3362 	stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3363 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3364 		struct inpcb *in_inp;
3365 		/* Its a V6 socket */
3366 		in_inp = (struct inpcb *)inp;
3367 		stc.ipv6_addr_legal = 1;
3368 		/* Now look at the binding flag to see if V4 will be legal */
3369 		if (
3370 #if defined(__FreeBSD__) || defined(__APPLE__)
3371 		    (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3372 #elif defined(__OpenBSD__)
3373 		    (0)	/* For openbsd we do dual bind only */
3374 #else
3375 		    (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3376 #endif
3377 		    == 0) {
3378 			stc.ipv4_addr_legal = 1;
3379 		} else {
3380 			/* V4 addresses are NOT legal on the association */
3381 			stc.ipv4_addr_legal = 0;
3382 		}
3383 	} else {
3384 		/* Its a V4 socket, no - V6 */
3385 		stc.ipv4_addr_legal = 1;
3386 		stc.ipv6_addr_legal = 0;
3387 	}
3388 
3389 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3390 	stc.ipv4_scope = 1;
3391 #else
3392 	stc.ipv4_scope = 0;
3393 #endif
3394 	/* now for scope setup */
3395 	memset((void *)&store, 0, sizeof(store));
3396 	sin = (struct sockaddr_in *)&store;
3397 	sin6 = (struct sockaddr_in6 *)&store;
3398 	if (net == NULL) {
3399 		to = (struct sockaddr *)&store;
3400 		iph = mtod(init_pkt, struct ip *);
3401 		if (iph->ip_v == IPVERSION) {
3402 			struct in_addr addr;
3403 			static struct route iproute;
3404 
3405 			sin->sin_family = AF_INET;
3406 			sin->sin_len = sizeof(struct sockaddr_in);
3407 			sin->sin_port = sh->src_port;
3408 			sin->sin_addr = iph->ip_src;
3409 			/* lookup address */
3410 			stc.address[0] = sin->sin_addr.s_addr;
3411 			stc.address[1] = 0;
3412 			stc.address[2] = 0;
3413 			stc.address[3] = 0;
3414 			stc.addr_type = SCTP_IPV4_ADDRESS;
3415 			/* local from address */
3416 			memset(&iproute, 0, sizeof(iproute));
3417 			ro = &iproute;
3418 
3419 			/* XXX */
3420 			rt = rtcache_lookup(ro, (struct sockaddr *) sin);
3421 			rtcache_unref(rt, ro);
3422 			addr = sctp_ipv4_source_address_selection(inp, NULL,
3423 			    ro, NULL, 0);
3424 			stc.laddress[0] = addr.s_addr;
3425 			stc.laddress[1] = 0;
3426 			stc.laddress[2] = 0;
3427 			stc.laddress[3] = 0;
3428 			stc.laddr_type = SCTP_IPV4_ADDRESS;
3429 			/* scope_id is only for v6 */
3430 			stc.scope_id = 0;
3431 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3432 			if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3433 				stc.ipv4_scope = 1;
3434 			}
3435 #else
3436 			stc.ipv4_scope = 1;
3437 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3438 			/* Must use the address in this case */
3439 			if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3440 				stc.loopback_scope = 1;
3441 				stc.ipv4_scope = 1;
3442 				stc.site_scope = 1;
3443 				stc.local_scope = 1;
3444 			}
3445 		} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3446 			struct in6_addr addr;
3447                         static struct route iproute6;
3448 			ip6 = mtod(init_pkt, struct ip6_hdr *);
3449 			sin6->sin6_family = AF_INET6;
3450 			sin6->sin6_len = sizeof(struct sockaddr_in6);
3451 			sin6->sin6_port = sh->src_port;
3452 			sin6->sin6_addr = ip6->ip6_src;
3453 			/* lookup address */
3454 			memcpy(&stc.address, &sin6->sin6_addr,
3455 			    sizeof(struct in6_addr));
3456 			sin6->sin6_scope_id = 0;
3457 			stc.addr_type = SCTP_IPV6_ADDRESS;
3458 			stc.scope_id = 0;
3459 			if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3460 				stc.loopback_scope = 1;
3461 				stc.local_scope = 1;
3462 				stc.site_scope = 1;
3463 				stc.ipv4_scope = 1;
3464 			} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3465 				/*
3466 				 * If the new destination is a LINK_LOCAL
3467 				 * we must have common both site and local
3468 				 * scope. Don't set local scope though since
3469 				 * we must depend on the source to be added
3470 				 * implicitly. We cannot assure just because
3471 				 * we share one link that all links are common.
3472 				 *
3473 				 * XXX: never treat link-local case explicitly.
3474 				 * Use general routines defined in scope6.c.
3475 				 * (jinmei@kame)
3476 				 */
3477 				stc.local_scope = 0;
3478 				stc.site_scope = 1;
3479  				stc.ipv4_scope = 1;
3480 				/* we start counting for the private
3481 				 * address stuff at 1. since the link
3482 				 * local we source from won't show
3483 				 * up in our scoped count.
3484 				 */
3485 				cnt_inits_to=1;
3486 				/* pull out the scope_id from incoming pkt */
3487 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
3488 				(void)in6_recoverscope(sin6, &in6_src,
3489 				    m_get_rcvif_NOMPSAFE(init_pkt));
3490 				in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3491 				    NULL);
3492 #else
3493 				(void)sa6_recoverscope(sin6);
3494 #endif
3495 				stc.scope_id = sin6->sin6_scope_id;
3496 
3497 			} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3498 				/*
3499 				 * If the new destination is SITE_LOCAL
3500 				 * then we must have site scope in common.
3501 				 */
3502 				stc.site_scope = 1;
3503 			}
3504 			/* local from address */
3505 			memset(&iproute6, 0, sizeof(iproute6));
3506 			ro = (struct route *)&iproute6;
3507 			/* XXX */
3508 			rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
3509 			rtcache_unref(rt, ro);
3510 			addr = sctp_ipv6_source_address_selection(inp, NULL,
3511 			    ro, NULL, 0);
3512 			memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3513 			stc.laddr_type = SCTP_IPV6_ADDRESS;
3514 		}
3515 	} else {
3516 		/* set the scope per the existing tcb */
3517 		struct sctp_nets *lnet;
3518 
3519 		stc.loopback_scope = asoc->loopback_scope;
3520 		stc.ipv4_scope = asoc->ipv4_local_scope;
3521 		stc.site_scope = asoc->site_scope;
3522 		stc.local_scope = asoc->local_scope;
3523 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3524 			if (rtcache_getdst(&lnet->ro)->sa_family == AF_INET6) {
3525 				if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&lnet->ro)->sa_data)) {
3526 					/* if we have a LL address, start counting
3527 					 * at 1.
3528 					 */
3529  					cnt_inits_to = 1;
3530 				}
3531 			}
3532 		}
3533 
3534 		/* use the net pointer */
3535 		to = rtcache_getdst(&net->ro);
3536 		if (to->sa_family == AF_INET) {
3537 			memcpy(&stc.address[0], to, sizeof(struct in_addr));
3538 			stc.address[1] = 0;
3539 			stc.address[2] = 0;
3540 			stc.address[3] = 0;
3541 			stc.addr_type = SCTP_IPV4_ADDRESS;
3542 			if (net->src_addr_selected == 0) {
3543 				/* strange case here, the INIT
3544 				 * should have did the selection.
3545 				 */
3546 				net->_s_addr.sin.sin_addr =
3547 				    sctp_ipv4_source_address_selection(inp,
3548 				    stcb, &net->ro, net, 0);
3549 				net->src_addr_selected = 1;
3550 
3551 			}
3552 
3553 			stc.laddress[0] = net->_s_addr.sin.sin_addr.s_addr;
3554 			stc.laddress[1] = 0;
3555 			stc.laddress[2] = 0;
3556 			stc.laddress[3] = 0;
3557 			stc.laddr_type = SCTP_IPV4_ADDRESS;
3558 		} else if (to->sa_family == AF_INET6) {
3559 			memcpy(&stc.address, &to->sa_data,
3560 			    sizeof(struct in6_addr));
3561 			stc.addr_type = SCTP_IPV6_ADDRESS;
3562 			if (net->src_addr_selected == 0) {
3563 				/* strange case here, the INIT
3564 				 * should have did the selection.
3565 				 */
3566 				net->_s_addr.sin6.sin6_addr =
3567 				    sctp_ipv6_source_address_selection(inp,
3568 				    stcb, &net->ro, net, 0);
3569 				net->src_addr_selected = 1;
3570 			}
3571 			memcpy(&stc.laddress, &net->_s_addr.sin6.sin6_addr,
3572 			    sizeof(struct in6_addr));
3573 			stc.laddr_type = SCTP_IPV6_ADDRESS;
3574 		}
3575 	}
3576 	/* Now lets put the SCTP header in place */
3577 	initackm_out = mtod(m, struct sctp_init_msg *);
3578 	initackm_out->sh.src_port = inp->sctp_lport;
3579 	initackm_out->sh.dest_port = sh->src_port;
3580 	initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3581 	/* Save it off for quick ref */
3582 	stc.peers_vtag = init_chk->init.initiate_tag;
3583 	initackm_out->sh.checksum = 0;	/* calculate later */
3584 	/* who are we */
3585 	strncpy(stc.identification, SCTP_VERSION_STRING,
3586 	   uimin(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3587 	/* now the chunk header */
3588 	initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3589 	initackm_out->msg.ch.chunk_flags = 0;
3590 	/* fill in later from mbuf we build */
3591 	initackm_out->msg.ch.chunk_length = 0;
3592 	/* place in my tag */
3593 	if ((asoc != NULL) &&
3594 	    ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3595 	     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3596 		/* re-use the v-tags and init-seq here */
3597 		initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3598 		initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3599 	} else {
3600 		initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3601 		/* get a TSN to use too */
3602 		initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3603 	}
3604 	/* save away my tag to */
3605 	stc.my_vtag = initackm_out->msg.init.initiate_tag;
3606 
3607 	/* set up some of the credits. */
3608 	initackm_out->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND));
3609 	/* set what I want */
3610 	his_limit = ntohs(init_chk->init.num_inbound_streams);
3611 	/* choose what I want */
3612 	if (asoc != NULL) {
3613 		if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3614 			i_want = asoc->streamoutcnt;
3615 		} else {
3616 			i_want = inp->sctp_ep.pre_open_stream_count;
3617 		}
3618 	} else {
3619 		i_want = inp->sctp_ep.pre_open_stream_count;
3620 	}
3621 	if (his_limit < i_want) {
3622 		/* I Want more :< */
3623 		initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3624 	} else {
3625 		/* I can have what I want :> */
3626 		initackm_out->msg.init.num_outbound_streams = htons(i_want);
3627 	}
3628 	/* tell him his limt. */
3629 	initackm_out->msg.init.num_inbound_streams =
3630 	    htons(inp->sctp_ep.max_open_streams_intome);
3631 	/* setup the ECN pointer */
3632 
3633 /*	if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3634 	if (inp->sctp_ep.adaption_layer_indicator) {
3635 		struct sctp_adaption_layer_indication *ali;
3636 		ali = (struct sctp_adaption_layer_indication *)(
3637 		    (vaddr_t)initackm_out + sizeof(*initackm_out));
3638 		ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3639 		ali->ph.param_length = htons(sizeof(*ali));
3640 		ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3641 		m->m_len += sizeof(*ali);
3642 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
3643 		    sizeof(*ali));
3644 	} else {
3645 		ecn = (struct sctp_ecn_supported_param*)(
3646 		    (vaddr_t)initackm_out + sizeof(*initackm_out));
3647 	}
3648 
3649 	/* ECN parameter */
3650 	if (sctp_ecn == 1) {
3651 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3652 		ecn->ph.param_length = htons(sizeof(*ecn));
3653 		m->m_len += sizeof(*ecn);
3654 
3655 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
3656 		    sizeof(*ecn));
3657 	} else {
3658 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
3659 	}
3660 	/* And now tell the peer we do  pr-sctp */
3661 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3662 	prsctp->ph.param_length = htons(sizeof(*prsctp));
3663 	m->m_len += sizeof(*prsctp);
3664 
3665 
3666 	/* And now tell the peer we do all the extensions */
3667 	pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
3668 	   sizeof(*prsctp));
3669 
3670 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3671 	pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3672 	pr_supported->chunk_types[0] = SCTP_ASCONF;
3673 	pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3674 	pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3675 	pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3676 	pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3677 	pr_supported->chunk_types[5] = 0; /* pad */
3678 	pr_supported->chunk_types[6] = 0; /* pad */
3679 	pr_supported->chunk_types[7] = 0; /* pad */
3680 
3681 	m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3682 	if (sctp_ecn_nonce) {
3683 		/* ECN nonce: And now tell the peer we support ECN nonce */
3684 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
3685 		     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3686 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3687 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3688 		m->m_len += sizeof(*ecn_nonce);
3689 	}
3690 
3691 	m_at = m;
3692 	/* now the addresses */
3693 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3694 		struct ifnet *ifn;
3695 		struct ifaddr *ifa;
3696 		int cnt = cnt_inits_to;
3697 		int s;
3698 
3699 		s = pserialize_read_enter();
3700 		IFNET_READER_FOREACH(ifn) {
3701 			if ((stc.loopback_scope == 0) &&
3702 			    (ifn->if_type == IFT_LOOP)) {
3703 				/*
3704 				 * Skip loopback devices if loopback_scope
3705 				 * not set
3706 				 */
3707 				continue;
3708 			}
3709 			IFADDR_READER_FOREACH(ifa, ifn) {
3710 				if (sctp_is_address_in_scope(ifa,
3711 				    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3712 				    stc.loopback_scope, stc.ipv4_scope,
3713 				    stc.local_scope, stc.site_scope) == 0) {
3714 					continue;
3715 				}
3716 				cnt++;
3717 			}
3718 		}
3719 		pserialize_read_exit(s);
3720 
3721 		if (cnt > 1) {
3722 			s = pserialize_read_enter();
3723 			IFNET_READER_FOREACH(ifn) {
3724 				if ((stc.loopback_scope == 0) &&
3725 				    (ifn->if_type == IFT_LOOP)) {
3726 					/*
3727 					 * Skip loopback devices if
3728 					 * loopback_scope not set
3729 					 */
3730 					continue;
3731 				}
3732 				IFADDR_READER_FOREACH(ifa, ifn) {
3733 					if (sctp_is_address_in_scope(ifa,
3734 					    stc.ipv4_addr_legal,
3735 					    stc.ipv6_addr_legal,
3736 					    stc.loopback_scope, stc.ipv4_scope,
3737 					    stc.local_scope, stc.site_scope) == 0) {
3738 						continue;
3739 					}
3740 					m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3741 				}
3742 			}
3743 			pserialize_read_exit(s);
3744 		}
3745 	} else {
3746 		struct sctp_laddr *laddr;
3747 		int cnt;
3748 		cnt = cnt_inits_to;
3749 		/* First, how many ? */
3750 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3751 			if (laddr->ifa == NULL) {
3752 				continue;
3753 			}
3754 			if (laddr->ifa->ifa_addr == NULL)
3755 				continue;
3756 			if (sctp_is_address_in_scope(laddr->ifa,
3757 			    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3758 			    stc.loopback_scope, stc.ipv4_scope,
3759 			    stc.local_scope, stc.site_scope) == 0) {
3760 				continue;
3761 			}
3762 			cnt++;
3763 		}
3764 		/* If we bind a single address only we won't list
3765 		 * any. This way you can get through a NAT
3766 		 */
3767 		if (cnt > 1) {
3768 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3769 				if (laddr->ifa == NULL) {
3770 #ifdef SCTP_DEBUG
3771 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3772 						printf("Help I have fallen and I can't get up!\n");
3773 					}
3774 #endif
3775 					continue;
3776 				}
3777 				if (laddr->ifa->ifa_addr == NULL)
3778 					continue;
3779 				if (sctp_is_address_in_scope(laddr->ifa,
3780 				    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3781 				    stc.loopback_scope, stc.ipv4_scope,
3782 				    stc.local_scope, stc.site_scope) == 0) {
3783 					continue;
3784 				}
3785 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3786 			}
3787 		}
3788 	}
3789 
3790 	/* tack on the operational error if present */
3791 	if (op_err) {
3792 		if (op_err->m_pkthdr.len % 4) {
3793 			/* must add a pad to the param */
3794 			u_int32_t cpthis=0;
3795 			int padlen;
3796 			padlen = 4 - (op_err->m_pkthdr.len % 4);
3797 			m_copyback(op_err, op_err->m_pkthdr.len, padlen, (void *)&cpthis);
3798 		}
3799 		while (m_at->m_next != NULL) {
3800 			m_at = m_at->m_next;
3801 		}
3802 		m_at->m_next = op_err;
3803 		while (m_at->m_next != NULL) {
3804 			m_at = m_at->m_next;
3805 		}
3806 	}
3807 	/* Get total size of init packet */
3808 	sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3809 	/* pre-calulate the size and update pkt header and chunk header */
3810 	m->m_pkthdr.len = 0;
3811 	for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3812 		m->m_pkthdr.len += m_tmp->m_len;
3813 		if (m_tmp->m_next == NULL) {
3814 			/* m_tmp should now point to last one */
3815 			break;
3816 		}
3817 	}
3818 	/*
3819 	 * Figure now the size of the cookie. We know the size of the
3820 	 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3821 	 * COOKIE-STRUCTURE and SIGNATURE.
3822 	 */
3823 
3824 	/*
3825 	 * take our earlier INIT calc and add in the sz we just calculated
3826 	 * minus the size of the sctphdr (its not included in chunk size
3827 	 */
3828 
3829 	/* add once for the INIT-ACK */
3830 	sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3831 
3832 	/* add a second time for the INIT-ACK in the cookie */
3833 	sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3834 
3835 	/* Now add the cookie header and cookie message struct */
3836 	sz_of += sizeof(struct sctp_state_cookie_param);
3837 	/* ...and add the size of our signature */
3838 	sz_of += SCTP_SIGNATURE_SIZE;
3839 	initackm_out->msg.ch.chunk_length = htons(sz_of);
3840 
3841 	/* Now we must build a cookie */
3842 	m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3843 	    sizeof(struct sctphdr), &stc);
3844 	if (m_cookie == NULL) {
3845 		/* memory problem */
3846 		sctp_m_freem(m);
3847 		return;
3848 	}
3849 	/* Now append the cookie to the end and update the space/size */
3850 	m_tmp->m_next = m_cookie;
3851 
3852 	/*
3853 	 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3854 	 * return here since the timer will drive a retranmission.
3855 	 */
3856 	padval = m->m_pkthdr.len % 4;
3857 	if ((padval) && (m_last)) {
3858 		/* see my previous comments on m_last */
3859 		int ret;
3860 		ret = sctp_add_pad_tombuf(m_last, (4-padval));
3861 		if (ret) {
3862 			/* Houston we have a problem, no space */
3863 			sctp_m_freem(m);
3864 			return;
3865 		}
3866 		m->m_pkthdr.len += padval;
3867 	}
3868 	sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
3869 }
3870 
3871 
3872 static void
3873 sctp_insert_on_wheel(struct sctp_association *asoc,
3874 		     struct sctp_stream_out *strq)
3875 {
3876 	struct sctp_stream_out *stre, *strn;
3877 	stre = TAILQ_FIRST(&asoc->out_wheel);
3878 	if (stre == NULL) {
3879 		/* only one on wheel */
3880 		TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
3881 		return;
3882 	}
3883 	for (; stre; stre = strn) {
3884 		strn = TAILQ_NEXT(stre, next_spoke);
3885 		if (stre->stream_no > strq->stream_no) {
3886 			TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
3887 			return;
3888 		} else if (stre->stream_no == strq->stream_no) {
3889 			/* huh, should not happen */
3890 			return;
3891 		} else if (strn == NULL) {
3892 			/* next one is null */
3893 			TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
3894 					   next_spoke);
3895 		}
3896 	}
3897 }
3898 
3899 static void
3900 sctp_remove_from_wheel(struct sctp_association *asoc,
3901 		       struct sctp_stream_out *strq)
3902 {
3903 	/* take off and then setup so we know it is not on the wheel */
3904 	TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
3905 	strq->next_spoke.tqe_next = NULL;
3906 	strq->next_spoke.tqe_prev = NULL;
3907 }
3908 
3909 
3910 static void
3911 sctp_prune_prsctp(struct sctp_tcb *stcb,
3912 		  struct sctp_association *asoc,
3913 		  struct sctp_sndrcvinfo *srcv,
3914 		  int dataout
3915 	)
3916 {
3917 	int freed_spc=0;
3918 	struct sctp_tmit_chunk *chk, *nchk;
3919 	if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
3920 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
3921 			/*
3922 			 * Look for chunks marked with the PR_SCTP
3923 			 * flag AND the buffer space flag. If the one
3924 			 * being sent is equal or greater priority then
3925 			 * purge the old one and free some space.
3926 			 */
3927 			if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
3928 					   SCTP_PR_SCTP_BUFFER)) ==
3929 			    (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
3930 				/*
3931 				 * This one is PR-SCTP AND buffer space
3932 				 * limited type
3933 				 */
3934 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
3935 					/* Lower numbers equates to
3936 					 * higher priority so if the
3937 					 * one we are looking at has a
3938 					 * larger or equal priority we
3939 					 * want to drop the data and
3940 					 * NOT retransmit it.
3941 					 */
3942 					if (chk->data) {
3943 						/* We release the
3944 						 * book_size if the
3945 						 * mbuf is here
3946 						 */
3947 						int ret_spc;
3948 						int cause;
3949 						if (chk->sent > SCTP_DATAGRAM_UNSENT)
3950 							cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
3951 						else
3952 							cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
3953 						ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
3954 										      cause,
3955 										      &asoc->sent_queue);
3956 						freed_spc += ret_spc;
3957 						if (freed_spc >= dataout) {
3958 							return;
3959 						}
3960 					} /* if chunk was present */
3961 				} /* if of sufficient priority */
3962 			} /* if chunk has enabled */
3963 		} /* tailqforeach */
3964 
3965 		chk = TAILQ_FIRST(&asoc->send_queue);
3966 		while (chk) {
3967 			nchk = TAILQ_NEXT(chk, sctp_next);
3968 			/* Here we must move to the sent queue and mark */
3969 			if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
3970 					   SCTP_PR_SCTP_BUFFER)) ==
3971 			    (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
3972 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
3973 					if (chk->data) {
3974 						/* We release the
3975 						 * book_size if the
3976 						 * mbuf is here
3977 						 */
3978 						int ret_spc;
3979 						ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
3980 						    SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
3981 						    &asoc->send_queue);
3982 
3983 						freed_spc += ret_spc;
3984 						if (freed_spc >= dataout) {
3985 							return;
3986 						}
3987 					} /* end if chk->data */
3988 				} /* end if right class */
3989 			} /* end if chk pr-sctp */
3990 			chk = nchk;
3991 		} /* end while (chk) */
3992 	} /* if enabled in asoc */
3993 }
3994 
3995 static void
3996 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
3997 		   struct sctp_tcb *stcb,
3998 		   struct sctp_sndrcvinfo *srcv,
3999 		   struct sctp_stream_out *strq,
4000 		   struct sctp_nets *net)
4001 {
4002 	memset(template, 0, sizeof(struct sctp_tmit_chunk));
4003 	template->sent = SCTP_DATAGRAM_UNSENT;
4004 	if ((stcb->asoc.peer_supports_prsctp) &&
4005 	    (srcv->sinfo_flags & (SCTP_PR_SCTP_TTL|SCTP_PR_SCTP_BUF)) &&
4006 	    (srcv->sinfo_timetolive > 0)
4007 		) {
4008 		/* If:
4009 		 *  Peer supports PR-SCTP
4010 		 *  The flags is set against this send for PR-SCTP
4011 		 *  And timetolive is a postive value, zero is reserved
4012 		 *     to mean a reliable send for both buffer/time
4013 		 *     related one.
4014 		 */
4015 		if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) {
4016 			/*
4017 			 * Time to live is a priority stored in tv_sec
4018 			 * when doing the buffer drop thing.
4019 			 */
4020 			template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4021 		} else {
4022 			struct timeval tv;
4023 
4024 			SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4025 			tv.tv_sec = srcv->sinfo_timetolive / 1000;
4026 			tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4027 #ifndef __FreeBSD__
4028 			timeradd(&template->rec.data.timetodrop, &tv,
4029 			    &template->rec.data.timetodrop);
4030 #else
4031 			timevaladd(&template->rec.data.timetodrop, &tv);
4032 #endif
4033 		}
4034 	}
4035 	if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
4036 		template->rec.data.stream_seq = strq->next_sequence_sent;
4037 	} else {
4038 		template->rec.data.stream_seq = 0;
4039 	}
4040 	template->rec.data.TSN_seq = 0;	/* not yet assigned */
4041 
4042 	template->rec.data.stream_number = srcv->sinfo_stream;
4043 	template->rec.data.payloadtype = srcv->sinfo_ppid;
4044 	template->rec.data.context = srcv->sinfo_context;
4045 	template->rec.data.doing_fast_retransmit = 0;
4046 	template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4047 
4048 	if (srcv->sinfo_flags & SCTP_ADDR_OVER) {
4049 		template->whoTo = net;
4050 	} else {
4051 		if (stcb->asoc.primary_destination)
4052 			template->whoTo = stcb->asoc.primary_destination;
4053 		else {
4054 			/* TSNH */
4055 			template->whoTo = net;
4056 		}
4057 	}
4058 	/* the actual chunk flags */
4059 	if (srcv->sinfo_flags & SCTP_UNORDERED) {
4060 		template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4061 	} else {
4062 		template->rec.data.rcv_flags = 0;
4063 	}
4064 	/* no flags yet, FRAGMENT_OK goes here */
4065 	template->flags = 0;
4066 	/* PR sctp flags */
4067 	if (stcb->asoc.peer_supports_prsctp) {
4068 		if (srcv->sinfo_timetolive > 0) {
4069 			/*
4070 			 * We only set the flag if timetolive (or
4071 			 * priority) was set to a positive number.
4072 			 * Zero is reserved specifically to be
4073 			 * EXCLUDED and sent reliable.
4074 			 */
4075 			if (srcv->sinfo_flags & SCTP_PR_SCTP_TTL) {
4076 				template->flags |= SCTP_PR_SCTP_ENABLED;
4077 			}
4078 			if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) {
4079 				template->flags |= SCTP_PR_SCTP_BUFFER;
4080 			}
4081 		}
4082 	}
4083 	template->asoc = &stcb->asoc;
4084 }
4085 
4086 
4087 int
4088 sctp_get_frag_point(struct sctp_tcb *stcb,
4089 		    struct sctp_association *asoc)
4090 {
4091 	int siz, ovh;
4092 
4093 	/* For endpoints that have both 6 and 4 addresses
4094 	 * we must reserver room for the 6 ip header, for
4095 	 * those that are only dealing with V4 we use
4096 	 * a larger frag point.
4097 	 */
4098  	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4099 		ovh = SCTP_MED_OVERHEAD;
4100 	} else {
4101 		ovh = SCTP_MED_V4_OVERHEAD;
4102 	}
4103 
4104 	if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4105 		siz = asoc->smallest_mtu - ovh;
4106 	else
4107 		siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4108 /*
4109   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4110 		/* A data chunk MUST fit in a cluster */
4111 /*		siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4112 /*	}*/
4113 
4114 	if (siz % 4) {
4115 		/* make it an even word boundary please */
4116 		siz -= (siz % 4);
4117 	}
4118 	return (siz);
4119 }
4120 extern unsigned int sctp_max_chunks_on_queue;
4121 
4122 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4123 
4124 static int
4125 sctp_msg_append(struct sctp_tcb *stcb,
4126 		struct sctp_nets *net,
4127 		struct mbuf *m,
4128 		struct sctp_sndrcvinfo *srcv,
4129 		int flags)
4130 {
4131 	struct socket *so;
4132 	struct sctp_association *asoc;
4133 	struct sctp_stream_out *strq;
4134 	struct sctp_tmit_chunk *chk;
4135 	struct sctpchunk_listhead tmp;
4136 	struct sctp_tmit_chunk template;
4137 	struct mbuf *n, *mnext;
4138 	struct mbuf *mm;
4139 	unsigned int dataout, siz;
4140 	int mbcnt = 0;
4141 	int mbcnt_e = 0;
4142 	int error = 0;
4143 
4144 	if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4145 		/* Software fault, you blew it on the call */
4146 #ifdef SCTP_DEBUG
4147 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4148 			printf("software error in sctp_msg_append:1\n");
4149 			printf("stcb:%p net:%p m:%p srcv:%p\n",
4150 			       stcb, net, m, srcv);
4151 		}
4152 #endif
4153 		if (m)
4154 			sctp_m_freem(m);
4155 		return (EFAULT);
4156 	}
4157 	so = stcb->sctp_socket;
4158 	asoc = &stcb->asoc;
4159 	if (srcv->sinfo_flags & SCTP_ABORT) {
4160 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4161 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4162 			/* It has to be up before we abort */
4163 			/* how big is the user initiated abort? */
4164 			if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4165 				dataout = m->m_pkthdr.len;
4166 			} else {
4167 				/* we must count */
4168 				dataout = 0;
4169 				for (n = m; n; n = n->m_next) {
4170 					dataout += n->m_len;
4171 				}
4172 			}
4173 			M_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT);
4174 			if (m) {
4175 				struct sctp_paramhdr *ph;
4176 				m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4177 				ph = mtod(m, struct sctp_paramhdr *);
4178 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4179 				ph->param_length = htons(m->m_len);
4180 			}
4181 			sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4182 			m = NULL;
4183 		} else {
4184 			/* Only free if we don't send an abort */
4185 			;
4186 		}
4187 		goto out;
4188 	}
4189 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4190 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4191 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4192 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4193 		/* got data while shutting down */
4194 		error = ECONNRESET;
4195 		goto out;
4196 	}
4197 
4198 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4199 		/* Invalid stream number */
4200 		error = EINVAL;
4201 		goto out;
4202 	}
4203 	if (asoc->strmout == NULL) {
4204 		/* huh? software error */
4205 #ifdef SCTP_DEBUG
4206 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4207 			printf("software error in sctp_msg_append:2\n");
4208 		}
4209 #endif
4210 		error = EFAULT;
4211 		goto out;
4212 	}
4213 	strq = &asoc->strmout[srcv->sinfo_stream];
4214 	/* how big is it ? */
4215 	if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4216 		dataout = m->m_pkthdr.len;
4217 	} else {
4218 		/* we must count */
4219 		dataout = 0;
4220 		for (n = m; n; n = n->m_next) {
4221 			dataout += n->m_len;
4222 		}
4223 	}
4224 #ifdef SCTP_DEBUG
4225 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4226 		printf("Attempt to send out %d bytes\n",
4227 		       dataout);
4228 	}
4229 #endif
4230 
4231 	/* lock the socket buf */
4232 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
4233 	if (error)
4234 		goto out_locked;
4235 
4236 	if (dataout > so->so_snd.sb_hiwat) {
4237 		/* It will NEVER fit */
4238 		error = EMSGSIZE;
4239 		goto release;
4240 	}
4241 	if ((srcv->sinfo_flags & SCTP_EOF) &&
4242 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4243 	    (dataout == 0)
4244 		) {
4245 		goto zap_by_it_all;
4246 	}
4247 	if ((so->so_snd.sb_hiwat <
4248 	     (dataout + asoc->total_output_queue_size)) ||
4249 	    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4250 	    (asoc->total_output_mbuf_queue_size >
4251 	     so->so_snd.sb_mbmax)
4252 		) {
4253 		/* XXX Buffer space hunt for data to skip */
4254 		if (asoc->peer_supports_prsctp) {
4255 			sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4256 		}
4257 		while ((so->so_snd.sb_hiwat <
4258 		    (dataout + asoc->total_output_queue_size)) ||
4259 		    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4260 		    (asoc->total_output_mbuf_queue_size >
4261 		    so->so_snd.sb_mbmax)) {
4262 			struct sctp_inpcb *inp;
4263 			/* Now did we free up enough room? */
4264 			if (so->so_state & SS_NBIO) {
4265 				/* Non-blocking io in place */
4266 				error = EWOULDBLOCK;
4267 				goto release;
4268 			}
4269 			/*
4270 			 * We store off a pointer to the endpoint.
4271 			 * Since on return from this we must check to
4272 			 * see if an so_error is set. If so we may have
4273 			 * been reset and our stcb destroyed. Returning
4274 			 * an error will cause the correct error return
4275 			 * through and fix this all.
4276 			 */
4277 			inp = stcb->sctp_ep;
4278 			/*
4279 			 * Not sure how else to do this since
4280 			 * the level we suspended at is not
4281 			 * known deep down where we are. I will
4282 			 * drop to spl0() so that others can
4283 			 * get in.
4284 			 */
4285 
4286 			inp->sctp_tcb_at_block = (void *)stcb;
4287 			inp->error_on_block = 0;
4288 			sbunlock(&so->so_snd);
4289 			error = sbwait(&so->so_snd);
4290 			/*
4291 			 * XXX: This is ugly but I have
4292 			 * recreated most of what goes on to
4293 			 * block in the sb. UGHH
4294 			 * May want to add the bit about being
4295 			 * no longer connected.. but this then
4296 			 * further dooms the UDP model NOT to
4297 			 * allow this.
4298 			 */
4299 			inp->sctp_tcb_at_block = 0;
4300 			if (inp->error_on_block)
4301 				error = inp->error_on_block;
4302 			if (so->so_error)
4303 				error = so->so_error;
4304 			if (error) {
4305 				goto out_locked;
4306 			}
4307 			error = sblock(&so->so_snd, M_WAITOK);
4308 			if (error)
4309 				goto out_locked;
4310 			/* Otherwise we cycle back and recheck
4311 			 * the space
4312 			 */
4313 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4314 			if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4315 #else
4316 			if (so->so_state & SS_CANTSENDMORE) {
4317 #endif
4318 				error = EPIPE;
4319 				goto release;
4320 			}
4321 			if (so->so_error) {
4322 				error = so->so_error;
4323 				goto release;
4324 			}
4325 		}
4326 	}
4327 	/* If we have a packet header fix it if it was broke */
4328 	if (m->m_flags & M_PKTHDR) {
4329 		m->m_pkthdr.len = dataout;
4330 	}
4331 	/* use the smallest one, user set value or
4332 	 * smallest mtu of the asoc
4333 	 */
4334 	siz = sctp_get_frag_point(stcb, asoc);
4335 	if ((dataout) && (dataout <= siz)) {
4336 		/* Fast path */
4337 		chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4338 		if (chk == NULL) {
4339 			error = ENOMEM;
4340 			goto release;
4341 		}
4342 		sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4343 		chk->whoTo->ref_count++;
4344 		chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4345 
4346 		/* no flags yet, FRAGMENT_OK goes here */
4347 		sctppcbinfo.ipi_count_chunk++;
4348 		sctppcbinfo.ipi_gencnt_chunk++;
4349 		asoc->chunks_on_out_queue++;
4350 		chk->data = m;
4351 		m = NULL;
4352 		/* Total in the MSIZE */
4353 		for (mm = chk->data; mm; mm = mm->m_next) {
4354 			mbcnt += MSIZE;
4355 			if (mm->m_flags & M_EXT) {
4356 				mbcnt += chk->data->m_ext.ext_size;
4357 			}
4358 		}
4359 		/* fix up the send_size if it is not present */
4360 		chk->send_size = dataout;
4361 		chk->book_size = chk->send_size;
4362 		chk->mbcnt = mbcnt;
4363 		/* ok, we are committed */
4364 		if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
4365 			/* bump the ssn if we are unordered. */
4366 			strq->next_sequence_sent++;
4367 		}
4368 		chk->data->m_nextpkt = 0;
4369 		asoc->stream_queue_cnt++;
4370 		TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4371 		/* now check if this stream is on the wheel */
4372 		if ((strq->next_spoke.tqe_next == NULL) &&
4373 		    (strq->next_spoke.tqe_prev == NULL)) {
4374 			/* Insert it on the wheel since it is not
4375 			 * on it currently
4376 			 */
4377 			sctp_insert_on_wheel(asoc, strq);
4378 		}
4379 	} else if ((dataout) && (dataout > siz)) {
4380 		/* Slow path */
4381 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4382 		    (dataout > siz)) {
4383 			error = EMSGSIZE;
4384 			goto release;
4385 		}
4386 		/* setup the template */
4387 		sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4388 
4389 		n = m;
4390 		while (dataout > siz) {
4391 			/*
4392 			 * We can wait since this is called from the user
4393 			 * send side
4394 			 */
4395 			n->m_nextpkt = m_split(n, siz, M_WAIT);
4396 			if (n->m_nextpkt == NULL) {
4397 				error = EFAULT;
4398 				goto release;
4399 			}
4400 			dataout -= siz;
4401 			n = n->m_nextpkt;
4402 		}
4403 		/*
4404 		 * ok, now we have a chain on m where m->m_nextpkt points to
4405 		 * the next chunk and m/m->m_next chain is the piece to send.
4406 		 * We must go through the chains and thread them on to
4407 		 * sctp_tmit_chunk chains and place them all on the stream
4408 		 * queue, breaking the m->m_nextpkt pointers as we go.
4409 		 */
4410 		n = m;
4411 		TAILQ_INIT(&tmp);
4412 		while (n) {
4413 			/*
4414 			 * first go through and allocate a sctp_tmit chunk
4415 			 * for each chunk piece
4416 			 */
4417 			chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4418 			if (chk == NULL) {
4419 				/*
4420 				 * ok we must spin through and dump anything
4421 				 * we have allocated and then jump to the
4422 				 * no_membad
4423 				 */
4424 				chk = TAILQ_FIRST(&tmp);
4425 				while (chk) {
4426 					TAILQ_REMOVE(&tmp, chk, sctp_next);
4427 					SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4428 					sctppcbinfo.ipi_count_chunk--;
4429 					asoc->chunks_on_out_queue--;
4430 					if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4431 						panic("Chunk count is negative");
4432 					}
4433 					sctppcbinfo.ipi_gencnt_chunk++;
4434 					chk = TAILQ_FIRST(&tmp);
4435 				}
4436 				error = ENOMEM;
4437 				goto release;
4438 			}
4439 			sctppcbinfo.ipi_count_chunk++;
4440 			asoc->chunks_on_out_queue++;
4441 
4442 			sctppcbinfo.ipi_gencnt_chunk++;
4443 			*chk = template;
4444 			chk->whoTo->ref_count++;
4445 			chk->data = n;
4446 			/* Total in the MSIZE */
4447 			mbcnt_e = 0;
4448 			for (mm = chk->data; mm; mm = mm->m_next) {
4449 				mbcnt_e += MSIZE;
4450 				if (mm->m_flags & M_EXT) {
4451 					mbcnt_e += chk->data->m_ext.ext_size;
4452 				}
4453 			}
4454 			/* now fix the chk->send_size */
4455 			if (chk->data->m_flags & M_PKTHDR) {
4456 				chk->send_size = chk->data->m_pkthdr.len;
4457 			} else {
4458 				struct mbuf *nn;
4459 				chk->send_size = 0;
4460 				for (nn = chk->data; nn; nn = nn->m_next) {
4461 					chk->send_size += nn->m_len;
4462 				}
4463 			}
4464 			chk->book_size = chk->send_size;
4465 			chk->mbcnt = mbcnt_e;
4466 			mbcnt += mbcnt_e;
4467 			if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4468 				asoc->sent_queue_cnt_removeable++;
4469 			}
4470 			n = n->m_nextpkt;
4471 			TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4472 		}
4473 		m = NULL;
4474 		/* now that we have enough space for all de-couple the
4475 		 * chain of mbufs by going through our temp array
4476 		 * and breaking the pointers.
4477 		 */
4478 		/* ok, we are committed */
4479 		if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
4480 			/* bump the ssn if we are unordered. */
4481 			strq->next_sequence_sent++;
4482 		}
4483 		/* Mark the first/last flags. This will
4484 		 * result int a 3 for a single item on the list
4485 		 */
4486 		chk = TAILQ_FIRST(&tmp);
4487 		chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4488 		chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4489 		chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4490 		/* now break any chains on the queue and
4491 		 * move it to the streams actual queue.
4492 		 */
4493 		chk = TAILQ_FIRST(&tmp);
4494 		while (chk) {
4495 			chk->data->m_nextpkt = 0;
4496 			TAILQ_REMOVE(&tmp, chk, sctp_next);
4497 			asoc->stream_queue_cnt++;
4498 			TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4499 			chk = TAILQ_FIRST(&tmp);
4500 		}
4501 		/* now check if this stream is on the wheel */
4502 		if ((strq->next_spoke.tqe_next == NULL) &&
4503 		    (strq->next_spoke.tqe_prev == NULL)) {
4504 			/* Insert it on the wheel since it is not
4505 			 * on it currently
4506 			 */
4507 			sctp_insert_on_wheel(asoc, strq);
4508 		}
4509 	}
4510 	/* has a SHUTDOWN been (also) requested by the user on this asoc? */
4511 zap_by_it_all:
4512 
4513 	if ((srcv->sinfo_flags & SCTP_EOF) &&
4514 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4515 
4516 		int some_on_streamwheel = 0;
4517 
4518 		if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4519 			/* Check to see if some data queued */
4520 			struct sctp_stream_out *outs;
4521 			TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4522 				if (!TAILQ_EMPTY(&outs->outqueue)) {
4523 					some_on_streamwheel = 1;
4524 					break;
4525 				}
4526 			}
4527 		}
4528 
4529 		if (TAILQ_EMPTY(&asoc->send_queue) &&
4530 		    TAILQ_EMPTY(&asoc->sent_queue) &&
4531 		    (some_on_streamwheel == 0)) {
4532 			/* there is nothing queued to send, so I'm done... */
4533 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4534 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4535 				/* only send SHUTDOWN the first time through */
4536 #ifdef SCTP_DEBUG
4537 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4538 					printf("%s:%d sends a shutdown\n",
4539 					       __FILE__,
4540 					       __LINE__
4541 						);
4542 				}
4543 #endif
4544 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4545 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4546 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4547 						 asoc->primary_destination);
4548 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4549 						 asoc->primary_destination);
4550 			}
4551 		} else {
4552 			/*
4553 			 * we still got (or just got) data to send, so set
4554 			 * SHUTDOWN_PENDING
4555 			 */
4556 			asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4557 		}
4558 	}
4559 #ifdef SCTP_MBCNT_LOGGING
4560 	sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4561 		       asoc->total_output_queue_size,
4562 		       dataout,
4563 		       asoc->total_output_mbuf_queue_size,
4564 		       mbcnt);
4565 #endif
4566 	asoc->total_output_queue_size += dataout;
4567 	asoc->total_output_mbuf_queue_size += mbcnt;
4568 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4569 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4570 		so->so_snd.sb_cc += dataout;
4571 		so->so_snd.sb_mbcnt += mbcnt;
4572 	}
4573 
4574 #ifdef SCTP_DEBUG
4575 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4576 		printf("++total out:%d total_mbuf_out:%d\n",
4577 		       (int)asoc->total_output_queue_size,
4578 		       (int)asoc->total_output_mbuf_queue_size);
4579 	}
4580 #endif
4581 
4582 release:
4583 	sbunlock(&so->so_snd);
4584 out_locked:
4585 
4586 out:
4587 	if (m && m->m_nextpkt) {
4588 		n = m;
4589 		while (n) {
4590 			mnext = n->m_nextpkt;
4591 			n->m_nextpkt = NULL;
4592 			sctp_m_freem(n);
4593 			n = mnext;
4594 		}
4595 	} else if (m)
4596 		sctp_m_freem(m);
4597 
4598 	return (error);
4599 }
4600 
4601 static struct mbuf *
4602 sctp_copy_mbufchain(struct mbuf *clonechain,
4603 		    struct mbuf *outchain)
4604 {
4605 	struct mbuf *appendchain;
4606 #if defined(__FreeBSD__) || defined(__NetBSD__)
4607 	/* Supposedly m_copypacket is an optimization, use it if we can */
4608 	if (clonechain->m_flags & M_PKTHDR) {
4609 		appendchain = m_copypacket(clonechain, M_DONTWAIT);
4610 		sctp_pegs[SCTP_CACHED_SRC]++;
4611 	} else
4612 		appendchain = m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT);
4613 #elif defined(__APPLE__)
4614 	appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT);
4615 #else
4616 	appendchain = m_copy(clonechain, 0, M_COPYALL);
4617 #endif
4618 
4619 	if (appendchain == NULL) {
4620 		/* error */
4621 		if (outchain)
4622 			sctp_m_freem(outchain);
4623 		return (NULL);
4624 	}
4625 	if (outchain) {
4626 		/* tack on to the end */
4627 		struct mbuf *m;
4628 		m = outchain;
4629 		while (m) {
4630 			if (m->m_next == NULL) {
4631 				m->m_next = appendchain;
4632 				break;
4633 			}
4634 			m = m->m_next;
4635 		}
4636 		if (outchain->m_flags & M_PKTHDR) {
4637 			int append_tot;
4638 			struct mbuf *t;
4639 			t = appendchain;
4640 			append_tot = 0;
4641 			while (t) {
4642 				append_tot += t->m_len;
4643 				t = t->m_next;
4644 			}
4645 			outchain->m_pkthdr.len += append_tot;
4646 		}
4647 		return (outchain);
4648 	} else {
4649 		return (appendchain);
4650 	}
4651 }
4652 
4653 static void
4654 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4655 {
4656 	struct sctp_copy_all *ca;
4657 	struct mbuf *m;
4658 	int turned_on_nonblock=0, ret;
4659 
4660 	ca = (struct sctp_copy_all *)ptr;
4661 	if (ca->m == NULL) {
4662 		return;
4663 	}
4664 	if (ca->inp != inp) {
4665 		/* TSNH */
4666 		return;
4667 	}
4668 	m = sctp_copy_mbufchain(ca->m, NULL);
4669 	if (m == NULL) {
4670 		/* can't copy so we are done */
4671 		ca->cnt_failed++;
4672 		return;
4673 	}
4674 	if ((stcb->sctp_socket->so_state & SS_NBIO) == 0) {
4675 		/* we have to do this non-blocking */
4676 		turned_on_nonblock = 1;
4677 		stcb->sctp_socket->so_state |= SS_NBIO;
4678 	}
4679 	ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, &ca->sndrcv, 0);
4680 	if (turned_on_nonblock) {
4681 		/* we turned on non-blocking so turn it off */
4682 		stcb->sctp_socket->so_state &= ~SS_NBIO;
4683 	}
4684 	if (ret) {
4685 		ca->cnt_failed++;
4686 	} else {
4687 		ca->cnt_sent++;
4688 	}
4689 }
4690 
4691 static void
4692 sctp_sendall_completes(void *ptr, u_int32_t val)
4693 {
4694 	struct sctp_copy_all *ca;
4695 	ca = (struct sctp_copy_all *)ptr;
4696 	/* Do a notify here?
4697 	 * Kacheong suggests that the notify
4698 	 * be done at the send time.. so you would
4699 	 * push up a notification if any send failed.
4700 	 * Don't know if this is feasable since the
4701 	 * only failures we have is "memory" related and
4702 	 * if you cannot get an mbuf to send the data
4703 	 * you surely can't get an mbuf to send up
4704 	 * to notify the user you can't send the data :->
4705 	 */
4706 
4707 	/* now free everything */
4708 	m_freem(ca->m);
4709 	free(ca, M_PCB);
4710 }
4711 
4712 
4713 #define	MC_ALIGN(m, len) do {						\
4714 	(m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);		\
4715 } while (0)
4716 
4717 
4718 
4719 static struct mbuf *
4720 sctp_copy_out_all(struct uio *uio, int len)
4721 {
4722 	struct mbuf *ret, *at;
4723 	int left, willcpy, cancpy, error;
4724 
4725 	MGETHDR(ret, M_WAIT, MT_HEADER);
4726 	if (ret == NULL) {
4727 		/* TSNH */
4728 		return (NULL);
4729 	}
4730 	left = len;
4731 	ret->m_len = 0;
4732 	ret->m_pkthdr.len = len;
4733 	MCLGET(ret, M_WAIT);
4734 	if (ret == NULL) {
4735 		return (NULL);
4736 	}
4737 	if ((ret->m_flags & M_EXT) == 0) {
4738 		m_freem (ret);
4739 		return (NULL);
4740 	}
4741 	cancpy = M_TRAILINGSPACE(ret);
4742 	willcpy = uimin(cancpy, left);
4743 	at = ret;
4744 	while (left > 0) {
4745 		/* Align data to the end */
4746 		MC_ALIGN(at, willcpy);
4747 		error = uiomove(mtod(at, void *), willcpy, uio);
4748 		if (error) {
4749 		err_out_now:
4750 			m_freem(ret);
4751 			return (NULL);
4752 		}
4753 		at->m_len = willcpy;
4754 		at->m_nextpkt = at->m_next = 0;
4755 		left -= willcpy;
4756 		if (left > 0) {
4757 			MGET(at->m_next, M_WAIT, MT_DATA);
4758 			if (at->m_next == NULL) {
4759 				goto err_out_now;
4760 			}
4761 			at = at->m_next;
4762 			at->m_len = 0;
4763 			MCLGET(at, M_WAIT);
4764 			if (at == NULL) {
4765 				goto err_out_now;
4766 			}
4767 			if ((at->m_flags & M_EXT) == 0) {
4768 				goto err_out_now;
4769 			}
4770 			cancpy = M_TRAILINGSPACE(at);
4771 			willcpy = uimin(cancpy, left);
4772 		}
4773 	}
4774 	return (ret);
4775 }
4776 
4777 static int
4778 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4779 {
4780 	int ret;
4781 	struct sctp_copy_all *ca;
4782 	ca = malloc(sizeof(struct sctp_copy_all), M_PCB, M_WAIT);
4783 	if (ca == NULL) {
4784 		m_freem(m);
4785 		return (ENOMEM);
4786 	}
4787 	memset (ca, 0, sizeof(struct sctp_copy_all));
4788 
4789 	ca->inp = inp;
4790 	ca->sndrcv = *srcv;
4791 	/* take off the sendall flag, it would
4792 	 * be bad if we failed to do this  :-0
4793 	 */
4794  	ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;
4795 
4796 	/* get length and mbuf chain */
4797 	if (uio) {
4798 		ca->sndlen = uio->uio_resid;
4799 		ca->m = sctp_copy_out_all(uio, ca->sndlen);
4800 		if (ca->m == NULL) {
4801 			free(ca, M_PCB);
4802 			return (ENOMEM);
4803 		}
4804 	} else {
4805 		if ((m->m_flags & M_PKTHDR) == 0) {
4806 			ca->sndlen = 0;
4807 			while(m) {
4808 				ca->sndlen += m->m_len;
4809 				m = m->m_next;
4810 			}
4811 		} else {
4812 			ca->sndlen = m->m_pkthdr.len;
4813 		}
4814 		ca->m = m;
4815 	}
4816 
4817 	ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4818 				     (void *)ca, 0, sctp_sendall_completes, inp);
4819 	if (ret) {
4820 #ifdef SCTP_DEBUG
4821 		printf("Failed to initate iterator to takeover associations\n");
4822 #endif
4823 		free(ca, M_PCB);
4824 		return (EFAULT);
4825 
4826 	}
4827 	return (0);
4828 }
4829 
4830 
4831 void
4832 sctp_toss_old_cookies(struct sctp_association *asoc)
4833 {
4834 	struct sctp_tmit_chunk *chk, *nchk;
4835 	chk = TAILQ_FIRST(&asoc->control_send_queue);
4836 	while (chk) {
4837 		nchk = TAILQ_NEXT(chk, sctp_next);
4838 		if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4839 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4840 			if (chk->data) {
4841 				sctp_m_freem(chk->data);
4842 				chk->data = NULL;
4843 			}
4844 			asoc->ctrl_queue_cnt--;
4845 			if (chk->whoTo)
4846 				sctp_free_remote_addr(chk->whoTo);
4847 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4848 			sctppcbinfo.ipi_count_chunk--;
4849 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4850 				panic("Chunk count is negative");
4851 			}
4852 			sctppcbinfo.ipi_gencnt_chunk++;
4853 		}
4854 		chk = nchk;
4855 	}
4856 }
4857 
4858 void
4859 sctp_toss_old_asconf(struct sctp_tcb *stcb)
4860 {
4861 	struct sctp_association *asoc;
4862 	struct sctp_tmit_chunk *chk, *chk_tmp;
4863 
4864 	asoc = &stcb->asoc;
4865 	for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
4866 	     chk = chk_tmp) {
4867 		/* get next chk */
4868 		chk_tmp = TAILQ_NEXT(chk, sctp_next);
4869 		/* find SCTP_ASCONF chunk in queue (only one ever in queue) */
4870 		if (chk->rec.chunk_id == SCTP_ASCONF) {
4871 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4872 			if (chk->data) {
4873 				sctp_m_freem(chk->data);
4874 				chk->data = NULL;
4875 			}
4876 			asoc->ctrl_queue_cnt--;
4877 			if (chk->whoTo)
4878 				sctp_free_remote_addr(chk->whoTo);
4879 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4880 			sctppcbinfo.ipi_count_chunk--;
4881 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4882 				panic("Chunk count is negative");
4883 			}
4884 			sctppcbinfo.ipi_gencnt_chunk++;
4885 		}
4886 	}
4887 }
4888 
4889 
4890 static void
4891 sctp_clean_up_datalist(struct sctp_tcb *stcb,
4892 		       struct sctp_association *asoc,
4893 		       struct sctp_tmit_chunk **data_list,
4894 		       int bundle_at,
4895 		       struct sctp_nets *net)
4896 {
4897 	int i;
4898 	for (i = 0; i < bundle_at; i++) {
4899 		/* off of the send queue */
4900 		if (i) {
4901 			/* Any chunk NOT 0 you zap the time
4902 			 * chunk 0 gets zapped or set based on
4903 			 * if a RTO measurement is needed.
4904 			 */
4905 			data_list[i]->do_rtt = 0;
4906 		}
4907 		/* record time */
4908 		data_list[i]->sent_rcv_time = net->last_sent_time;
4909 		TAILQ_REMOVE(&asoc->send_queue,
4910 			     data_list[i],
4911 			     sctp_next);
4912 		/* on to the sent queue */
4913 		TAILQ_INSERT_TAIL(&asoc->sent_queue,
4914 				  data_list[i],
4915 				  sctp_next);
4916 		/* This does not lower until the cum-ack passes it */
4917 		asoc->sent_queue_cnt++;
4918 		asoc->send_queue_cnt--;
4919 		if ((asoc->peers_rwnd <= 0) &&
4920 		    (asoc->total_flight == 0) &&
4921 		    (bundle_at == 1)) {
4922 			/* Mark the chunk as being a window probe */
4923 #ifdef SCTP_DEBUG
4924 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4925 				printf("WINDOW PROBE SET\n");
4926 			}
4927 #endif
4928 			sctp_pegs[SCTP_WINDOW_PROBES]++;
4929 			data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
4930 		} else {
4931 			data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
4932 		}
4933 #ifdef SCTP_AUDITING_ENABLED
4934 		sctp_audit_log(0xC2, 3);
4935 #endif
4936 		data_list[i]->sent = SCTP_DATAGRAM_SENT;
4937 		data_list[i]->snd_count = 1;
4938 		net->flight_size += data_list[i]->book_size;
4939 		asoc->total_flight += data_list[i]->book_size;
4940 		asoc->total_flight_count++;
4941 #ifdef SCTP_LOG_RWND
4942 		sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
4943 			      asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
4944 #endif
4945 		asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
4946 						    (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
4947 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4948 			/* SWS sender side engages */
4949 			asoc->peers_rwnd = 0;
4950 		}
4951 	}
4952 }
4953 
4954 static void
4955 sctp_clean_up_ctl(struct sctp_association *asoc)
4956 {
4957 	struct sctp_tmit_chunk *chk, *nchk;
4958 	for (chk = TAILQ_FIRST(&asoc->control_send_queue);
4959 	    chk; chk = nchk) {
4960 		nchk = TAILQ_NEXT(chk, sctp_next);
4961 		if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
4962 		    (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
4963 		    (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
4964 		    (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
4965 		    (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
4966 		    (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
4967 		    (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
4968 		    (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
4969 		    (chk->rec.chunk_id == SCTP_ECN_CWR) ||
4970 		    (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
4971 			/* Stray chunks must be cleaned up */
4972 		clean_up_anyway:
4973 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4974 			if (chk->data) {
4975 				sctp_m_freem(chk->data);
4976 				chk->data = NULL;
4977 			}
4978 			asoc->ctrl_queue_cnt--;
4979 			sctp_free_remote_addr(chk->whoTo);
4980 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4981 			sctppcbinfo.ipi_count_chunk--;
4982 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4983 				panic("Chunk count is negative");
4984 			}
4985 			sctppcbinfo.ipi_gencnt_chunk++;
4986 		} else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
4987 			struct sctp_stream_reset_req *strreq;
4988 			/* special handling, we must look into the param */
4989 			strreq = mtod(chk->data, struct sctp_stream_reset_req *);
4990 			if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
4991 				goto clean_up_anyway;
4992 			}
4993 		}
4994 	}
4995 }
4996 
4997 static int
4998 sctp_move_to_outqueue(struct sctp_tcb *stcb,
4999 		      struct sctp_stream_out *strq)
5000 {
5001 	/* Move from the stream to the send_queue keeping track of the total */
5002 	struct sctp_association *asoc;
5003 	int tot_moved = 0;
5004 	int failed = 0;
5005 	int padval;
5006 	struct sctp_tmit_chunk *chk, *nchk;
5007 	struct sctp_data_chunk *dchkh;
5008 	struct sctpchunk_listhead tmp;
5009 	struct mbuf *orig;
5010 
5011 	asoc = &stcb->asoc;
5012 	TAILQ_INIT(&tmp);
5013 	chk = TAILQ_FIRST(&strq->outqueue);
5014 	while (chk) {
5015 		nchk = TAILQ_NEXT(chk, sctp_next);
5016 		/* now put in the chunk header */
5017 		orig = chk->data;
5018 		M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT);
5019 		if (chk->data == NULL) {
5020 			/* HELP */
5021 			failed++;
5022 			break;
5023 		}
5024 		if (orig != chk->data) {
5025 			/* A new mbuf was added, account for it */
5026 			if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5027 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5028 				stcb->sctp_socket->so_snd.sb_mbcnt += MSIZE;
5029 			}
5030 #ifdef SCTP_MBCNT_LOGGING
5031 			sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5032 				       asoc->total_output_queue_size,
5033 				       0,
5034 				       asoc->total_output_mbuf_queue_size,
5035 				       MSIZE);
5036 #endif
5037 			stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5038 			chk->mbcnt += MSIZE;
5039 		}
5040 		chk->send_size += sizeof(struct sctp_data_chunk);
5041 		/* This should NOT have to do anything, but
5042 		 * I would rather be cautious
5043 		 */
5044 		if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5045 			m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5046 			if (chk->data == NULL) {
5047 				failed++;
5048 				break;
5049 			}
5050 		}
5051 		dchkh = mtod(chk->data, struct sctp_data_chunk *);
5052 		dchkh->ch.chunk_length = htons(chk->send_size);
5053 		/* Chunks must be padded to even word boundary */
5054 		padval = chk->send_size % 4;
5055 		if (padval) {
5056 			/* For fragmented messages this should not
5057 			 * run except possibly on the last chunk
5058 			 */
5059 			if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5060 				/* we are in big big trouble no mbufs :< */
5061 				failed++;
5062 				break;
5063 			}
5064 			chk->send_size += (4 - padval);
5065 		}
5066 		/* pull from stream queue */
5067 		TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5068 		asoc->stream_queue_cnt--;
5069 		TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5070 		/* add it in to the size of moved chunks */
5071 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5072 			/* we pull only one message */
5073 			break;
5074 		}
5075 		chk = nchk;
5076 	}
5077 	if (failed) {
5078 		/* Gak, we just lost the user message */
5079 		chk = TAILQ_FIRST(&tmp);
5080 		while (chk) {
5081 			nchk = TAILQ_NEXT(chk, sctp_next);
5082 			TAILQ_REMOVE(&tmp, chk, sctp_next);
5083 
5084 			sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5085 					(SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5086 					chk);
5087 
5088 			if (chk->data) {
5089 				sctp_m_freem(chk->data);
5090 				chk->data = NULL;
5091 			}
5092 			if (chk->whoTo) {
5093 				sctp_free_remote_addr(chk->whoTo);
5094 				chk->whoTo = NULL;
5095 			}
5096 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5097 			sctppcbinfo.ipi_count_chunk--;
5098 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5099 				panic("Chunk count is negative");
5100 			}
5101 			sctppcbinfo.ipi_gencnt_chunk++;
5102 			chk = nchk;
5103 		}
5104 		return (0);
5105 	}
5106 	/* now pull them off of temp wheel */
5107 	chk = TAILQ_FIRST(&tmp);
5108 	while (chk) {
5109 		nchk = TAILQ_NEXT(chk, sctp_next);
5110 		/* insert on send_queue */
5111 		TAILQ_REMOVE(&tmp, chk, sctp_next);
5112 		TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5113 		asoc->send_queue_cnt++;
5114 		/* assign TSN */
5115 		chk->rec.data.TSN_seq = asoc->sending_seq++;
5116 
5117 		dchkh = mtod(chk->data, struct sctp_data_chunk *);
5118 		/* Put the rest of the things in place now. Size
5119 		 * was done earlier in previous loop prior to
5120 		 * padding.
5121 		 */
5122 		dchkh->ch.chunk_type = SCTP_DATA;
5123 		dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5124 		dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5125 		dchkh->dp.stream_id = htons(strq->stream_no);
5126 		dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5127 		dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5128 		/* total count moved */
5129 		tot_moved += chk->send_size;
5130 		chk = nchk;
5131 	}
5132 	return (tot_moved);
5133 }
5134 
5135 static void
5136 sctp_fill_outqueue(struct sctp_tcb *stcb,
5137 		   struct sctp_nets *net)
5138 {
5139 	struct sctp_association *asoc;
5140 	struct sctp_tmit_chunk *chk;
5141 	struct sctp_stream_out *strq, *strqn;
5142 	int mtu_fromwheel, goal_mtu;
5143 	unsigned int moved, seenend, cnt_mvd=0;
5144 
5145 	asoc = &stcb->asoc;
5146 	/* Attempt to move at least 1 MTU's worth
5147 	 * onto the wheel for each destination address
5148 	 */
5149 	goal_mtu = net->cwnd - net->flight_size;
5150 	if ((unsigned int)goal_mtu < net->mtu) {
5151 		goal_mtu = net->mtu;
5152 	}
5153 	if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5154 		sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5155 	}
5156 	seenend = moved = mtu_fromwheel = 0;
5157 	if (asoc->last_out_stream == NULL) {
5158 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5159 		if (asoc->last_out_stream == NULL) {
5160 			/* huh nothing on the wheel, TSNH */
5161 			return;
5162 		}
5163 		goto done_it;
5164 	}
5165 	strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5166  done_it:
5167 	if (strq == NULL) {
5168 		asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5169 	}
5170 	while (mtu_fromwheel < goal_mtu) {
5171 		if (strq == NULL) {
5172 			if (seenend == 0) {
5173 				seenend = 1;
5174 				strq = TAILQ_FIRST(&asoc->out_wheel);
5175 			} else if ((moved == 0) && (seenend)) {
5176 				/* none left on the wheel */
5177 				sctp_pegs[SCTP_MOVED_NLEF]++;
5178 				return;
5179 			} else if (moved) {
5180 				/*
5181 				 * clear the flags and rotate back through
5182 				 * again
5183 				 */
5184 				moved = 0;
5185 				seenend = 0;
5186 				strq = TAILQ_FIRST(&asoc->out_wheel);
5187 			}
5188 			if (strq == NULL)
5189 				break;
5190 			continue;
5191 		}
5192 		strqn = TAILQ_NEXT(strq, next_spoke);
5193 		if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5194 			/* none left on this queue, prune a spoke?  */
5195 			sctp_remove_from_wheel(asoc, strq);
5196 			if (strq == asoc->last_out_stream) {
5197 			    /* the last one we used went off the wheel */
5198 			    asoc->last_out_stream = NULL;
5199 			}
5200 			strq = strqn;
5201 			continue;
5202 		}
5203 		if (chk->whoTo != net) {
5204 			/* Skip this stream, first one on stream
5205 			 * does not head to our current destination.
5206 			 */
5207 			strq = strqn;
5208 			continue;
5209 		}
5210 		mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5211 		cnt_mvd++;
5212 		moved++;
5213 		asoc->last_out_stream = strq;
5214 		strq = strqn;
5215 	}
5216 	sctp_pegs[SCTP_MOVED_MAX]++;
5217 #ifdef SCTP_DEBUG
5218 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5219 		printf("Ok we moved %d chunks to send queue\n",
5220 		       moved);
5221 	}
5222 #endif
5223 	if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5224 		sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5225 	}
5226 }
5227 
5228 void
5229 sctp_fix_ecn_echo(struct sctp_association *asoc)
5230 {
5231 	struct sctp_tmit_chunk *chk;
5232 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5233 		if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5234 			chk->sent = SCTP_DATAGRAM_UNSENT;
5235 		}
5236 	}
5237 }
5238 
5239 static void
5240 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5241 		    struct sctp_association *asoc,
5242 		    struct sctp_nets *net)
5243 {
5244 	struct sctp_tmit_chunk *chk;
5245 	struct sctp_nets *a_net;
5246 	a_net = sctp_find_alternate_net(stcb, net);
5247 	if ((a_net != net) &&
5248 	    ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5249 		/*
5250 		 * We only proceed if a valid alternate is found that is
5251 		 * not this one and is reachable. Here we must move all
5252 		 * chunks queued in the send queue off of the destination
5253 		 * address to our alternate.
5254 		 */
5255 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5256 			if (chk->whoTo == net) {
5257 				/* Move the chunk to our alternate */
5258 				sctp_free_remote_addr(chk->whoTo);
5259 				chk->whoTo = a_net;
5260 				a_net->ref_count++;
5261 			}
5262 		}
5263 	}
5264 }
5265 
5266 static int sctp_from_user_send=0;
5267 
5268 static int
5269 sctp_med_chunk_output(struct sctp_inpcb *inp,
5270 		      struct sctp_tcb *stcb,
5271 		      struct sctp_association *asoc,
5272 		      int *num_out,
5273 		      int *reason_code,
5274 		      int control_only, int *cwnd_full, int from_where,
5275 		      struct timeval *now, int *now_filled)
5276 {
5277 	/*
5278 	 * Ok this is the generic chunk service queue.
5279 	 * we must do the following:
5280 	 *  - Service the stream queue that is next, moving any message
5281 	 *    (note I must get a complete message i.e. FIRST/MIDDLE and
5282 	 *    LAST to the out queue in one pass) and assigning TSN's
5283 	 *  - Check to see if the cwnd/rwnd allows any output, if so we
5284 	 *    go ahead and fomulate and send the low level chunks. Making
5285 	 *    sure to combine any control in the control chunk queue also.
5286 	 */
5287 	struct sctp_nets *net;
5288 	struct mbuf *outchain;
5289 	struct sctp_tmit_chunk *chk, *nchk;
5290 	struct sctphdr *shdr;
5291 	/* temp arrays for unlinking */
5292 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5293 	int no_fragmentflg, error;
5294 	int one_chunk, hbflag;
5295 	int asconf, cookie, no_out_cnt;
5296 	int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5297         unsigned int mtu, r_mtu, omtu;
5298 	*num_out = 0;
5299 	cwnd_full_ind = 0;
5300 	ctl_cnt = no_out_cnt = asconf = cookie = 0;
5301 	/*
5302 	 * First lets prime the pump. For each destination, if there
5303 	 * is room in the flight size, attempt to pull an MTU's worth
5304 	 * out of the stream queues into the general send_queue
5305 	 */
5306 #ifdef SCTP_AUDITING_ENABLED
5307 	sctp_audit_log(0xC2, 2);
5308 #endif
5309 #ifdef SCTP_DEBUG
5310 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5311 		printf("***********************\n");
5312 	}
5313 #endif
5314 	hbflag = 0;
5315 	if (control_only)
5316 		no_data_chunks = 1;
5317 	else
5318 		no_data_chunks = 0;
5319 
5320 	/* Nothing to possible to send? */
5321 	if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5322 	    TAILQ_EMPTY(&asoc->send_queue) &&
5323 	    TAILQ_EMPTY(&asoc->out_wheel)) {
5324 #ifdef SCTP_DEBUG
5325 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5326 			printf("All wheels empty\n");
5327 		}
5328 #endif
5329 		return (0);
5330 	}
5331 	if (asoc->peers_rwnd <= 0) {
5332 		/* No room in peers rwnd */
5333 		*cwnd_full = 1;
5334 		*reason_code = 1;
5335 		if (asoc->total_flight > 0) {
5336 			/* we are allowed one chunk in flight */
5337 			no_data_chunks = 1;
5338 			sctp_pegs[SCTP_RWND_BLOCKED]++;
5339 		}
5340 	}
5341 #ifdef SCTP_DEBUG
5342 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5343 		printf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5344 		       (int)no_data_chunks,
5345 		       (int)asoc->total_flight, (int)asoc->peers_rwnd);
5346 	}
5347 #endif
5348 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5349 #ifdef SCTP_DEBUG
5350 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5351 			printf("net:%p fs:%d  cwnd:%d\n",
5352 			       net, net->flight_size, net->cwnd);
5353 		}
5354 #endif
5355 		if (net->flight_size >= net->cwnd) {
5356 			/* skip this network, no room */
5357 			cwnd_full_ind++;
5358 #ifdef SCTP_DEBUG
5359 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5360 				printf("Ok skip fillup->fs:%d > cwnd:%d\n",
5361 				       net->flight_size,
5362 				       net->cwnd);
5363 			}
5364 #endif
5365 			sctp_pegs[SCTP_CWND_NOFILL]++;
5366 			continue;
5367 		}
5368 		/*
5369 		 * spin through the stream queues moving one message and
5370 		 * assign TSN's as appropriate.
5371 		 */
5372 		sctp_fill_outqueue(stcb, net);
5373 	}
5374 	*cwnd_full = cwnd_full_ind;
5375 	/* now service each destination and send out what we can for it */
5376 #ifdef SCTP_DEBUG
5377 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5378 		int chk_cnt = 0;
5379 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5380 			chk_cnt++;
5381 		}
5382 		printf("We have %d chunks on the send_queue\n", chk_cnt);
5383 		chk_cnt = 0;
5384 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5385 			chk_cnt++;
5386 		}
5387 		printf("We have %d chunks on the sent_queue\n", chk_cnt);
5388 		TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5389 			chk_cnt++;
5390 		}
5391 		printf("We have %d chunks on the control_queue\n", chk_cnt);
5392 	}
5393 #endif
5394 	/* If we have data to send, and DSACK is running, stop it
5395 	 * and build a SACK to dump on to bundle with output. This
5396 	 * actually MAY make it so the bundling does not occur if
5397 	 * the SACK is big but I think this is ok because basic SACK
5398 	 * space is pre-reserved in our fragmentation size choice.
5399 	 */
5400 	if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5401 	    (no_data_chunks == 0)) {
5402 		/* We will be sending something */
5403 		if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5404 			/* Yep a callout is pending */
5405 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5406 					stcb->sctp_ep,
5407 					stcb, NULL);
5408 			sctp_send_sack(stcb);
5409 		}
5410 	}
5411 	/* Nothing to send? */
5412 	if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5413 	    (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5414 		return (0);
5415 	}
5416 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5417 		struct rtentry *rt;
5418 		/* how much can we send? */
5419 		if (net->ref_count < 2) {
5420 			/* Ref-count of 1 so we cannot have data or control
5421 			 * queued to this address. Skip it.
5422 			 */
5423  			continue;
5424 		}
5425 		ctl_cnt = bundle_at = 0;
5426 		outchain = NULL;
5427 		no_fragmentflg = 1;
5428 		one_chunk = 0;
5429 
5430 		rt = rtcache_validate(&net->ro);
5431 		if (rt != NULL) {
5432 			/* if we have a route and an ifp
5433 			 * check to see if we have room to
5434 			 * send to this guy
5435 			 */
5436 			struct ifnet *ifp;
5437 			ifp = net->ro._ro_rt->rt_ifp;
5438 			if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
5439 				sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
5440 #ifdef SCTP_LOG_MAXBURST
5441 				sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
5442   #endif
5443 				rtcache_unref(rt, &net->ro);
5444 				continue;
5445 			}
5446 			rtcache_unref(rt, &net->ro);
5447 		}
5448 		if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
5449 			mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5450 		} else {
5451 			mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5452 		}
5453 		if (mtu > asoc->peers_rwnd) {
5454 			if (asoc->total_flight > 0) {
5455 				/* We have a packet in flight somewhere */
5456 				r_mtu = asoc->peers_rwnd;
5457 			} else {
5458 				/* We are always allowed to send one MTU out */
5459 				one_chunk = 1;
5460 				r_mtu = mtu;
5461 			}
5462 		} else {
5463 			r_mtu = mtu;
5464 		}
5465 #ifdef SCTP_DEBUG
5466 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5467 			printf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5468 			       r_mtu, mtu, net, one_chunk);
5469 		}
5470 #endif
5471 		/************************/
5472 		/* Control transmission */
5473 		/************************/
5474 		/* Now first lets go through the control queue */
5475 		for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5476 		     chk; chk = nchk) {
5477 			nchk = TAILQ_NEXT(chk, sctp_next);
5478 			if (chk->whoTo != net) {
5479 				/*
5480 				 * No, not sent to the network we are
5481 				 * looking at
5482 				 */
5483 				continue;
5484 			}
5485 			if (chk->data == NULL) {
5486 				continue;
5487 			}
5488 			if ((chk->data->m_flags & M_PKTHDR) == 0) {
5489 				/*
5490 				 * NOTE: the chk queue MUST have the PKTHDR
5491 				 * flag set on it with a total in the
5492 				 * m_pkthdr.len field!! else the chunk will
5493 				 * ALWAYS be skipped
5494 				 */
5495 				continue;
5496 			}
5497 			if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5498 				/*
5499 				 * It must be unsent. Cookies and ASCONF's
5500 				 * hang around but there timers will force
5501 				 * when marked for resend.
5502 				 */
5503 				continue;
5504 			}
5505 			/* Here we do NOT factor the r_mtu */
5506 			if ((chk->data->m_pkthdr.len < (int)mtu) ||
5507 			    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5508 				/*
5509 				 * We probably should glom the mbuf chain from
5510 				 * the chk->data for control but the problem
5511 				 * is it becomes yet one more level of
5512 				 * tracking to do if for some reason output
5513 				 * fails. Then I have got to reconstruct the
5514 				 * merged control chain.. el yucko.. for now
5515 				 * we take the easy way and do the copy
5516 				 */
5517 				outchain = sctp_copy_mbufchain(chk->data,
5518 							       outchain);
5519 				if (outchain == NULL) {
5520 					return (ENOMEM);
5521 				}
5522 				/* update our MTU size */
5523 				if (mtu > chk->data->m_pkthdr.len)
5524 					mtu -= chk->data->m_pkthdr.len;
5525 				else
5526 					mtu = 0;
5527 				/* Do clear IP_DF ? */
5528 				if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5529 					no_fragmentflg = 0;
5530 				}
5531 				/* Mark things to be removed, if needed */
5532 				if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5533 				    (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5534 				    (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5535 				    (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5536 				    (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5537 				    (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5538 				    (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5539 				    (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5540 				    (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5541 				    (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5542 
5543 					if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5544 						hbflag = 1;
5545 					/* remove these chunks at the end */
5546 					if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5547 						/* turn off the timer */
5548 						if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5549 							sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5550 									inp, stcb, net);
5551 						}
5552 					}
5553 					ctl_cnt++;
5554 				} else {
5555 					/*
5556 					 * Other chunks, since they have
5557 					 * timers running (i.e. COOKIE or
5558 					 * ASCONF) we just "trust" that it
5559 					 * gets sent or retransmitted.
5560 					 */
5561 					ctl_cnt++;
5562 					if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5563 						cookie = 1;
5564 						no_out_cnt = 1;
5565 					} else if (chk->rec.chunk_id == SCTP_ASCONF) {
5566 						/*
5567 						 * set hb flag since we can use
5568 						 * these for RTO
5569 						 */
5570 						hbflag = 1;
5571 						asconf = 1;
5572 					}
5573 					chk->sent = SCTP_DATAGRAM_SENT;
5574 					chk->snd_count++;
5575 				}
5576 				if (mtu == 0) {
5577 					/*
5578 					 * Ok we are out of room but we can
5579 					 * output without effecting the flight
5580 					 * size since this little guy is a
5581 					 * control only packet.
5582 					 */
5583 					if (asconf) {
5584 						sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5585 						asconf = 0;
5586 					}
5587 					if (cookie) {
5588 						sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5589 						cookie = 0;
5590 					}
5591 					if (outchain->m_len == 0) {
5592 						/*
5593 						 * Special case for when you
5594 						 * get a 0 len mbuf at the
5595 						 * head due to the lack of a
5596 						 * MHDR at the beginning.
5597 						 */
5598 						outchain->m_len = sizeof(struct sctphdr);
5599 					} else {
5600 						M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
5601 						if (outchain == NULL) {
5602 							/* no memory */
5603 							error = ENOBUFS;
5604 							goto error_out_again;
5605 						}
5606 					}
5607 					shdr = mtod(outchain, struct sctphdr *);
5608 					shdr->src_port = inp->sctp_lport;
5609 					shdr->dest_port = stcb->rport;
5610 					shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5611 					shdr->checksum = 0;
5612 
5613 					if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5614 										rtcache_getdst(&net->ro),
5615 										outchain,
5616 										no_fragmentflg, 0, NULL, asconf))) {
5617 						if (error == ENOBUFS) {
5618 							asoc->ifp_had_enobuf = 1;
5619 						}
5620 						sctp_pegs[SCTP_DATA_OUT_ERR]++;
5621 						if (from_where == 0) {
5622 							sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5623 						}
5624 					error_out_again:
5625 #ifdef SCTP_DEBUG
5626 						if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5627 							printf("Gak got ctrl error %d\n", error);
5628 						}
5629 #endif
5630 						/* error, could not output */
5631 						if (hbflag) {
5632 #ifdef SCTP_DEBUG
5633 							if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5634 								printf("Update HB anyway\n");
5635 							}
5636 #endif
5637 							if (*now_filled == 0) {
5638 								SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5639 								*now_filled = 1;
5640 								*now = net->last_sent_time;
5641 							} else {
5642 								net->last_sent_time = *now;
5643 							}
5644 							hbflag = 0;
5645 						}
5646 						if (error == EHOSTUNREACH) {
5647 							/*
5648 							 * Destination went
5649 							 * unreachable during
5650 							 * this send
5651 							 */
5652 #ifdef SCTP_DEBUG
5653 							if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5654 								printf("Moving data to an alterante\n");
5655 							}
5656 #endif
5657 							sctp_move_to_an_alt(stcb, asoc, net);
5658 						}
5659 						sctp_clean_up_ctl (asoc);
5660 						return (error);
5661 					} else
5662 						asoc->ifp_had_enobuf = 0;
5663 					/* Only HB or ASCONF advances time */
5664 					if (hbflag) {
5665 						if (*now_filled == 0) {
5666 							SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5667 							*now_filled = 1;
5668 							*now = net->last_sent_time;
5669 						} else {
5670 							net->last_sent_time = *now;
5671 						}
5672 						hbflag = 0;
5673 					}
5674 					/*
5675 					 * increase the number we sent, if a
5676 					 * cookie is sent we don't tell them
5677 					 * any was sent out.
5678 					 */
5679 					if (!no_out_cnt)
5680 						*num_out +=  ctl_cnt;
5681 					/* recalc a clean slate and setup */
5682 					if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5683 						mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5684 					} else {
5685 						mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5686 					}
5687 					no_fragmentflg = 1;
5688 				}
5689 			}
5690 		}
5691 		/*********************/
5692 		/* Data transmission */
5693 		/*********************/
5694 		/* now lets add any data within the MTU constraints */
5695 		if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
5696 			omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5697 		} else {
5698 			omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5699 		}
5700 
5701 #ifdef SCTP_DEBUG
5702 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5703 			printf("Now to data transmission\n");
5704 		}
5705 #endif
5706 
5707 		if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5708 		    (cookie)) {
5709 			for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5710 				if (no_data_chunks) {
5711 					/* let only control go out */
5712 #ifdef SCTP_DEBUG
5713 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5714 						printf("Either nothing to send or we are full\n");
5715 					}
5716 #endif
5717 					break;
5718 				}
5719 				if (net->flight_size >= net->cwnd) {
5720 					/* skip this net, no room for data */
5721 #ifdef SCTP_DEBUG
5722 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5723 						printf("fs:%d > cwnd:%d\n",
5724 						       net->flight_size, net->cwnd);
5725 					}
5726 #endif
5727 					sctp_pegs[SCTP_CWND_BLOCKED]++;
5728 					*reason_code = 2;
5729 					break;
5730 				}
5731 				nchk = TAILQ_NEXT(chk, sctp_next);
5732 				if (chk->whoTo != net) {
5733 					/* No, not sent to this net */
5734 #ifdef SCTP_DEBUG
5735 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5736 						printf("chk->whoTo:%p not %p\n",
5737 						       chk->whoTo, net);
5738 
5739 					}
5740 #endif
5741 					continue;
5742 				}
5743 #ifdef SCTP_DEBUG
5744 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5745 					printf("Can we pick up a chunk?\n");
5746 				}
5747 #endif
5748 				if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5749 					/* strange, we have a chunk that is to bit
5750 					 * for its destination and yet no fragment ok flag.
5751 					 * Something went wrong when the PMTU changed...we did
5752 					 * not mark this chunk for some reason?? I will
5753 					 * fix it here by letting IP fragment it for now and
5754 					 * printing a warning. This really should not happen ...
5755 					 */
5756 /*#ifdef SCTP_DEBUG*/
5757 					printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5758 					       chk->send_size, mtu);
5759 /*#endif*/
5760 					chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5761 				}
5762 
5763 				if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5764 				    ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5765 					/* ok we will add this one */
5766 #ifdef SCTP_DEBUG
5767 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5768 						printf("Picking up the chunk\n");
5769 					}
5770 #endif
5771 					outchain = sctp_copy_mbufchain(chk->data, outchain);
5772 					if (outchain == NULL) {
5773 #ifdef SCTP_DEBUG
5774 						if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5775 							printf("Gakk no memory\n");
5776 						}
5777 #endif
5778 						if (!callout_pending(&net->rxt_timer.timer)) {
5779 							sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5780 						}
5781 						return (ENOMEM);
5782 					}
5783 					/* update our MTU size */
5784 					/* Do clear IP_DF ? */
5785 					if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5786 						no_fragmentflg = 0;
5787 					}
5788 					mtu -= chk->send_size;
5789 					r_mtu -= chk->send_size;
5790 					data_list[bundle_at++] = chk;
5791 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5792 						mtu = 0;
5793 						break;
5794 					}
5795 					if (mtu <= 0) {
5796 						mtu = 0;
5797 						break;
5798 					}
5799 					if ((r_mtu <= 0) || one_chunk) {
5800 						r_mtu = 0;
5801 						break;
5802 					}
5803 				} else {
5804 					/*
5805 					 * Must be sent in order of the TSN's
5806 					 * (on a network)
5807 					 */
5808 #ifdef SCTP_DEBUG
5809 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5810 						printf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5811 						       chk->send_size, mtu, r_mtu);
5812 					}
5813 #endif
5814 
5815 					break;
5816 				}
5817 			}/* for () */
5818 		} /* if asoc.state OPEN */
5819 		/* Is there something to send for this destination? */
5820 #ifdef SCTP_DEBUG
5821 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5822 			printf("ok now is chain assembled? %p\n",
5823 			       outchain);
5824 		}
5825 #endif
5826 
5827 		if (outchain) {
5828 			/* We may need to start a control timer or two */
5829 			if (asconf) {
5830 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5831 				asconf = 0;
5832 			}
5833 			if (cookie) {
5834 				sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5835 				cookie = 0;
5836 			}
5837 			/* must start a send timer if data is being sent */
5838 			if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5839 				/* no timer running on this destination
5840 				 * restart it.
5841 				 */
5842 #ifdef SCTP_DEBUG
5843 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5844 					printf("ok lets start a send timer .. we will transmit %p\n",
5845 					       outchain);
5846 				}
5847 #endif
5848 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5849 			}
5850 			/* Now send it, if there is anything to send :> */
5851 			if ((outchain->m_flags & M_PKTHDR) == 0) {
5852 				struct mbuf *t;
5853 
5854 				MGETHDR(t, M_DONTWAIT, MT_HEADER);
5855 				if (t == NULL) {
5856 					sctp_m_freem(outchain);
5857 					return (ENOMEM);
5858 				}
5859 				t->m_next = outchain;
5860 				t->m_pkthdr.len = 0;
5861 				m_reset_rcvif(t);
5862 				t->m_len = 0;
5863 
5864 				outchain = t;
5865 				while (t) {
5866 					outchain->m_pkthdr.len += t->m_len;
5867 					t = t->m_next;
5868 				}
5869 			}
5870 			if (outchain->m_len == 0) {
5871 				/* Special case for when you get a 0 len
5872 				 * mbuf at the head due to the lack
5873 				 * of a MHDR at the beginning.
5874 				 */
5875 				m_align(outchain, sizeof(struct sctphdr));
5876 				outchain->m_len = sizeof(struct sctphdr);
5877 			} else {
5878 				M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
5879 				if (outchain == NULL) {
5880 					/* out of mbufs */
5881 					error = ENOBUFS;
5882 					goto errored_send;
5883 				}
5884 			}
5885 			shdr = mtod(outchain, struct sctphdr *);
5886 			shdr->src_port = inp->sctp_lport;
5887 			shdr->dest_port = stcb->rport;
5888 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5889 			shdr->checksum = 0;
5890 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5891 								rtcache_getdst(&net->ro),
5892 								outchain,
5893 								no_fragmentflg, bundle_at, data_list[0], asconf))) {
5894 				/* error, we could not output */
5895 				if (error == ENOBUFS) {
5896 					asoc->ifp_had_enobuf = 1;
5897 				}
5898 				sctp_pegs[SCTP_DATA_OUT_ERR]++;
5899 				if (from_where == 0) {
5900 					sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5901 				}
5902 
5903 			errored_send:
5904 #ifdef SCTP_DEBUG
5905 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5906 					printf("Gak send error %d\n", error);
5907 				}
5908 #endif
5909 				if (hbflag) {
5910 #ifdef SCTP_DEBUG
5911 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5912 						printf("Update HB time anyway\n");
5913 					}
5914 #endif
5915 					if (*now_filled == 0) {
5916 						SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5917 						*now_filled = 1;
5918 						*now = net->last_sent_time;
5919 					} else {
5920 						net->last_sent_time = *now;
5921 					}
5922 					hbflag = 0;
5923 				}
5924 				if (error == EHOSTUNREACH) {
5925 					/*
5926 					 * Destination went unreachable during
5927 					 * this send
5928 					 */
5929 #ifdef SCTP_DEBUG
5930 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5931 						printf("Calling the movement routine\n");
5932 					}
5933 #endif
5934 					sctp_move_to_an_alt(stcb, asoc, net);
5935 				}
5936 				sctp_clean_up_ctl (asoc);
5937 				return (error);
5938 			} else {
5939 				asoc->ifp_had_enobuf = 0;
5940 			}
5941 			if (bundle_at || hbflag) {
5942 				/* For data/asconf and hb set time */
5943 				if (*now_filled == 0) {
5944 					SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5945 					*now_filled = 1;
5946 					*now = net->last_sent_time;
5947 				} else {
5948 					net->last_sent_time = *now;
5949 				}
5950 			}
5951 
5952 			if (!no_out_cnt) {
5953 				*num_out += (ctl_cnt + bundle_at);
5954 			}
5955 			if (bundle_at) {
5956 				if (!net->rto_pending) {
5957 					/* setup for a RTO measurement */
5958 					net->rto_pending = 1;
5959 					data_list[0]->do_rtt = 1;
5960 				} else {
5961 					data_list[0]->do_rtt = 0;
5962 				}
5963 				sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
5964 				sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
5965 			}
5966 			if (one_chunk) {
5967 				break;
5968 			}
5969 		}
5970 	}
5971 	/* At the end there should be no NON timed
5972 	 * chunks hanging on this queue.
5973 	 */
5974 	if ((*num_out == 0) && (*reason_code == 0)) {
5975 		*reason_code = 3;
5976 	}
5977 	sctp_clean_up_ctl (asoc);
5978 	return (0);
5979 }
5980 
5981 void
5982 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
5983 {
5984 	/* Prepend a OPERATIONAL_ERROR chunk header
5985 	 * and put on the end of the control chunk queue.
5986 	 */
5987 	/* Sender had better have gotten a MGETHDR or else
5988 	 * the control chunk will be forever skipped
5989 	 */
5990 	struct sctp_chunkhdr *hdr;
5991 	struct sctp_tmit_chunk *chk;
5992 	struct mbuf *mat;
5993 
5994 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
5995 	if (chk == NULL) {
5996 		/* no memory */
5997 		sctp_m_freem(op_err);
5998 		return;
5999 	}
6000 	sctppcbinfo.ipi_count_chunk++;
6001 	sctppcbinfo.ipi_gencnt_chunk++;
6002 	M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT);
6003 	if (op_err == NULL) {
6004 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6005 		sctppcbinfo.ipi_count_chunk--;
6006 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6007 			panic("Chunk count is negative");
6008 		}
6009 		sctppcbinfo.ipi_gencnt_chunk++;
6010 		return;
6011 	}
6012 	chk->send_size = 0;
6013 	mat = op_err;
6014 	while (mat != NULL) {
6015 		chk->send_size += mat->m_len;
6016 		mat = mat->m_next;
6017 	}
6018 	chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6019 	chk->sent = SCTP_DATAGRAM_UNSENT;
6020 	chk->snd_count = 0;
6021 	chk->flags = 0;
6022 	chk->asoc = &stcb->asoc;
6023 	chk->data = op_err;
6024 	chk->whoTo = chk->asoc->primary_destination;
6025 	chk->whoTo->ref_count++;
6026 	hdr = mtod(op_err, struct sctp_chunkhdr *);
6027 	hdr->chunk_type = SCTP_OPERATION_ERROR;
6028 	hdr->chunk_flags = 0;
6029 	hdr->chunk_length = htons(chk->send_size);
6030 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6031 			  chk,
6032 			  sctp_next);
6033 	chk->asoc->ctrl_queue_cnt++;
6034 }
6035 
6036 int
6037 sctp_send_cookie_echo(struct mbuf *m,
6038 		      int offset,
6039 		      struct sctp_tcb *stcb,
6040 		      struct sctp_nets *net)
6041 {
6042 	/*
6043 	 * pull out the cookie and put it at the front of the control
6044 	 * chunk queue.
6045 	 */
6046 	int at;
6047 	struct mbuf *cookie, *mat;
6048 	struct sctp_paramhdr parm, *phdr;
6049 	struct sctp_chunkhdr *hdr;
6050 	struct sctp_tmit_chunk *chk;
6051 	uint16_t ptype, plen;
6052 	/* First find the cookie in the param area */
6053 	cookie = NULL;
6054 	at = offset + sizeof(struct sctp_init_chunk);
6055 
6056 	do {
6057 		phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6058 		if (phdr == NULL) {
6059 			return (-3);
6060 		}
6061 		ptype = ntohs(phdr->param_type);
6062 		plen = ntohs(phdr->param_length);
6063 		if (ptype == SCTP_STATE_COOKIE) {
6064 			int pad;
6065 			/* found the cookie */
6066 			if ((pad = (plen % 4))) {
6067 				plen += 4 - pad;
6068 			}
6069 			cookie = sctp_m_copym(m, at, plen, M_DONTWAIT);
6070 			if (cookie == NULL) {
6071 				/* No memory */
6072 				return (-2);
6073 			}
6074 			break;
6075 		}
6076 		at += SCTP_SIZE32(plen);
6077 	} while (phdr);
6078 	if (cookie == NULL) {
6079 		/* Did not find the cookie */
6080 		return (-3);
6081 	}
6082 	/* ok, we got the cookie lets change it into a cookie echo chunk */
6083 
6084 	/* first the change from param to cookie */
6085 	hdr = mtod(cookie, struct sctp_chunkhdr *);
6086 	hdr->chunk_type = SCTP_COOKIE_ECHO;
6087 	hdr->chunk_flags = 0;
6088 	/* now we MUST have a PKTHDR on it */
6089 	if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6090 		/* we hope this happens rarely */
6091 		MGETHDR(mat, M_DONTWAIT, MT_HEADER);
6092 		if (mat == NULL) {
6093 			sctp_m_freem(cookie);
6094 			return (-4);
6095 		}
6096 		mat->m_len = 0;
6097 		m_reset_rcvif(mat);
6098 		mat->m_next = cookie;
6099 		cookie = mat;
6100 	}
6101 	cookie->m_pkthdr.len = plen;
6102 	/* get the chunk stuff now and place it in the FRONT of the queue */
6103 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6104 	if (chk == NULL) {
6105 		/* no memory */
6106 		sctp_m_freem(cookie);
6107 		return (-5);
6108 	}
6109 	sctppcbinfo.ipi_count_chunk++;
6110 	sctppcbinfo.ipi_gencnt_chunk++;
6111 	chk->send_size = cookie->m_pkthdr.len;
6112 	chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6113 	chk->sent = SCTP_DATAGRAM_UNSENT;
6114 	chk->snd_count = 0;
6115 	chk->flags = 0;
6116 	chk->asoc = &stcb->asoc;
6117 	chk->data = cookie;
6118 	chk->whoTo = chk->asoc->primary_destination;
6119 	chk->whoTo->ref_count++;
6120 	TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6121 	chk->asoc->ctrl_queue_cnt++;
6122 	return (0);
6123 }
6124 
6125 void
6126 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6127 			struct mbuf *m,
6128 			int offset,
6129 			int chk_length,
6130 			struct sctp_nets *net)
6131 {
6132 	/* take a HB request and make it into a
6133 	 * HB ack and send it.
6134 	 */
6135 	struct mbuf *outchain;
6136 	struct sctp_chunkhdr *chdr;
6137 	struct sctp_tmit_chunk *chk;
6138 
6139 
6140 	if (net == NULL)
6141 		/* must have a net pointer */
6142 		return;
6143 
6144 	outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT);
6145 	if (outchain == NULL) {
6146 		/* gak out of memory */
6147 		return;
6148 	}
6149 	chdr = mtod(outchain, struct sctp_chunkhdr *);
6150 	chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6151 	chdr->chunk_flags = 0;
6152 	if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6153 		/* should not happen but we are cautious. */
6154 		struct mbuf *tmp;
6155 		MGETHDR(tmp, M_DONTWAIT, MT_HEADER);
6156 		if (tmp == NULL) {
6157 			return;
6158 		}
6159 		tmp->m_len = 0;
6160 		m_reset_rcvif(tmp);
6161 		tmp->m_next = outchain;
6162 		outchain = tmp;
6163 	}
6164 	outchain->m_pkthdr.len = chk_length;
6165 	if (chk_length % 4) {
6166 		/* need pad */
6167 		u_int32_t cpthis=0;
6168 		int padlen;
6169 		padlen = 4 - (outchain->m_pkthdr.len % 4);
6170 		m_copyback(outchain, outchain->m_pkthdr.len, padlen, (void *)&cpthis);
6171 	}
6172 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6173 	if (chk == NULL) {
6174 		/* no memory */
6175 		sctp_m_freem(outchain);
6176 		return ;
6177 	}
6178 	sctppcbinfo.ipi_count_chunk++;
6179 	sctppcbinfo.ipi_gencnt_chunk++;
6180 
6181 	chk->send_size = chk_length;
6182 	chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6183 	chk->sent = SCTP_DATAGRAM_UNSENT;
6184 	chk->snd_count = 0;
6185 	chk->flags = 0;
6186 	chk->asoc = &stcb->asoc;
6187 	chk->data = outchain;
6188 	chk->whoTo = net;
6189 	chk->whoTo->ref_count++;
6190 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6191 	chk->asoc->ctrl_queue_cnt++;
6192 }
6193 
6194 int
6195 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6196 	/* formulate and queue a cookie-ack back to sender */
6197 	struct mbuf *cookie_ack;
6198 	struct sctp_chunkhdr *hdr;
6199 	struct sctp_tmit_chunk *chk;
6200 
6201 	cookie_ack = NULL;
6202 	MGETHDR(cookie_ack, M_DONTWAIT, MT_HEADER);
6203 	if (cookie_ack == NULL) {
6204 		/* no mbuf's */
6205 		return (-1);
6206 	}
6207  	cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6208 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6209 	if (chk == NULL) {
6210 		/* no memory */
6211 		sctp_m_freem(cookie_ack);
6212 		return (-1);
6213 	}
6214 	sctppcbinfo.ipi_count_chunk++;
6215 	sctppcbinfo.ipi_gencnt_chunk++;
6216 
6217 	chk->send_size = sizeof(struct sctp_chunkhdr);
6218 	chk->rec.chunk_id = SCTP_COOKIE_ACK;
6219 	chk->sent = SCTP_DATAGRAM_UNSENT;
6220 	chk->snd_count = 0;
6221 	chk->flags = 0;
6222 	chk->asoc = &stcb->asoc;
6223 	chk->data = cookie_ack;
6224 	if (chk->asoc->last_control_chunk_from != NULL) {
6225 		chk->whoTo = chk->asoc->last_control_chunk_from;
6226 	} else {
6227 		chk->whoTo = chk->asoc->primary_destination;
6228 	}
6229 	chk->whoTo->ref_count++;
6230 	hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6231 	hdr->chunk_type = SCTP_COOKIE_ACK;
6232 	hdr->chunk_flags = 0;
6233 	hdr->chunk_length = htons(chk->send_size);
6234 	cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6235 	m_reset_rcvif(cookie_ack);
6236 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6237 	chk->asoc->ctrl_queue_cnt++;
6238 	return (0);
6239 }
6240 
6241 
6242 int
6243 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6244 {
6245 	/* formulate and queue a SHUTDOWN-ACK back to the sender */
6246 	struct mbuf *m_shutdown_ack;
6247 	struct sctp_shutdown_ack_chunk *ack_cp;
6248 	struct sctp_tmit_chunk *chk;
6249 
6250 	m_shutdown_ack = NULL;
6251 	MGETHDR(m_shutdown_ack, M_DONTWAIT, MT_HEADER);
6252 	if (m_shutdown_ack == NULL) {
6253 		/* no mbuf's */
6254 		return (-1);
6255 	}
6256 	m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6257 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6258 	if (chk == NULL) {
6259 		/* no memory */
6260 		sctp_m_freem(m_shutdown_ack);
6261 		return (-1);
6262 	}
6263 	sctppcbinfo.ipi_count_chunk++;
6264 	sctppcbinfo.ipi_gencnt_chunk++;
6265 
6266 	chk->send_size = sizeof(struct sctp_chunkhdr);
6267 	chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6268 	chk->sent = SCTP_DATAGRAM_UNSENT;
6269 	chk->snd_count = 0;
6270 	chk->flags = 0;
6271 	chk->asoc = &stcb->asoc;
6272 	chk->data = m_shutdown_ack;
6273 	chk->whoTo = net;
6274 	net->ref_count++;
6275 
6276 	ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6277 	ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6278 	ack_cp->ch.chunk_flags = 0;
6279 	ack_cp->ch.chunk_length = htons(chk->send_size);
6280 	m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6281 	m_reset_rcvif(m_shutdown_ack);
6282 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6283 	chk->asoc->ctrl_queue_cnt++;
6284 	return (0);
6285 }
6286 
6287 int
6288 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6289 {
6290 	/* formulate and queue a SHUTDOWN to the sender */
6291 	struct mbuf *m_shutdown;
6292 	struct sctp_shutdown_chunk *shutdown_cp;
6293 	struct sctp_tmit_chunk *chk;
6294 
6295 	m_shutdown = NULL;
6296 	MGETHDR(m_shutdown, M_DONTWAIT, MT_HEADER);
6297 	if (m_shutdown == NULL) {
6298 		/* no mbuf's */
6299 		return (-1);
6300 	}
6301 	m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6302 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6303 	if (chk == NULL) {
6304 		/* no memory */
6305 		sctp_m_freem(m_shutdown);
6306 		return (-1);
6307 	}
6308 	sctppcbinfo.ipi_count_chunk++;
6309 	sctppcbinfo.ipi_gencnt_chunk++;
6310 
6311 	chk->send_size = sizeof(struct sctp_shutdown_chunk);
6312 	chk->rec.chunk_id = SCTP_SHUTDOWN;
6313 	chk->sent = SCTP_DATAGRAM_UNSENT;
6314 	chk->snd_count = 0;
6315 	chk->flags = 0;
6316 	chk->asoc = &stcb->asoc;
6317 	chk->data = m_shutdown;
6318 	chk->whoTo = net;
6319 	net->ref_count++;
6320 
6321 	shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6322 	shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6323 	shutdown_cp->ch.chunk_flags = 0;
6324 	shutdown_cp->ch.chunk_length = htons(chk->send_size);
6325 	shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6326 	m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6327 	m_reset_rcvif(m_shutdown);
6328 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6329 	chk->asoc->ctrl_queue_cnt++;
6330 
6331 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6332 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6333 		stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
6334 		soisdisconnecting(stcb->sctp_ep->sctp_socket);
6335 	}
6336 	return (0);
6337 }
6338 
6339 int
6340 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6341 {
6342 	/*
6343 	 * formulate and queue an ASCONF to the peer
6344 	 * ASCONF parameters should be queued on the assoc queue
6345 	 */
6346 	struct sctp_tmit_chunk *chk;
6347 	struct mbuf *m_asconf;
6348 
6349 	/* compose an ASCONF chunk, maximum length is PMTU */
6350 	m_asconf = sctp_compose_asconf(stcb);
6351 	if (m_asconf == NULL) {
6352 		return (-1);
6353 	}
6354 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6355 	if (chk == NULL) {
6356 		/* no memory */
6357 		sctp_m_freem(m_asconf);
6358 		return (-1);
6359 	}
6360 	sctppcbinfo.ipi_count_chunk++;
6361 	sctppcbinfo.ipi_gencnt_chunk++;
6362 
6363 	chk->data = m_asconf;
6364 	chk->send_size = m_asconf->m_pkthdr.len;
6365 	chk->rec.chunk_id = SCTP_ASCONF;
6366 	chk->sent = SCTP_DATAGRAM_UNSENT;
6367 	chk->snd_count = 0;
6368 	chk->flags = 0;
6369 	chk->asoc = &stcb->asoc;
6370 	chk->whoTo = chk->asoc->primary_destination;
6371 	chk->whoTo->ref_count++;
6372 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6373 	chk->asoc->ctrl_queue_cnt++;
6374 	return (0);
6375 }
6376 
6377 int
6378 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6379 {
6380 	/*
6381 	 * formulate and queue a asconf-ack back to sender
6382 	 * the asconf-ack must be stored in the tcb
6383 	 */
6384 	struct sctp_tmit_chunk *chk;
6385 	struct mbuf *m_ack;
6386 
6387 	/* is there a asconf-ack mbuf chain to send? */
6388 	if (stcb->asoc.last_asconf_ack_sent == NULL) {
6389 		return (-1);
6390 	}
6391 
6392 	/* copy the asconf_ack */
6393 #if defined(__FreeBSD__) || defined(__NetBSD__)
6394 	/* Supposedly the m_copypacket is a optimzation,
6395 	 * use it if we can.
6396 	 */
6397 	if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6398 		m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, M_DONTWAIT);
6399 		sctp_pegs[SCTP_CACHED_SRC]++;
6400 	} else
6401 		m_ack = m_copym(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL, M_DONTWAIT);
6402 #else
6403 		m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6404 #endif
6405 	if (m_ack == NULL) {
6406 		/* couldn't copy it */
6407 
6408 		return (-1);
6409 	}
6410 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6411 	if (chk == NULL) {
6412 		/* no memory */
6413 		if (m_ack)
6414 			sctp_m_freem(m_ack);
6415 		return (-1);
6416 	}
6417 	sctppcbinfo.ipi_count_chunk++;
6418 	sctppcbinfo.ipi_gencnt_chunk++;
6419 
6420 	/* figure out where it goes to */
6421 	if (retrans) {
6422 		/* we're doing a retransmission */
6423 		if (stcb->asoc.used_alt_asconfack > 2) {
6424 			/* tried alternate nets already, go back */
6425 			chk->whoTo = NULL;
6426 		} else {
6427 			/* need to try and alternate net */
6428 			chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6429 			stcb->asoc.used_alt_asconfack++;
6430 		}
6431 		if (chk->whoTo == NULL) {
6432 			/* no alternate */
6433 			if (stcb->asoc.last_control_chunk_from == NULL)
6434 				chk->whoTo = stcb->asoc.primary_destination;
6435 			else
6436 				chk->whoTo = stcb->asoc.last_control_chunk_from;
6437 			stcb->asoc.used_alt_asconfack = 0;
6438 		}
6439 	} else {
6440 		/* normal case */
6441 		if (stcb->asoc.last_control_chunk_from == NULL)
6442 			chk->whoTo = stcb->asoc.primary_destination;
6443 		else
6444 			chk->whoTo = stcb->asoc.last_control_chunk_from;
6445 		stcb->asoc.used_alt_asconfack = 0;
6446 	}
6447 	chk->data = m_ack;
6448 	chk->send_size = m_ack->m_pkthdr.len;
6449 	chk->rec.chunk_id = SCTP_ASCONF_ACK;
6450 	chk->sent = SCTP_DATAGRAM_UNSENT;
6451 	chk->snd_count = 0;
6452 	chk->flags = 0;
6453 	chk->asoc = &stcb->asoc;
6454 	chk->whoTo->ref_count++;
6455 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6456 	chk->asoc->ctrl_queue_cnt++;
6457 	return (0);
6458 }
6459 
6460 
6461 static int
6462 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6463 			  struct sctp_tcb *stcb,
6464 			  struct sctp_association *asoc,
6465 			  int *cnt_out, struct timeval *now, int *now_filled)
6466 {
6467 	/*
6468 	 * send out one MTU of retransmission.
6469 	 * If fast_retransmit is happening we ignore the cwnd.
6470 	 * Otherwise we obey the cwnd and rwnd.
6471 	 * For a Cookie or Asconf in the control chunk queue we retransmit
6472 	 * them by themselves.
6473 	 *
6474 	 * For data chunks we will pick out the lowest TSN's in the
6475 	 * sent_queue marked for resend and bundle them all together
6476 	 * (up to a MTU of destination). The address to send to should
6477 	 * have been selected/changed where the retransmission was
6478 	 * marked (i.e. in FR or t3-timeout routines).
6479 	 */
6480 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6481 	struct sctp_tmit_chunk *chk, *fwd;
6482 	struct mbuf *m;
6483 	struct sctphdr *shdr;
6484 	int asconf;
6485 	struct sctp_nets *net;
6486 	int no_fragmentflg, bundle_at, cnt_thru;
6487 	unsigned int mtu;
6488 	int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6489 
6490 	tmr_started = ctl_cnt = bundle_at =  error = 0;
6491 	no_fragmentflg = 1;
6492 	asconf = 0;
6493 	fwd_tsn = 0;
6494 	*cnt_out = 0;
6495 	fwd = NULL;
6496 	m = NULL;
6497 #ifdef SCTP_AUDITING_ENABLED
6498 	sctp_audit_log(0xC3, 1);
6499 #endif
6500 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
6501 #ifdef SCTP_DEBUG
6502 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6503 			printf("SCTP hits empty queue with cnt set to %d?\n",
6504 			       asoc->sent_queue_retran_cnt);
6505 		}
6506 #endif
6507 		asoc->sent_queue_cnt = 0;
6508 		asoc->sent_queue_cnt_removeable = 0;
6509 	}
6510 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6511 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
6512 			/* we only worry about things marked for resend */
6513 			continue;
6514 		}
6515 		if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6516 		    (chk->rec.chunk_id == SCTP_ASCONF) ||
6517 		    (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6518 		    (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6519 			if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6520 				/* For stream reset we only retran the request
6521 				 * not the response.
6522 				 */
6523 				struct sctp_stream_reset_req *strreq;
6524 				strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6525 				if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6526 					continue;
6527 				}
6528 			}
6529 			ctl_cnt++;
6530 			if (chk->rec.chunk_id == SCTP_ASCONF) {
6531 				no_fragmentflg = 1;
6532 				asconf = 1;
6533 			}
6534 			if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6535 				fwd_tsn = 1;
6536 				fwd = chk;
6537 			}
6538 			m = sctp_copy_mbufchain(chk->data, m);
6539 			break;
6540 		}
6541 	}
6542 	one_chunk = 0;
6543 	cnt_thru = 0;
6544 	/* do we have control chunks to retransmit? */
6545 	if (m != NULL) {
6546 		/* Start a timer no matter if we suceed or fail */
6547 		if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6548 			sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6549 		} else if (chk->rec.chunk_id == SCTP_ASCONF)
6550 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6551 
6552 		if (m->m_len == 0) {
6553 			/* Special case for when you get a 0 len
6554 			 * mbuf at the head due to the lack
6555 			 * of a MHDR at the beginning.
6556 			 */
6557 			m->m_len = sizeof(struct sctphdr);
6558 		} else {
6559 			M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
6560 			if (m == NULL) {
6561 				return (ENOBUFS);
6562 			}
6563 		}
6564 		shdr = mtod(m, struct sctphdr *);
6565 		shdr->src_port = inp->sctp_lport;
6566 		shdr->dest_port = stcb->rport;
6567 		shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6568 		shdr->checksum = 0;
6569 		chk->snd_count++;		/* update our count */
6570 
6571 		if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6572 		    rtcache_getdst(&chk->whoTo->ro), m,
6573 		    no_fragmentflg, 0, NULL, asconf))) {
6574 			sctp_pegs[SCTP_DATA_OUT_ERR]++;
6575 			return (error);
6576 		}
6577 		/*
6578 		 *We don't want to mark the net->sent time here since this
6579 		 * we use this for HB and retrans cannot measure RTT
6580 		 */
6581 		/*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6582 		*cnt_out += 1;
6583 		chk->sent = SCTP_DATAGRAM_SENT;
6584 		sctp_ucount_decr(asoc->sent_queue_retran_cnt);
6585 		if (fwd_tsn == 0) {
6586 			return (0);
6587 		} else {
6588 			/* Clean up the fwd-tsn list */
6589 			sctp_clean_up_ctl (asoc);
6590 			return (0);
6591 		}
6592 	}
6593 	/* Ok, it is just data retransmission we need to do or
6594 	 * that and a fwd-tsn with it all.
6595 	 */
6596 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
6597 		return (-1);
6598 	}
6599 #ifdef SCTP_DEBUG
6600 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6601 		printf("Normal chunk retransmission cnt:%d\n",
6602 		       asoc->sent_queue_retran_cnt);
6603 	}
6604 #endif
6605 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6606 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6607 		/* not yet open, resend the cookie and that is it */
6608 		return (1);
6609 	}
6610 
6611 
6612 #ifdef SCTP_AUDITING_ENABLED
6613 	sctp_auditing(20, inp, stcb, NULL);
6614 #endif
6615 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6616 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
6617 			/* No, not sent to this net or not ready for rtx */
6618 			continue;
6619 
6620 		}
6621 		/* pick up the net */
6622 		net = chk->whoTo;
6623 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6624 			mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6625 		} else {
6626 			mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6627 		}
6628 
6629 		if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6630 			/* No room in peers rwnd */
6631 			uint32_t tsn;
6632 			tsn = asoc->last_acked_seq + 1;
6633 			if (tsn == chk->rec.data.TSN_seq) {
6634 				/* we make a special exception for this case.
6635 				 * The peer has no rwnd but is missing the
6636 				 * lowest chunk.. which is probably what is
6637 				 * holding up the rwnd.
6638 				 */
6639 				goto one_chunk_around;
6640 			}
6641 #ifdef SCTP_DEBUG
6642 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6643 				printf("blocked-peers_rwnd:%d tf:%d\n",
6644 				       (int)asoc->peers_rwnd,
6645 				       (int)asoc->total_flight);
6646 			}
6647 #endif
6648 			sctp_pegs[SCTP_RWND_BLOCKED]++;
6649 			return (1);
6650 		}
6651 	one_chunk_around:
6652 		if (asoc->peers_rwnd < mtu) {
6653 			one_chunk = 1;
6654 		}
6655 #ifdef SCTP_AUDITING_ENABLED
6656 		sctp_audit_log(0xC3, 2);
6657 #endif
6658 		bundle_at = 0;
6659 		m = NULL;
6660 		net->fast_retran_ip = 0;
6661 		if (chk->rec.data.doing_fast_retransmit == 0) {
6662 			/* if no FR in progress skip destination that
6663 			 * have flight_size > cwnd.
6664 			 */
6665 			if (net->flight_size >= net->cwnd) {
6666 				sctp_pegs[SCTP_CWND_BLOCKED]++;
6667 				continue;
6668 			}
6669 		} else {
6670 			/* Mark the destination net to have FR recovery
6671 			 * limits put on it.
6672 			 */
6673 			net->fast_retran_ip = 1;
6674 		}
6675 
6676 		if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6677 			/* ok we will add this one */
6678 			m = sctp_copy_mbufchain(chk->data, m);
6679 			if (m == NULL) {
6680 				return (ENOMEM);
6681 			}
6682 			/* update our MTU size */
6683 			/* Do clear IP_DF ? */
6684 			if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6685 				no_fragmentflg = 0;
6686 			}
6687 			mtu -= chk->send_size;
6688 			data_list[bundle_at++] = chk;
6689 			if (one_chunk && (asoc->total_flight <= 0)) {
6690 				sctp_pegs[SCTP_WINDOW_PROBES]++;
6691 				chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6692 			}
6693 		}
6694 		if (one_chunk == 0) {
6695 			/* now are there anymore forward from chk to pick up?*/
6696 			fwd = TAILQ_NEXT(chk, sctp_next);
6697 			while (fwd) {
6698 				if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6699 					/* Nope, not for retran */
6700 					fwd = TAILQ_NEXT(fwd, sctp_next);
6701 					continue;
6702 				}
6703 				if (fwd->whoTo != net) {
6704 					/* Nope, not the net in question */
6705 					fwd = TAILQ_NEXT(fwd, sctp_next);
6706 					continue;
6707 				}
6708 				if (fwd->send_size <= mtu) {
6709 					m = sctp_copy_mbufchain(fwd->data, m);
6710 					if (m == NULL) {
6711 						return (ENOMEM);
6712 					}
6713 					/* update our MTU size */
6714 					/* Do clear IP_DF ? */
6715 					if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6716 						no_fragmentflg = 0;
6717 					}
6718 					mtu -= fwd->send_size;
6719 					data_list[bundle_at++] = fwd;
6720 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6721 						break;
6722 					}
6723 					fwd = TAILQ_NEXT(fwd, sctp_next);
6724 				} else {
6725 					/* can't fit so we are done */
6726 					break;
6727 				}
6728 			}
6729 		}
6730 		/* Is there something to send for this destination? */
6731 		if (m) {
6732 			/* No matter if we fail/or suceed we should
6733 			 * start a timer. A failure is like a lost
6734 			 * IP packet :-)
6735 			 */
6736 			if (!callout_pending(&net->rxt_timer.timer)) {
6737 				/* no timer running on this destination
6738 				 * restart it.
6739 				 */
6740 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6741 				tmr_started = 1;
6742 			}
6743 			if (m->m_len == 0) {
6744 				/* Special case for when you get a 0 len
6745 				 * mbuf at the head due to the lack
6746 				 * of a MHDR at the beginning.
6747 				 */
6748 				m->m_len = sizeof(struct sctphdr);
6749 			} else {
6750 				M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
6751 				if (m == NULL) {
6752 					return (ENOBUFS);
6753 				}
6754 			}
6755 			shdr = mtod(m, struct sctphdr *);
6756 			shdr->src_port = inp->sctp_lport;
6757 			shdr->dest_port = stcb->rport;
6758 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6759 			shdr->checksum = 0;
6760 
6761 			/* Now lets send it, if there is anything to send :> */
6762 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6763 							       rtcache_getdst(&net->ro),
6764 							       m,
6765 							       no_fragmentflg, 0, NULL, asconf))) {
6766 				/* error, we could not output */
6767 				sctp_pegs[SCTP_DATA_OUT_ERR]++;
6768 				return (error);
6769 			}
6770 			/* For HB's */
6771 			/*
6772 			 * We don't want to mark the net->sent time here since
6773 			 * this we use this for HB and retrans cannot measure
6774 			 * RTT
6775 			 */
6776 			/*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6777 
6778 			/* For auto-close */
6779 			cnt_thru++;
6780 			if (*now_filled == 0) {
6781 				SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6782 				*now = asoc->time_last_sent;
6783 				*now_filled = 1;
6784 			} else {
6785 				asoc->time_last_sent = *now;
6786 			}
6787 			*cnt_out += bundle_at;
6788 #ifdef SCTP_AUDITING_ENABLED
6789 			sctp_audit_log(0xC4, bundle_at);
6790 #endif
6791 			for (i = 0; i < bundle_at; i++) {
6792 				sctp_pegs[SCTP_RETRANTSN_SENT]++;
6793 				data_list[i]->sent = SCTP_DATAGRAM_SENT;
6794 				data_list[i]->snd_count++;
6795 				sctp_ucount_decr(asoc->sent_queue_retran_cnt);
6796 				/* record the time */
6797 				data_list[i]->sent_rcv_time = asoc->time_last_sent;
6798 				net->flight_size += data_list[i]->book_size;
6799 				asoc->total_flight += data_list[i]->book_size;
6800 				asoc->total_flight_count++;
6801 
6802 #ifdef SCTP_LOG_RWND
6803 				sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6804 					      asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6805 #endif
6806 				asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6807 								    (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6808 				if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6809 					/* SWS sender side engages */
6810 					asoc->peers_rwnd = 0;
6811 				}
6812 
6813 				if ((i == 0) &&
6814 				    (data_list[i]->rec.data.doing_fast_retransmit)) {
6815 					sctp_pegs[SCTP_FAST_RETRAN]++;
6816 					if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6817 					    (tmr_started == 0)) {
6818 						/*
6819 						 * ok we just fast-retrans'd
6820 						 * the lowest TSN, i.e the
6821 						 * first on the list. In this
6822 						 * case we want to give some
6823 						 * more time to get a SACK
6824 						 * back without a t3-expiring.
6825 						 */
6826 						sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6827 						sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6828 					}
6829 				}
6830 			}
6831 #ifdef SCTP_AUDITING_ENABLED
6832 			sctp_auditing(21, inp, stcb, NULL);
6833 #endif
6834 		} else {
6835 			/* None will fit */
6836 			return (1);
6837 		}
6838 		if (asoc->sent_queue_retran_cnt <= 0) {
6839 			/* all done we have no more to retran */
6840 			asoc->sent_queue_retran_cnt = 0;
6841 			break;
6842 		}
6843 		if (one_chunk) {
6844 			/* No more room in rwnd */
6845 			return (1);
6846 		}
6847 		/* stop the for loop here. we sent out a packet */
6848 		break;
6849 	}
6850 	return (0);
6851 }
6852 
6853 
6854 static int
6855 sctp_timer_validation(struct sctp_inpcb *inp,
6856 		      struct sctp_tcb *stcb,
6857 		      struct sctp_association *asoc,
6858 		      int ret)
6859 {
6860 	struct sctp_nets *net;
6861 	/* Validate that a timer is running somewhere */
6862 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6863 		if (callout_pending(&net->rxt_timer.timer)) {
6864 			/* Here is a timer */
6865 			return (ret);
6866 		}
6867 	}
6868 	/* Gak, we did not have a timer somewhere */
6869 #ifdef SCTP_DEBUG
6870 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6871 		printf("Deadlock avoided starting timer on a dest at retran\n");
6872 	}
6873 #endif
6874 	sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
6875 	return (ret);
6876 }
6877 
6878 int
6879 sctp_chunk_output(struct sctp_inpcb *inp,
6880 		  struct sctp_tcb *stcb,
6881 		  int from_where)
6882 {
6883 	/* Ok this is the generic chunk service queue.
6884 	 * we must do the following:
6885 	 *  - See if there are retransmits pending, if so we
6886 	 *   	must do these first and return.
6887 	 *  - Service the stream queue that is next,
6888 	 *    moving any message (note I must get a complete
6889 	 *    message i.e. FIRST/MIDDLE and LAST to the out
6890 	 *    queue in one pass) and assigning TSN's
6891 	 *  - Check to see if the cwnd/rwnd allows any output, if
6892 	 *	so we go ahead and fomulate and send the low level
6893 	 *    chunks. Making sure to combine any control in the
6894 	 *    control chunk queue also.
6895 	 */
6896 	struct sctp_association *asoc;
6897 	struct sctp_nets *net;
6898 	int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
6899 	struct timeval now;
6900 	int now_filled=0;
6901 	int cwnd_full=0;
6902 	asoc = &stcb->asoc;
6903 	tot_out = 0;
6904 	num_out = 0;
6905 	reason_code = 0;
6906 	sctp_pegs[SCTP_CALLS_TO_CO]++;
6907 #ifdef SCTP_DEBUG
6908 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6909 		printf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
6910 	}
6911 #endif
6912 	while (asoc->sent_queue_retran_cnt) {
6913 		/* Ok, it is retransmission time only, we send out only ONE
6914 		 * packet with a single call off to the retran code.
6915 		 */
6916 		ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
6917 		if (ret > 0) {
6918 			/* Can't send anymore */
6919 #ifdef SCTP_DEBUG
6920 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6921 				printf("retransmission ret:%d -- full\n", ret);
6922 			}
6923 #endif
6924 			/*
6925 			 * now lets push out control by calling med-level
6926 			 * output once. this assures that we WILL send HB's
6927 			 * if queued too.
6928 			 */
6929 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
6930 						    &cwnd_full, from_where,
6931 						    &now, &now_filled);
6932 #ifdef SCTP_DEBUG
6933 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6934 				printf("Control send outputs:%d@full\n", num_out);
6935 			}
6936 #endif
6937 #ifdef SCTP_AUDITING_ENABLED
6938 			sctp_auditing(8, inp, stcb, NULL);
6939 #endif
6940 			return (sctp_timer_validation(inp, stcb, asoc, ret));
6941 		}
6942 		if (ret < 0) {
6943 			/*
6944 			 * The count was off.. retran is not happening so do
6945 			 * the normal retransmission.
6946 			 */
6947 #ifdef SCTP_DEBUG
6948 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6949 				printf("Done with retrans, none left fill up window\n");
6950 			}
6951 #endif
6952 #ifdef SCTP_AUDITING_ENABLED
6953 			sctp_auditing(9, inp, stcb, NULL);
6954 #endif
6955 			break;
6956 		}
6957 		if (from_where == 1) {
6958 			/* Only one transmission allowed out of a timeout */
6959 #ifdef SCTP_DEBUG
6960 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6961 				printf("Only one packet allowed out\n");
6962 			}
6963 #endif
6964 #ifdef SCTP_AUDITING_ENABLED
6965 			sctp_auditing(10, inp, stcb, NULL);
6966 #endif
6967 			/* Push out any control */
6968 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
6969 						    &now, &now_filled);
6970 			return (ret);
6971 		}
6972 		if ((num_out == 0) && (ret == 0)) {
6973 			/* No more retrans to send */
6974 			break;
6975 		}
6976 	}
6977 #ifdef SCTP_AUDITING_ENABLED
6978 	sctp_auditing(12, inp, stcb, NULL);
6979 #endif
6980 	/* Check for bad destinations, if they exist move chunks around. */
6981 	burst_limit = asoc->max_burst;
6982 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6983 		if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
6984 		    SCTP_ADDR_NOT_REACHABLE) {
6985 			/*
6986 			 * if possible move things off of this address
6987 			 * we still may send below due to the dormant state
6988 			 * but we try to find an alternate address to send
6989 			 * to and if we have one we move all queued data on
6990 			 * the out wheel to this alternate address.
6991 			 */
6992 			sctp_move_to_an_alt(stcb, asoc, net);
6993 		} else {
6994 			/*
6995 			if ((asoc->sat_network) || (net->addr_is_local)) {
6996 				burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
6997 			}
6998 			*/
6999 #ifdef SCTP_DEBUG
7000 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7001 				printf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7002 			}
7003 #endif
7004 
7005 #ifdef SCTP_USE_ALLMAN_BURST
7006 			if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7007 				if (net->ssthresh < net->cwnd)
7008 					net->ssthresh = net->cwnd;
7009 				net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7010 #ifdef SCTP_LOG_MAXBURST
7011 				sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7012 #endif
7013 				sctp_pegs[SCTP_MAX_BURST_APL]++;
7014 			}
7015 			net->fast_retran_ip = 0;
7016 #endif
7017 		}
7018 
7019 	}
7020 	/* Fill up what we can to the destination */
7021 	burst_cnt = 0;
7022 	cwnd_full = 0;
7023 	do {
7024 #ifdef SCTP_DEBUG
7025 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7026 			printf("Burst count:%d - call m-c-o\n", burst_cnt);
7027 		}
7028 #endif
7029 		error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7030 					      &reason_code, 0,  &cwnd_full, from_where,
7031 					      &now, &now_filled);
7032 		if (error) {
7033 #ifdef SCTP_DEBUG
7034 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7035 				printf("Error %d was returned from med-c-op\n", error);
7036 			}
7037 #endif
7038 #ifdef SCTP_LOG_MAXBURST
7039 			sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7040 #endif
7041 			break;
7042 		}
7043 #ifdef SCTP_DEBUG
7044 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7045 			printf("m-c-o put out %d\n", num_out);
7046 		}
7047 #endif
7048 		tot_out += num_out;
7049 		burst_cnt++;
7050 	} while (num_out
7051 #ifndef SCTP_USE_ALLMAN_BURST
7052 		 &&  (burst_cnt < burst_limit)
7053 #endif
7054 		);
7055 #ifndef SCTP_USE_ALLMAN_BURST
7056 	if (burst_cnt >= burst_limit) {
7057 		sctp_pegs[SCTP_MAX_BURST_APL]++;
7058  		asoc->burst_limit_applied = 1;
7059 #ifdef SCTP_LOG_MAXBURST
7060 		sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7061 #endif
7062  	} else {
7063 		asoc->burst_limit_applied = 0;
7064  	}
7065 #endif
7066 
7067 #ifdef SCTP_DEBUG
7068 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7069 		printf("Ok, we have put out %d chunks\n", tot_out);
7070 	}
7071 #endif
7072 	if (tot_out == 0) {
7073 		sctp_pegs[SCTP_CO_NODATASNT]++;
7074 		if (asoc->stream_queue_cnt > 0) {
7075 			sctp_pegs[SCTP_SOS_NOSNT]++;
7076 		} else {
7077 			sctp_pegs[SCTP_NOS_NOSNT]++;
7078 		}
7079 		if (asoc->send_queue_cnt > 0) {
7080 			sctp_pegs[SCTP_SOSE_NOSNT]++;
7081 		} else {
7082 			sctp_pegs[SCTP_NOSE_NOSNT]++;
7083 		}
7084 	}
7085 	/* Now we need to clean up the control chunk chain if
7086 	 * a ECNE is on it. It must be marked as UNSENT again
7087 	 * so next call will continue to send it until
7088 	 * such time that we get a CWR, to remove it.
7089 	 */
7090 	sctp_fix_ecn_echo(asoc);
7091 	return (error);
7092 }
7093 
7094 
7095 int
7096 sctp_output(struct sctp_inpcb *inp, struct mbuf *m,
7097      struct sockaddr *addr, struct mbuf *control, struct lwp *l, int flags)
7098 {
7099 	struct sctp_inpcb *t_inp;
7100  	struct sctp_tcb *stcb;
7101 	struct sctp_nets *net;
7102 	struct sctp_association *asoc;
7103 	int create_lock_applied = 0;
7104 	int queue_only, error = 0;
7105 	struct sctp_sndrcvinfo srcv;
7106 	int un_sent = 0;
7107 	int use_rcvinfo = 0;
7108 	t_inp = inp;
7109 	/*  struct route ro;*/
7110 
7111 	queue_only = 0;
7112 	stcb = NULL;
7113 	asoc = NULL;
7114 	net = NULL;
7115 
7116 #ifdef SCTP_DEBUG
7117 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7118 		printf("USR Send BEGINS\n");
7119 	}
7120 #endif
7121 
7122 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7123 	    (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7124 		/* The listner can NOT send */
7125 		if (control) {
7126 			sctppcbinfo.mbuf_track--;
7127 			sctp_m_freem(control);
7128 			control = NULL;
7129 		}
7130 		sctp_m_freem(m);
7131 		return (EFAULT);
7132 	}
7133 	/* Can't allow a V6 address on a non-v6 socket */
7134 	if (addr) {
7135 		SCTP_ASOC_CREATE_LOCK(inp);
7136 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7137 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7138 			/* Should I really unlock ? */
7139 			SCTP_ASOC_CREATE_UNLOCK(inp);
7140 			if (control) {
7141 				sctppcbinfo.mbuf_track--;
7142 				sctp_m_freem(control);
7143 				control = NULL;
7144 			}
7145 			sctp_m_freem(m);
7146 			return (EFAULT);
7147 		}
7148 		create_lock_applied = 1;
7149 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7150 		    (addr->sa_family == AF_INET6)) {
7151 			SCTP_ASOC_CREATE_UNLOCK(inp);
7152 			if (control) {
7153 				sctppcbinfo.mbuf_track--;
7154 				sctp_m_freem(control);
7155 				control = NULL;
7156 			}
7157 			sctp_m_freem(m);
7158 			return (EINVAL);
7159 		}
7160 	}
7161 	if (control) {
7162 		sctppcbinfo.mbuf_track++;
7163 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
7164 				   sizeof(srcv))) {
7165 			if (srcv.sinfo_flags & SCTP_SENDALL) {
7166 				/* its a sendall */
7167 				sctppcbinfo.mbuf_track--;
7168 				sctp_m_freem(control);
7169 				if (create_lock_applied) {
7170 					SCTP_ASOC_CREATE_UNLOCK(inp);
7171 					create_lock_applied = 0;
7172 				}
7173 				return (sctp_sendall(inp, NULL, m, &srcv));
7174 			}
7175 			if (srcv.sinfo_assoc_id) {
7176 				if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7177 					SCTP_INP_RLOCK(inp);
7178 					stcb = LIST_FIRST(&inp->sctp_asoc_list);
7179 					if (stcb) {
7180 						SCTP_TCB_LOCK(stcb);
7181 					}
7182 					SCTP_INP_RUNLOCK(inp);
7183 
7184 					if (stcb == NULL) {
7185 						if (create_lock_applied) {
7186 							SCTP_ASOC_CREATE_UNLOCK(inp);
7187 							create_lock_applied = 0;
7188 						}
7189 						sctppcbinfo.mbuf_track--;
7190 						sctp_m_freem(control);
7191 						sctp_m_freem(m);
7192 						return (ENOTCONN);
7193 					}
7194 					net = stcb->asoc.primary_destination;
7195 				} else {
7196 					stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7197 				}
7198 				/*
7199 				 * Question: Should I error here if the
7200 
7201 				 * assoc_id is no longer valid?
7202 				 * i.e. I can't find it?
7203 				 */
7204 				if ((stcb) &&
7205 				    (addr != NULL)) {
7206 					/* Must locate the net structure */
7207 					if (addr)
7208 						net = sctp_findnet(stcb, addr);
7209 				}
7210 				if (net == NULL)
7211 					net = stcb->asoc.primary_destination;
7212 			}
7213 			use_rcvinfo = 1;
7214 		}
7215 	}
7216 	if (stcb == NULL) {
7217 		if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7218 			SCTP_INP_RLOCK(inp);
7219 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
7220 			if (stcb) {
7221 				SCTP_TCB_LOCK(stcb);
7222 			}
7223 			SCTP_INP_RUNLOCK(inp);
7224 			if (stcb == NULL) {
7225 				if (create_lock_applied) {
7226 					SCTP_ASOC_CREATE_UNLOCK(inp);
7227 					create_lock_applied = 0;
7228 				}
7229 				if (control) {
7230 					sctppcbinfo.mbuf_track--;
7231 					sctp_m_freem(control);
7232 					control = NULL;
7233 				}
7234 				sctp_m_freem(m);
7235 				return (ENOTCONN);
7236 			}
7237 			if (addr == NULL) {
7238 				net = stcb->asoc.primary_destination;
7239 			} else {
7240 				net = sctp_findnet(stcb, addr);
7241 				if (net == NULL) {
7242 					net = stcb->asoc.primary_destination;
7243 				}
7244 			}
7245 		} else {
7246 			if (addr != NULL) {
7247 				SCTP_INP_WLOCK(inp);
7248 				SCTP_INP_INCR_REF(inp);
7249 				SCTP_INP_WUNLOCK(inp);
7250 				stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7251 				if (stcb == NULL) {
7252 					SCTP_INP_WLOCK(inp);
7253 					SCTP_INP_DECR_REF(inp);
7254 					SCTP_INP_WUNLOCK(inp);
7255 				}
7256 			}
7257 		}
7258 	}
7259 	if ((stcb == NULL) &&
7260 	    (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7261 		if (control) {
7262 			sctppcbinfo.mbuf_track--;
7263 			sctp_m_freem(control);
7264 			control = NULL;
7265 		}
7266 		if (create_lock_applied) {
7267 			SCTP_ASOC_CREATE_UNLOCK(inp);
7268 			create_lock_applied = 0;
7269 		}
7270 		sctp_m_freem(m);
7271 		return (ENOTCONN);
7272 	} else if ((stcb == NULL) &&
7273 		   (addr == NULL)) {
7274 		if (control) {
7275 			sctppcbinfo.mbuf_track--;
7276 			sctp_m_freem(control);
7277 			control = NULL;
7278 		}
7279 		if (create_lock_applied) {
7280 			SCTP_ASOC_CREATE_UNLOCK(inp);
7281 			create_lock_applied = 0;
7282 		}
7283 		sctp_m_freem(m);
7284 		return (ENOENT);
7285 	} else if (stcb == NULL) {
7286 		/* UDP mode, we must go ahead and start the INIT process */
7287 		if ((use_rcvinfo) && (srcv.sinfo_flags & SCTP_ABORT)) {
7288 			/* Strange user to do this */
7289 			if (control) {
7290 				sctppcbinfo.mbuf_track--;
7291 				sctp_m_freem(control);
7292 				control = NULL;
7293 			}
7294 			if (create_lock_applied) {
7295 				SCTP_ASOC_CREATE_UNLOCK(inp);
7296 				create_lock_applied = 0;
7297 			}
7298 			sctp_m_freem(m);
7299 			return (ENOENT);
7300 		}
7301 		stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7302 		if (stcb == NULL) {
7303 			if (control) {
7304 				sctppcbinfo.mbuf_track--;
7305 				sctp_m_freem(control);
7306 				control = NULL;
7307 			}
7308 			if (create_lock_applied) {
7309 				SCTP_ASOC_CREATE_UNLOCK(inp);
7310 				create_lock_applied = 0;
7311 			}
7312 			sctp_m_freem(m);
7313 			return (error);
7314 		}
7315 		if (create_lock_applied) {
7316 			SCTP_ASOC_CREATE_UNLOCK(inp);
7317 			create_lock_applied = 0;
7318 		} else {
7319 			printf("Huh-1, create lock should have been applied!\n");
7320 		}
7321 		queue_only = 1;
7322 		asoc = &stcb->asoc;
7323 		asoc->state = SCTP_STATE_COOKIE_WAIT;
7324 		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7325 		if (control) {
7326 			/* see if a init structure exists in cmsg headers */
7327 			struct sctp_initmsg initm;
7328 			int i;
7329 			if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
7330 					   sizeof(initm))) {
7331 				/* we have an INIT override of the default */
7332 				if (initm.sinit_max_attempts)
7333 					asoc->max_init_times = initm.sinit_max_attempts;
7334 				if (initm.sinit_num_ostreams)
7335 					asoc->pre_open_streams = initm.sinit_num_ostreams;
7336 				if (initm.sinit_max_instreams)
7337 					asoc->max_inbound_streams = initm.sinit_max_instreams;
7338 				if (initm.sinit_max_init_timeo)
7339 					asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7340 			}
7341 			if (asoc->streamoutcnt < asoc->pre_open_streams) {
7342 				/* Default is NOT correct */
7343 #ifdef SCTP_DEBUG
7344 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7345 					printf("Ok, defout:%d pre_open:%d\n",
7346 					       asoc->streamoutcnt, asoc->pre_open_streams);
7347 				}
7348 #endif
7349 				free(asoc->strmout, M_PCB);
7350 				asoc->strmout = NULL;
7351 				asoc->streamoutcnt = asoc->pre_open_streams;
7352 				asoc->strmout = malloc(asoc->streamoutcnt *
7353 				       sizeof(struct sctp_stream_out), M_PCB,
7354 				       M_WAIT);
7355 				for (i = 0; i < asoc->streamoutcnt; i++) {
7356 					/*
7357 					 * inbound side must be set to 0xffff,
7358 					 * also NOTE when we get the INIT-ACK
7359 					 * back (for INIT sender) we MUST
7360 					 * reduce the count (streamoutcnt) but
7361 					 * first check if we sent to any of the
7362 					 * upper streams that were dropped (if
7363 					 * some were). Those that were dropped
7364 					 * must be notified to the upper layer
7365 					 * as failed to send.
7366 					 */
7367 					asoc->strmout[i].next_sequence_sent = 0x0;
7368 					TAILQ_INIT(&asoc->strmout[i].outqueue);
7369 					asoc->strmout[i].stream_no = i;
7370 					asoc->strmout[i].next_spoke.tqe_next = 0;
7371 					asoc->strmout[i].next_spoke.tqe_prev = 0;
7372 				}
7373 			}
7374 		}
7375 		sctp_send_initiate(inp, stcb);
7376 		/*
7377 		 * we may want to dig in after this call and adjust the MTU
7378 		 * value. It defaulted to 1500 (constant) but the ro structure
7379 		 * may now have an update and thus we may need to change it
7380 		 * BEFORE we append the message.
7381 		 */
7382 		net = stcb->asoc.primary_destination;
7383 	} else {
7384 		if (create_lock_applied) {
7385 			SCTP_ASOC_CREATE_UNLOCK(inp);
7386 			create_lock_applied = 0;
7387 		}
7388 		asoc = &stcb->asoc;
7389 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7390 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7391 			queue_only = 1;
7392 		}
7393 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7394 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7395 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7396 		    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7397 			if (control) {
7398 				sctppcbinfo.mbuf_track--;
7399 				sctp_m_freem(control);
7400 				control = NULL;
7401 			}
7402 			if ((use_rcvinfo) &&
7403 			    (srcv.sinfo_flags & SCTP_ABORT)) {
7404 				sctp_msg_append(stcb, net, m, &srcv, flags);
7405 				error = 0;
7406 			} else {
7407 				if (m)
7408 					sctp_m_freem(m);
7409 				error = ECONNRESET;
7410 			}
7411 			SCTP_TCB_UNLOCK(stcb);
7412 			return (error);
7413 		}
7414 	}
7415 	if (create_lock_applied) {
7416 		/* we should never hit here with the create lock applied
7417 		 *
7418 		 */
7419 		SCTP_ASOC_CREATE_UNLOCK(inp);
7420 		create_lock_applied = 0;
7421 	}
7422 
7423 
7424 	if (use_rcvinfo == 0) {
7425 		srcv = stcb->asoc.def_send;
7426 	}
7427 #ifdef SCTP_DEBUG
7428 	else {
7429 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7430 			printf("stream:%d\n", srcv.sinfo_stream);
7431 			printf("flags:%x\n", (u_int)srcv.sinfo_flags);
7432 			printf("ppid:%d\n", srcv.sinfo_ppid);
7433 			printf("context:%d\n", srcv.sinfo_context);
7434 		}
7435 	}
7436 #endif
7437 	if (control) {
7438 		sctppcbinfo.mbuf_track--;
7439 		sctp_m_freem(control);
7440 		control = NULL;
7441 	}
7442 	if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) {
7443 		/* we take the override or the unconfirmed */
7444 		;
7445 	} else {
7446 		net = stcb->asoc.primary_destination;
7447 	}
7448 	if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7449 		SCTP_TCB_UNLOCK(stcb);
7450 		return (error);
7451 	}
7452 	if (net->flight_size > net->cwnd) {
7453 		sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7454 		queue_only = 1;
7455  	} else if (asoc->ifp_had_enobuf) {
7456 		sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7457 	 	queue_only = 1;
7458  	} else {
7459 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7460 			   ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7461 			   SCTP_MED_OVERHEAD);
7462 
7463 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7464 		    (stcb->asoc.total_flight > 0) &&
7465 		    (un_sent < (int)stcb->asoc.smallest_mtu)
7466 			) {
7467 
7468 			/* Ok, Nagle is set on and we have
7469 			 * data outstanding. Don't send anything
7470 			 * and let the SACK drive out the data.
7471 			 */
7472 			sctp_pegs[SCTP_NAGLE_NOQ]++;
7473 			queue_only = 1;
7474 		} else {
7475 			sctp_pegs[SCTP_NAGLE_OFF]++;
7476 		}
7477 	}
7478 	if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7479 		/* we can attempt to send too.*/
7480 #ifdef SCTP_DEBUG
7481 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7482 			printf("USR Send calls sctp_chunk_output\n");
7483 		}
7484 #endif
7485 #ifdef SCTP_AUDITING_ENABLED
7486 		sctp_audit_log(0xC0, 1);
7487 		sctp_auditing(6, inp, stcb, net);
7488 #endif
7489 		sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7490 		sctp_chunk_output(inp, stcb, 0);
7491 #ifdef SCTP_AUDITING_ENABLED
7492 		sctp_audit_log(0xC0, 2);
7493 		sctp_auditing(7, inp, stcb, net);
7494 #endif
7495 
7496 	}
7497 #ifdef SCTP_DEBUG
7498 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7499 		printf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7500 	}
7501 #endif
7502 	SCTP_TCB_UNLOCK(stcb);
7503 	return (0);
7504 }
7505 
7506 void
7507 send_forward_tsn(struct sctp_tcb *stcb,
7508 		 struct sctp_association *asoc)
7509 {
7510 	struct sctp_tmit_chunk *chk;
7511 	struct sctp_forward_tsn_chunk *fwdtsn;
7512 
7513 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7514 		if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7515 			/* mark it to unsent */
7516 			chk->sent = SCTP_DATAGRAM_UNSENT;
7517 			chk->snd_count = 0;
7518 			/* Do we correct its output location? */
7519 			if (chk->whoTo != asoc->primary_destination) {
7520 				sctp_free_remote_addr(chk->whoTo);
7521 				chk->whoTo = asoc->primary_destination;
7522 				chk->whoTo->ref_count++;
7523 			}
7524 			goto sctp_fill_in_rest;
7525 		}
7526 	}
7527 	/* Ok if we reach here we must build one */
7528 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7529 	if (chk == NULL) {
7530 		return;
7531 	}
7532 	sctppcbinfo.ipi_count_chunk++;
7533 	sctppcbinfo.ipi_gencnt_chunk++;
7534 	chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7535 	chk->asoc = asoc;
7536 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
7537 	if (chk->data == NULL) {
7538 		chk->whoTo->ref_count--;
7539 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7540 		sctppcbinfo.ipi_count_chunk--;
7541 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7542 			panic("Chunk count is negative");
7543 		}
7544 		sctppcbinfo.ipi_gencnt_chunk++;
7545 		return;
7546 	}
7547 	chk->data->m_data += SCTP_MIN_OVERHEAD;
7548 	chk->sent = SCTP_DATAGRAM_UNSENT;
7549 	chk->snd_count = 0;
7550 	chk->whoTo = asoc->primary_destination;
7551 	chk->whoTo->ref_count++;
7552 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7553 	asoc->ctrl_queue_cnt++;
7554  sctp_fill_in_rest:
7555 	/* Here we go through and fill out the part that
7556 	 * deals with stream/seq of the ones we skip.
7557 	 */
7558 	chk->data->m_pkthdr.len = chk->data->m_len = 0;
7559 	{
7560 		struct sctp_tmit_chunk *at, *tp1, *last;
7561 		struct sctp_strseq *strseq;
7562 		unsigned int cnt_of_space, i, ovh;
7563 		unsigned int space_needed;
7564 		unsigned int cnt_of_skipped = 0;
7565 		TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7566 			if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7567 				/* no more to look at */
7568 				break;
7569 			}
7570 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7571 				/* We don't report these */
7572 				continue;
7573 			}
7574 			cnt_of_skipped++;
7575 		}
7576 		space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7577 				(cnt_of_skipped * sizeof(struct sctp_strseq)));
7578 		if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7579 		    ((chk->data->m_flags & M_EXT) == 0)) {
7580 			/* Need a M_EXT, get one and move
7581 			 * fwdtsn to data area.
7582 			 */
7583 			MCLGET(chk->data, M_DONTWAIT);
7584 		}
7585 		cnt_of_space = M_TRAILINGSPACE(chk->data);
7586 
7587 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7588 			ovh = SCTP_MIN_OVERHEAD;
7589 		} else {
7590 			ovh = SCTP_MIN_V4_OVERHEAD;
7591 		}
7592 		if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7593 			/* trim to a mtu size */
7594 			cnt_of_space = asoc->smallest_mtu - ovh;
7595 		}
7596 		if (cnt_of_space < space_needed) {
7597 			/* ok we must trim down the chunk by lowering
7598 			 * the advance peer ack point.
7599 			 */
7600 			cnt_of_skipped = (cnt_of_space-
7601 					  ((sizeof(struct sctp_forward_tsn_chunk))/
7602  					    sizeof(struct sctp_strseq)));
7603 			/* Go through and find the TSN that
7604 			 * will be the one we report.
7605 			 */
7606 			at = TAILQ_FIRST(&asoc->sent_queue);
7607 			for (i = 0; i < cnt_of_skipped; i++) {
7608 				tp1 = TAILQ_NEXT(at, sctp_next);
7609 				at = tp1;
7610 			}
7611 			last = at;
7612 			/* last now points to last one I can report, update peer ack point */
7613 			asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7614 			space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7615 		}
7616 		chk->send_size = space_needed;
7617 		/* Setup the chunk */
7618 		fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7619 		fwdtsn->ch.chunk_length = htons(chk->send_size);
7620 		fwdtsn->ch.chunk_flags = 0;
7621 		fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7622 		fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7623 		chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7624 				  (cnt_of_skipped * sizeof(struct sctp_strseq)));
7625 		chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7626 		fwdtsn++;
7627 		/* Move pointer to after the fwdtsn and transfer to
7628 		 * the strseq pointer.
7629 		 */
7630 		strseq = (struct sctp_strseq *)fwdtsn;
7631 		/*
7632 		 * Now populate the strseq list. This is done blindly
7633 		 * without pulling out duplicate stream info. This is
7634 		 * inefficent but won't harm the process since the peer
7635 		 * will look at these in sequence and will thus release
7636 		 * anything. It could mean we exceed the PMTU and chop
7637 		 * off some that we could have included.. but this is
7638 		 * unlikely (aka 1432/4 would mean 300+ stream seq's would
7639 		 * have to be reported in one FWD-TSN. With a bit of work
7640 		 * we can later FIX this to optimize and pull out duplcates..
7641 		 * but it does add more overhead. So for now... not!
7642 		 */
7643 		at = TAILQ_FIRST(&asoc->sent_queue);
7644 		for (i = 0; i < cnt_of_skipped; i++) {
7645 			tp1 = TAILQ_NEXT(at, sctp_next);
7646 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7647 				/* We don't report these */
7648 				i--;
7649 				at = tp1;
7650 				continue;
7651 			}
7652 			strseq->stream = ntohs(at->rec.data.stream_number);
7653 			strseq->sequence = ntohs(at->rec.data.stream_seq);
7654 			strseq++;
7655 			at = tp1;
7656 		}
7657 	}
7658 	return;
7659 
7660 }
7661 
7662 void
7663 sctp_send_sack(struct sctp_tcb *stcb)
7664 {
7665 	/*
7666 	 * Queue up a SACK in the control queue. We must first check to
7667 	 * see if a SACK is somehow on the control queue. If so, we will
7668 	 * take and remove the old one.
7669 	 */
7670 	struct sctp_association *asoc;
7671 	struct sctp_tmit_chunk *chk, *a_chk;
7672 	struct sctp_sack_chunk *sack;
7673 	struct sctp_gap_ack_block *gap_descriptor;
7674 	uint32_t *dup;
7675 	int start;
7676 	unsigned int i, maxi, seeing_ones, m_size;
7677 	unsigned int num_gap_blocks, space;
7678 
7679 	start = maxi = 0;
7680 	seeing_ones = 1;
7681 	a_chk = NULL;
7682 	asoc = &stcb->asoc;
7683 	if (asoc->last_data_chunk_from == NULL) {
7684 		/* Hmm we never received anything */
7685 		return;
7686 	}
7687 	sctp_set_rwnd(stcb, asoc);
7688 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7689 		if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7690 			/* Hmm, found a sack already on queue, remove it */
7691 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7692 			asoc->ctrl_queue_cnt++;
7693 			a_chk = chk;
7694 			if (a_chk->data)
7695 				sctp_m_freem(a_chk->data);
7696 			a_chk->data = NULL;
7697 			sctp_free_remote_addr(a_chk->whoTo);
7698 			a_chk->whoTo = NULL;
7699 			break;
7700 		}
7701 	}
7702 	if (a_chk == NULL) {
7703 		a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7704 		if (a_chk == NULL) {
7705 			/* No memory so we drop the idea, and set a timer */
7706 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7707 					stcb->sctp_ep, stcb, NULL);
7708 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7709 					 stcb->sctp_ep, stcb, NULL);
7710 			return;
7711 		}
7712 		sctppcbinfo.ipi_count_chunk++;
7713 		sctppcbinfo.ipi_gencnt_chunk++;
7714 		a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7715 	}
7716 	a_chk->asoc = asoc;
7717 	a_chk->snd_count = 0;
7718 	a_chk->send_size = 0;	/* fill in later */
7719 	a_chk->sent = SCTP_DATAGRAM_UNSENT;
7720 	m_size = (asoc->mapping_array_size << 3);
7721 
7722 	if ((asoc->numduptsns) ||
7723 	    (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7724 		) {
7725 		/* Ok, we have some duplicates or the destination for the
7726 		 * sack is unreachable, lets see if we can select an alternate
7727 		 * than asoc->last_data_chunk_from
7728 		 */
7729 		if ((!(asoc->last_data_chunk_from->dest_state &
7730 		      SCTP_ADDR_NOT_REACHABLE)) &&
7731 		    (asoc->used_alt_onsack > 2)) {
7732 			/* We used an alt last time, don't this time */
7733 			a_chk->whoTo = NULL;
7734 		} else {
7735 			asoc->used_alt_onsack++;
7736 			a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7737 		}
7738 		if (a_chk->whoTo == NULL) {
7739 			/* Nope, no alternate */
7740 			a_chk->whoTo = asoc->last_data_chunk_from;
7741 			asoc->used_alt_onsack = 0;
7742 		}
7743 	} else {
7744 		/* No duplicates so we use the last
7745 		 * place we received data from.
7746 		 */
7747 #ifdef SCTP_DEBUG
7748 		if (asoc->last_data_chunk_from == NULL) {
7749 			printf("Huh, last_data_chunk_from is null when we want to sack??\n");
7750 		}
7751 #endif
7752 		asoc->used_alt_onsack = 0;
7753 		a_chk->whoTo = asoc->last_data_chunk_from;
7754 	}
7755 	if (a_chk->whoTo)
7756 		a_chk->whoTo->ref_count++;
7757 
7758 	/* Ok now lets formulate a MBUF with our sack */
7759 	MGETHDR(a_chk->data, M_DONTWAIT, MT_DATA);
7760 	if ((a_chk->data == NULL) ||
7761 	    (a_chk->whoTo == NULL)) {
7762 		/* rats, no mbuf memory */
7763 		if (a_chk->data) {
7764 			/* was a problem with the destination */
7765 			sctp_m_freem(a_chk->data);
7766 			a_chk->data = NULL;
7767 		}
7768 		a_chk->whoTo->ref_count--;
7769 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7770 		sctppcbinfo.ipi_count_chunk--;
7771 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7772 			panic("Chunk count is negative");
7773 		}
7774 		sctppcbinfo.ipi_gencnt_chunk++;
7775 		sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7776 				stcb->sctp_ep, stcb, NULL);
7777 		sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7778 				 stcb->sctp_ep, stcb, NULL);
7779 		return;
7780 	}
7781 	/* First count the number of gap ack blocks we need */
7782 	if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7783 		/* We know if there are none above the cum-ack we
7784 		 * have everything with NO gaps
7785 		 */
7786 		num_gap_blocks = 0;
7787 	} else {
7788 		/* Ok we must count how many gaps we
7789 		 * have.
7790 		 */
7791 		num_gap_blocks = 0;
7792 		if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7793 			maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7794 		} else {
7795 			maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7796 		}
7797 		if (maxi > m_size) {
7798 			/* impossible but who knows, someone is playing with us  :> */
7799 #ifdef SCTP_DEBUG
7800 			printf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7801 			       maxi,
7802 			       m_size,
7803 			       asoc->highest_tsn_inside_map,
7804 			       asoc->mapping_array_base_tsn,
7805 			       asoc->cumulative_tsn
7806 			       );
7807 #endif
7808 			num_gap_blocks = 0;
7809 			goto no_gaps_now;
7810 		}
7811 		if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7812 			start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7813 		} else {
7814 			/* Set it so we start at 0 */
7815 			start = -1;
7816 		}
7817 		/* Ok move start up one to look at the NEXT past the cum-ack */
7818 		start++;
7819 		for (i = start; i <= maxi; i++) {
7820 			if (seeing_ones) {
7821 				/* while seeing ones I must
7822 				 * transition back to 0 before
7823 				 * finding the next gap and
7824 				 * counting the segment.
7825 				 */
7826 				if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7827 					seeing_ones = 0;
7828 				}
7829 			} else {
7830 				if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7831 					seeing_ones = 1;
7832 					num_gap_blocks++;
7833 				}
7834 			}
7835 		}
7836 	no_gaps_now:
7837 		if (num_gap_blocks == 0) {
7838 			/*
7839 			 * Traveled all of the bits and NO one,
7840 			 * must have reneged
7841 			 */
7842 			if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
7843 			   asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
7844 #ifdef SCTP_MAP_LOGGING
7845 			   sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
7846 #endif
7847 			}
7848 		}
7849 	}
7850 
7851 	/* Now calculate the space needed */
7852 	space = (sizeof(struct sctp_sack_chunk) +
7853 		 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7854 		 (asoc->numduptsns * sizeof(int32_t))
7855 		);
7856 	if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
7857 		/* Reduce the size of the sack to fit */
7858 		int calc, fit;
7859 		calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
7860 		calc -= sizeof(struct sctp_gap_ack_block);
7861 		fit = calc/sizeof(struct sctp_gap_ack_block);
7862 		if (fit > (int)num_gap_blocks) {
7863 			/* discard some dups */
7864 			asoc->numduptsns = (fit - num_gap_blocks);
7865 		} else {
7866 			/* discard all dups and some gaps */
7867 			num_gap_blocks = fit;
7868 			asoc->numduptsns = 0;
7869 		}
7870 		/* recalc space */
7871 		space = (sizeof(struct sctp_sack_chunk) +
7872 			 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7873 			 (asoc->numduptsns * sizeof(int32_t))
7874 			);
7875 
7876 	}
7877 
7878 	if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
7879 		/* We need a cluster */
7880 		MCLGET(a_chk->data, M_DONTWAIT);
7881 		if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
7882 			/* can't get a cluster
7883 			 * give up and try later.
7884 			 */
7885 			if (a_chk->data)
7886 				sctp_m_freem(a_chk->data);
7887 			a_chk->data = NULL;
7888 			a_chk->whoTo->ref_count--;
7889 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7890 			sctppcbinfo.ipi_count_chunk--;
7891 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7892 				panic("Chunk count is negative");
7893 			}
7894 			sctppcbinfo.ipi_gencnt_chunk++;
7895 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7896 					stcb->sctp_ep, stcb, NULL);
7897 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7898 					 stcb->sctp_ep, stcb, NULL);
7899 			return;
7900 		}
7901 	}
7902 
7903 	/* ok, lets go through and fill it in */
7904 	a_chk->data->m_data += SCTP_MIN_OVERHEAD;
7905 	sack = mtod(a_chk->data, struct sctp_sack_chunk *);
7906 	sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
7907 	sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
7908 	sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
7909 	sack->sack.a_rwnd = htonl(asoc->my_rwnd);
7910 	asoc->my_last_reported_rwnd = asoc->my_rwnd;
7911 	sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
7912 	sack->sack.num_dup_tsns = htons(asoc->numduptsns);
7913 
7914 	a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
7915 			    (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7916 			    (asoc->numduptsns * sizeof(int32_t)));
7917 	a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
7918 	sack->ch.chunk_length = htons(a_chk->send_size);
7919 
7920 	gap_descriptor = (struct sctp_gap_ack_block *)((vaddr_t)sack + sizeof(struct sctp_sack_chunk));
7921 	seeing_ones = 0;
7922 	for (i = start; i <= maxi; i++) {
7923 		if (num_gap_blocks == 0) {
7924 			break;
7925 		}
7926 		if (seeing_ones) {
7927 			/* while seeing Ones I must
7928 			 * transition back to 0 before
7929 			 * finding the next gap
7930 			 */
7931 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7932 				gap_descriptor->end = htons(((uint16_t)(i-start)));
7933 				gap_descriptor++;
7934 				seeing_ones = 0;
7935 				num_gap_blocks--;
7936 			}
7937 		} else {
7938 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7939 				gap_descriptor->start = htons(((uint16_t)(i+1-start)));
7940 				/* advance struct to next pointer */
7941 				seeing_ones = 1;
7942 			}
7943 		}
7944 	}
7945 	if (num_gap_blocks) {
7946 		/* special case where the array is all 1's
7947 		 * to the end of the array.
7948 		 */
7949 		gap_descriptor->end = htons(((uint16_t)((i-start))));
7950 		gap_descriptor++;
7951 	}
7952 	/* now we must add any dups we are going to report. */
7953 	if (asoc->numduptsns) {
7954 		dup = (uint32_t *)gap_descriptor;
7955 		for (i = 0; i < asoc->numduptsns; i++) {
7956 			*dup = htonl(asoc->dup_tsns[i]);
7957 			dup++;
7958 		}
7959 		asoc->numduptsns = 0;
7960 	}
7961 	/* now that the chunk is prepared queue it to the control
7962 	 * chunk queue.
7963 	 */
7964 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
7965 	asoc->ctrl_queue_cnt++;
7966 	sctp_pegs[SCTP_PEG_SACKS_SENT]++;
7967 	return;
7968 }
7969 
7970 void
7971 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
7972 {
7973 	struct mbuf *m_abort;
7974 	struct sctp_abort_msg *abort_m;
7975 	int sz;
7976 	abort_m = NULL;
7977 	MGETHDR(m_abort, M_DONTWAIT, MT_HEADER);
7978 	if (m_abort == NULL) {
7979 		/* no mbuf's */
7980 		return;
7981 	}
7982 	m_abort->m_data += SCTP_MIN_OVERHEAD;
7983 	abort_m = mtod(m_abort, struct sctp_abort_msg *);
7984 	m_abort->m_len = sizeof(struct sctp_abort_msg);
7985 	m_abort->m_next = operr;
7986 	sz = 0;
7987 	if (operr) {
7988 		struct mbuf *n;
7989 		n = operr;
7990 		while (n) {
7991 			sz += n->m_len;
7992 			n = n->m_next;
7993 		}
7994 	}
7995 	abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
7996 	abort_m->msg.ch.chunk_flags = 0;
7997 	abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
7998 					     sz);
7999 	abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8000 	abort_m->sh.dest_port = stcb->rport;
8001 	abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8002 	abort_m->sh.checksum = 0;
8003 	m_abort->m_pkthdr.len = m_abort->m_len + sz;
8004 	m_reset_rcvif(m_abort);
8005 	sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8006 	    stcb->asoc.primary_destination,
8007 	    rtcache_getdst(&stcb->asoc.primary_destination->ro),
8008 	    m_abort, 1, 0, NULL, 0);
8009 }
8010 
8011 int
8012 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8013 			    struct sctp_nets *net)
8014 
8015 {
8016 	/* formulate and SEND a SHUTDOWN-COMPLETE */
8017 	struct mbuf *m_shutdown_comp;
8018 	struct sctp_shutdown_complete_msg *comp_cp;
8019 
8020 	m_shutdown_comp = NULL;
8021 	MGETHDR(m_shutdown_comp, M_DONTWAIT, MT_HEADER);
8022 	if (m_shutdown_comp == NULL) {
8023 		/* no mbuf's */
8024 		return (-1);
8025 	}
8026 	m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8027 	comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8028 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8029 	comp_cp->shut_cmp.ch.chunk_flags = 0;
8030 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8031 	comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8032 	comp_cp->sh.dest_port = stcb->rport;
8033 	comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8034 	comp_cp->sh.checksum = 0;
8035 
8036 	m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8037 	m_reset_rcvif(m_shutdown_comp);
8038 	sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8039 	    rtcache_getdst(&net->ro), m_shutdown_comp,
8040 	    1, 0, NULL, 0);
8041 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8042 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8043 		stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8044 		stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
8045 		soisdisconnected(stcb->sctp_ep->sctp_socket);
8046 	}
8047 	return (0);
8048 }
8049 
8050 int
8051 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8052 {
8053 	/* formulate and SEND a SHUTDOWN-COMPLETE */
8054 	struct mbuf *mout;
8055 	struct ip *iph, *iph_out;
8056 	struct ip6_hdr *ip6, *ip6_out;
8057 	int offset_out;
8058 	struct sctp_shutdown_complete_msg *comp_cp;
8059 
8060 	MGETHDR(mout, M_DONTWAIT, MT_HEADER);
8061 	if (mout == NULL) {
8062 		/* no mbuf's */
8063 		return (-1);
8064 	}
8065 	iph = mtod(m, struct ip *);
8066 	iph_out = NULL;
8067 	ip6_out = NULL;
8068 	offset_out = 0;
8069 	if (iph->ip_v == IPVERSION) {
8070 		mout->m_len = sizeof(struct ip) +
8071 		    sizeof(struct sctp_shutdown_complete_msg);
8072 		mout->m_next = NULL;
8073 		iph_out = mtod(mout, struct ip *);
8074 
8075 		/* Fill in the IP header for the ABORT */
8076 		iph_out->ip_v = IPVERSION;
8077 		iph_out->ip_hl = (sizeof(struct ip)/4);
8078 		iph_out->ip_tos = (u_char)0;
8079 		iph_out->ip_id = 0;
8080 		iph_out->ip_off = 0;
8081 		iph_out->ip_ttl = MAXTTL;
8082 		iph_out->ip_p = IPPROTO_SCTP;
8083 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8084 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8085 
8086 		/* let IP layer calculate this */
8087 		iph_out->ip_sum = 0;
8088 		offset_out += sizeof(*iph_out);
8089 		comp_cp = (struct sctp_shutdown_complete_msg *)(
8090 		    (vaddr_t)iph_out + offset_out);
8091 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8092 		ip6 = (struct ip6_hdr *)iph;
8093 		mout->m_len = sizeof(struct ip6_hdr) +
8094 		    sizeof(struct sctp_shutdown_complete_msg);
8095 		mout->m_next = NULL;
8096 		ip6_out = mtod(mout, struct ip6_hdr *);
8097 
8098 		/* Fill in the IPv6 header for the ABORT */
8099 		ip6_out->ip6_flow = ip6->ip6_flow;
8100 		ip6_out->ip6_hlim = ip6_defhlim;
8101 		ip6_out->ip6_nxt = IPPROTO_SCTP;
8102 		ip6_out->ip6_src = ip6->ip6_dst;
8103 		ip6_out->ip6_dst = ip6->ip6_src;
8104  		ip6_out->ip6_plen = mout->m_len;
8105 		offset_out += sizeof(*ip6_out);
8106 		comp_cp = (struct sctp_shutdown_complete_msg *)(
8107 		    (vaddr_t)ip6_out + offset_out);
8108 	} else {
8109 		/* Currently not supported. */
8110 		return (-1);
8111 	}
8112 
8113 	/* Now copy in and fill in the ABORT tags etc. */
8114 	comp_cp->sh.src_port = sh->dest_port;
8115 	comp_cp->sh.dest_port = sh->src_port;
8116 	comp_cp->sh.checksum = 0;
8117 	comp_cp->sh.v_tag = sh->v_tag;
8118 	comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8119 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8120 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8121 
8122 	mout->m_pkthdr.len = mout->m_len;
8123 	/* add checksum */
8124 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
8125 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
8126 		comp_cp->sh.checksum =  0;
8127 	} else {
8128 		comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8129 	}
8130 
8131 	/* zap the rcvif, it should be null */
8132 	m_reset_rcvif(mout);
8133 	/* zap the stack pointer to the route */
8134 	if (iph_out != NULL) {
8135 		struct route ro;
8136 
8137 		memset(&ro, 0, sizeof ro);
8138 #ifdef SCTP_DEBUG
8139 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8140 			printf("sctp_shutdown_complete2 calling ip_output:\n");
8141 			sctp_print_address_pkt(iph_out, &comp_cp->sh);
8142 		}
8143 #endif
8144 		/* set IPv4 length */
8145 		iph_out->ip_len = htons(mout->m_pkthdr.len);
8146 		/* out it goes */
8147 		ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
8148 	} else if (ip6_out != NULL) {
8149 		struct route ro;
8150 
8151 		memset(&ro, 0, sizeof(ro));
8152 #ifdef SCTP_DEBUG
8153 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8154 			printf("sctp_shutdown_complete2 calling ip6_output:\n");
8155 			sctp_print_address_pkt((struct ip *)ip6_out,
8156 			    &comp_cp->sh);
8157 		}
8158 #endif
8159 		ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
8160 	}
8161 	sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8162 	return (0);
8163 }
8164 
8165 static struct sctp_nets *
8166 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8167 {
8168 	struct sctp_nets *net, *hnet;
8169 	int ms_goneby, highest_ms, state_override=0;
8170 
8171 	SCTP_GETTIME_TIMEVAL(now);
8172 	highest_ms = 0;
8173 	hnet = NULL;
8174 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8175 		if (
8176 			((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8177 			(net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8178 			) {
8179 			/* Skip this guy from consideration if HB is off AND its confirmed*/
8180 #ifdef SCTP_DEBUG
8181 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8182 				printf("Skipping net:%p state:%d nohb/out-of-scope\n",
8183 				       net, net->dest_state);
8184 			}
8185 #endif
8186 			continue;
8187 		}
8188 		if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro.ro_sa) == 0) {
8189 			/* skip this dest net from consideration */
8190 #ifdef SCTP_DEBUG
8191 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8192 				printf("Skipping net:%p reachable NOT\n",
8193 				       net);
8194 			}
8195 #endif
8196 			continue;
8197 		}
8198 		if (net->last_sent_time.tv_sec) {
8199 			/* Sent to so we subtract */
8200 			ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8201 		} else
8202 			/* Never been sent to */
8203 			ms_goneby = 0x7fffffff;
8204 #ifdef SCTP_DEBUG
8205 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8206 			printf("net:%p ms_goneby:%d\n",
8207 			       net, ms_goneby);
8208 		}
8209 #endif
8210 		/* When the address state is unconfirmed but still considered reachable, we
8211 		 * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8212 		 * state, then we cut it back to HB at a more normal pace.
8213 		 */
8214 		if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8215 			state_override = 1;
8216 		} else {
8217 			state_override = 0;
8218 		}
8219 
8220 		if ((((unsigned int)ms_goneby >= net->RTO) || (state_override)) &&
8221 		    (ms_goneby > highest_ms)) {
8222 			highest_ms = ms_goneby;
8223 			hnet = net;
8224 #ifdef SCTP_DEBUG
8225 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8226 				printf("net:%p is the new high\n",
8227 				       net);
8228 			}
8229 #endif
8230 		}
8231 	}
8232 	if (hnet &&
8233 	   ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8234 		state_override = 1;
8235 	} else {
8236 		state_override = 0;
8237 	}
8238 
8239 	if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_override)) {
8240 		/* Found the one with longest delay bounds
8241 		 * OR it is unconfirmed and still not marked
8242 		 * unreachable.
8243 		 */
8244 #ifdef SCTP_DEBUG
8245 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8246 			printf("net:%p is the hb winner -",
8247 				hnet);
8248 			if (hnet)
8249 				sctp_print_address((struct sockaddr *)&hnet->ro.ro_sa);
8250 			else
8251 				printf(" none\n");
8252 		}
8253 #endif
8254 		/* update the timer now */
8255 		hnet->last_sent_time = *now;
8256 		return (hnet);
8257 	}
8258 	/* Nothing to HB */
8259 	return (NULL);
8260 }
8261 
8262 int
8263 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8264 {
8265 	struct sctp_tmit_chunk *chk;
8266 	struct sctp_nets *net;
8267 	struct sctp_heartbeat_chunk *hb;
8268 	struct timeval now;
8269 	struct sockaddr_in *sin;
8270 	struct sockaddr_in6 *sin6;
8271 
8272 	if (user_req == 0) {
8273 		net = sctp_select_hb_destination(stcb, &now);
8274 		if (net == NULL) {
8275 			/* All our busy none to send to, just
8276 			 * start the timer again.
8277 			 */
8278 			if (stcb->asoc.state == 0) {
8279 				return (0);
8280 			}
8281 			sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8282 					 stcb->sctp_ep,
8283 					 stcb,
8284 					 net);
8285 			return (0);
8286 		}
8287 #ifndef SCTP_USE_ALLMAN_BURST
8288 		else {
8289 			/* found one idle.. decay cwnd on this one
8290 			 * by 1/2 if none outstanding.
8291 			 */
8292 
8293 			if (net->flight_size == 0) {
8294 				net->cwnd /= 2;
8295 				if (net->addr_is_local) {
8296 					if (net->cwnd < (net->mtu *4)) {
8297 						net->cwnd = net->mtu * 4;
8298 					}
8299 				} else {
8300 					if (net->cwnd < (net->mtu * 2)) {
8301 						net->cwnd = net->mtu * 2;
8302 					}
8303 				}
8304 
8305 			}
8306 
8307 		}
8308 #endif
8309 	} else {
8310 		net = u_net;
8311 		if (net == NULL) {
8312 			return (0);
8313 		}
8314 		SCTP_GETTIME_TIMEVAL(&now);
8315 	}
8316 	sin = (struct sockaddr_in *)&net->ro.ro_sa;
8317 	if (sin->sin_family != AF_INET) {
8318 		if (sin->sin_family != AF_INET6) {
8319 			/* huh */
8320 			return (0);
8321 		}
8322 	}
8323 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8324 	if (chk == NULL) {
8325 #ifdef SCTP_DEBUG
8326 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8327 			printf("Gak, can't get a chunk for hb\n");
8328 		}
8329 #endif
8330 		return (0);
8331 	}
8332 	sctppcbinfo.ipi_gencnt_chunk++;
8333 	sctppcbinfo.ipi_count_chunk++;
8334 	chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8335 	chk->asoc = &stcb->asoc;
8336 	chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8337 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8338 	if (chk->data == NULL) {
8339 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8340 		sctppcbinfo.ipi_count_chunk--;
8341 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8342 			panic("Chunk count is negative");
8343 		}
8344 		sctppcbinfo.ipi_gencnt_chunk++;
8345 		return (0);
8346 	}
8347 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8348 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8349 	chk->sent = SCTP_DATAGRAM_UNSENT;
8350 	chk->snd_count = 0;
8351 	chk->whoTo = net;
8352 	chk->whoTo->ref_count++;
8353 	/* Now we have a mbuf that we can fill in with the details */
8354 	hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8355 
8356 	/* fill out chunk header */
8357 	hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8358 	hb->ch.chunk_flags = 0;
8359 	hb->ch.chunk_length = htons(chk->send_size);
8360 	/* Fill out hb parameter */
8361 	hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8362 	hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8363 	hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8364 	hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8365 	/* Did our user request this one, put it in */
8366 	hb->heartbeat.hb_info.user_req = user_req;
8367 	hb->heartbeat.hb_info.addr_family = sin->sin_family;
8368 	hb->heartbeat.hb_info.addr_len = sin->sin_len;
8369 	if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8370 		/* we only take from the entropy pool if the address is
8371 		 * not confirmed.
8372 		 */
8373  		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8374  		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8375 	} else {
8376 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8377 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8378 	}
8379 	if (sin->sin_family == AF_INET) {
8380 		memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8381 	} else if (sin->sin_family == AF_INET6) {
8382 		/* We leave the scope the way it is in our lookup table. */
8383 		sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
8384 		memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8385 	} else {
8386 		/* huh compiler bug */
8387 #ifdef SCTP_DEBUG
8388 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8389 			printf("Compiler bug bleeds a mbuf and a chunk\n");
8390 		}
8391 #endif
8392 		return (0);
8393 	}
8394 	/* ok we have a destination that needs a beat */
8395 	/* lets do the theshold management Qiaobing style */
8396 	if (user_req == 0) {
8397 		if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8398 					      stcb->asoc.max_send_times)) {
8399 			/* we have lost the association, in a way this
8400 			 * is quite bad since we really are one less time
8401 			 * since we really did not send yet. This is the
8402 			 * down side to the Q's style as defined in the RFC
8403 			 * and not my alternate style defined in the RFC.
8404 			 */
8405 			if (chk->data != NULL) {
8406 				sctp_m_freem(chk->data);
8407 				chk->data = NULL;
8408 			}
8409 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8410 			sctppcbinfo.ipi_count_chunk--;
8411 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8412 				panic("Chunk count is negative");
8413 			}
8414 			sctppcbinfo.ipi_gencnt_chunk++;
8415 			return (-1);
8416 		}
8417 	}
8418 	net->hb_responded = 0;
8419 #ifdef SCTP_DEBUG
8420 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8421 		printf("Inserting chunk for HB\n");
8422 	}
8423 #endif
8424 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8425 	stcb->asoc.ctrl_queue_cnt++;
8426 	sctp_pegs[SCTP_HB_SENT]++;
8427 	/*
8428 	 * Call directly med level routine to put out the chunk. It will
8429 	 * always tumble out control chunks aka HB but it may even tumble
8430 	 * out data too.
8431 	 */
8432 	if (user_req == 0) {
8433 		/* Ok now lets start the HB timer if it is NOT a user req */
8434 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8435 				 stcb, net);
8436 	}
8437 	return (1);
8438 }
8439 
8440 void
8441 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8442 		   uint32_t high_tsn)
8443 {
8444 	struct sctp_association *asoc;
8445 	struct sctp_ecne_chunk *ecne;
8446 	struct sctp_tmit_chunk *chk;
8447 	asoc = &stcb->asoc;
8448 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8449 		if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8450 			/* found a previous ECN_ECHO update it if needed */
8451 			ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8452 			ecne->tsn = htonl(high_tsn);
8453 			return;
8454 		}
8455 	}
8456 	/* nope could not find one to update so we must build one */
8457 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8458 	if (chk == NULL) {
8459 		return;
8460 	}
8461 	sctp_pegs[SCTP_ECNE_SENT]++;
8462 	sctppcbinfo.ipi_count_chunk++;
8463 	sctppcbinfo.ipi_gencnt_chunk++;
8464 	chk->rec.chunk_id = SCTP_ECN_ECHO;
8465 	chk->asoc = &stcb->asoc;
8466 	chk->send_size = sizeof(struct sctp_ecne_chunk);
8467 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8468 	if (chk->data == NULL) {
8469 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8470 		sctppcbinfo.ipi_count_chunk--;
8471 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8472 			panic("Chunk count is negative");
8473 		}
8474 		sctppcbinfo.ipi_gencnt_chunk++;
8475 		return;
8476 	}
8477 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8478 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8479 	chk->sent = SCTP_DATAGRAM_UNSENT;
8480 	chk->snd_count = 0;
8481 	chk->whoTo = net;
8482 	chk->whoTo->ref_count++;
8483 	ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8484 	ecne->ch.chunk_type = SCTP_ECN_ECHO;
8485 	ecne->ch.chunk_flags = 0;
8486 	ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8487 	ecne->tsn = htonl(high_tsn);
8488 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8489 	asoc->ctrl_queue_cnt++;
8490 }
8491 
8492 void
8493 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8494 			 struct mbuf *m, int iphlen, int bad_crc)
8495 {
8496 	struct sctp_association *asoc;
8497 	struct sctp_pktdrop_chunk *drp;
8498 	struct sctp_tmit_chunk *chk;
8499 	uint8_t *datap;
8500 	int len;
8501 	unsigned int small_one;
8502 	struct ip *iph;
8503 
8504 	long spc;
8505 	asoc = &stcb->asoc;
8506 	if (asoc->peer_supports_pktdrop == 0) {
8507 		/* peer must declare support before I
8508 		 * send one.
8509 		 */
8510 		return;
8511 	}
8512 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8513 	if (chk == NULL) {
8514 		return;
8515 	}
8516 	sctppcbinfo.ipi_count_chunk++;
8517 	sctppcbinfo.ipi_gencnt_chunk++;
8518 
8519 	iph = mtod(m, struct ip *);
8520 	if (iph == NULL) {
8521 		return;
8522 	}
8523 	if (iph->ip_v == IPVERSION) {
8524 		/* IPv4 */
8525 #if defined(__FreeBSD__)
8526 		len = chk->send_size = iph->ip_len;
8527 #else
8528 		len = chk->send_size = (iph->ip_len - iphlen);
8529 #endif
8530 	} else {
8531 		struct ip6_hdr *ip6h;
8532 		/* IPv6 */
8533 		ip6h = mtod(m, struct ip6_hdr *);
8534 		len = chk->send_size = htons(ip6h->ip6_plen);
8535 	}
8536 	if ((len+iphlen) > m->m_pkthdr.len) {
8537 		/* huh */
8538 		chk->send_size = len = m->m_pkthdr.len - iphlen;
8539 	}
8540 	chk->asoc = &stcb->asoc;
8541 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8542 	if (chk->data == NULL) {
8543 	jump_out:
8544 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8545 		sctppcbinfo.ipi_count_chunk--;
8546 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8547 			panic("Chunk count is negative");
8548 		}
8549 		sctppcbinfo.ipi_gencnt_chunk++;
8550 		return;
8551 	}
8552 	if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8553 		MCLGET(chk->data, M_DONTWAIT);
8554 		if ((chk->data->m_flags & M_EXT) == 0) {
8555 			/* Give up */
8556 			sctp_m_freem(chk->data);
8557 			chk->data = NULL;
8558 			goto jump_out;
8559 		}
8560 	}
8561 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8562 	drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8563 	if (drp == NULL) {
8564 		sctp_m_freem(chk->data);
8565 		chk->data = NULL;
8566 		goto jump_out;
8567 	}
8568 	small_one = asoc->smallest_mtu;
8569 	if (small_one > MCLBYTES) {
8570 		/* Only one cluster worth of data MAX */
8571 		small_one = MCLBYTES;
8572 	}
8573 	chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8574 			  sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8575 	if (chk->book_size > small_one) {
8576 		drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8577 		drp->trunc_len = htons(chk->send_size);
8578 		chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8579 					     sizeof(struct sctp_pktdrop_chunk) +
8580 					     sizeof(struct sctphdr));
8581 		len = chk->send_size;
8582 	} else {
8583 		/* no truncation needed */
8584 		drp->ch.chunk_flags = 0;
8585 		drp->trunc_len = htons(0);
8586 	}
8587 	if (bad_crc) {
8588 		drp->ch.chunk_flags |= SCTP_BADCRC;
8589 	}
8590 	chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8591 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8592 	chk->sent = SCTP_DATAGRAM_UNSENT;
8593 	chk->snd_count = 0;
8594 	if (net) {
8595 		/* we should hit here */
8596 		chk->whoTo = net;
8597 	} else {
8598 		chk->whoTo = asoc->primary_destination;
8599 	}
8600 	chk->whoTo->ref_count++;
8601 	chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8602 	drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8603 	drp->ch.chunk_length = htons(chk->send_size);
8604 	spc = stcb->sctp_socket->so_rcv.sb_hiwat;
8605 	if (spc < 0) {
8606 		spc = 0;
8607 	}
8608 	drp->bottle_bw = htonl(spc);
8609 	drp->current_onq = htonl(asoc->size_on_delivery_queue +
8610 				 asoc->size_on_reasm_queue +
8611 				 asoc->size_on_all_streams +
8612 				 asoc->my_rwnd_control_len +
8613 		                 stcb->sctp_socket->so_rcv.sb_cc);
8614 	drp->reserved = 0;
8615 	datap = drp->data;
8616         m_copydata(m, iphlen, len, datap);
8617 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8618 	asoc->ctrl_queue_cnt++;
8619 }
8620 
8621 void
8622 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8623 {
8624 	struct sctp_association *asoc;
8625 	struct sctp_cwr_chunk *cwr;
8626 	struct sctp_tmit_chunk *chk;
8627 
8628 	asoc = &stcb->asoc;
8629 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8630 		if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8631 			/* found a previous ECN_CWR update it if needed */
8632 			cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8633 			if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8634 					      MAX_TSN)) {
8635 				cwr->tsn = htonl(high_tsn);
8636 			}
8637 			return;
8638 		}
8639 	}
8640 	/* nope could not find one to update so we must build one */
8641 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8642 	if (chk == NULL) {
8643 		return;
8644 	}
8645 	sctppcbinfo.ipi_count_chunk++;
8646 	sctppcbinfo.ipi_gencnt_chunk++;
8647 	chk->rec.chunk_id = SCTP_ECN_CWR;
8648 	chk->asoc = &stcb->asoc;
8649 	chk->send_size = sizeof(struct sctp_cwr_chunk);
8650 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8651 	if (chk->data == NULL) {
8652 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8653 		sctppcbinfo.ipi_count_chunk--;
8654 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8655 			panic("Chunk count is negative");
8656 		}
8657 		sctppcbinfo.ipi_gencnt_chunk++;
8658 		return;
8659 	}
8660 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8661 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8662 	chk->sent = SCTP_DATAGRAM_UNSENT;
8663 	chk->snd_count = 0;
8664 	chk->whoTo = net;
8665 	chk->whoTo->ref_count++;
8666 	cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8667 	cwr->ch.chunk_type = SCTP_ECN_CWR;
8668 	cwr->ch.chunk_flags = 0;
8669 	cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8670 	cwr->tsn = htonl(high_tsn);
8671 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8672 	asoc->ctrl_queue_cnt++;
8673 }
8674 static void
8675 sctp_reset_the_streams(struct sctp_tcb *stcb,
8676      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8677 {
8678 	int i;
8679 
8680 	if (req->reset_flags & SCTP_RESET_ALL) {
8681 		for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8682 			stcb->asoc.strmout[i].next_sequence_sent = 0;
8683 		}
8684 	} else if (number_entries) {
8685 		for (i=0; i<number_entries; i++) {
8686 			if (list[i] >= stcb->asoc.streamoutcnt) {
8687 				/* no such stream */
8688 				continue;
8689 			}
8690 			stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8691 		}
8692 	}
8693 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8694 }
8695 
8696 void
8697 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8698      struct sctp_stream_reset_request *req)
8699 {
8700 	struct sctp_association *asoc;
8701 	struct sctp_stream_reset_resp *strack;
8702 	struct sctp_tmit_chunk *chk;
8703 	uint32_t seq;
8704 	int number_entries, i;
8705 	uint8_t two_way=0, not_peer=0;
8706 	uint16_t *list=NULL;
8707 
8708 	asoc = &stcb->asoc;
8709 	if (req->reset_flags & SCTP_RESET_ALL)
8710 		number_entries = 0;
8711 	else
8712 		number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8713 
8714 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8715 	if (chk == NULL) {
8716 		return;
8717 	}
8718 	sctppcbinfo.ipi_count_chunk++;
8719 	sctppcbinfo.ipi_gencnt_chunk++;
8720 	chk->rec.chunk_id = SCTP_STREAM_RESET;
8721 	chk->asoc = &stcb->asoc;
8722 	chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8723 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8724 	if (chk->data == NULL) {
8725 	strresp_jump_out:
8726 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8727 		sctppcbinfo.ipi_count_chunk--;
8728 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8729 			panic("Chunk count is negative");
8730 		}
8731 		sctppcbinfo.ipi_gencnt_chunk++;
8732 		return;
8733 	}
8734 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8735 	chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8736 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8737 		MCLGET(chk->data, M_DONTWAIT);
8738 		if ((chk->data->m_flags & M_EXT) == 0) {
8739 			/* Give up */
8740 			sctp_m_freem(chk->data);
8741 			chk->data = NULL;
8742 			goto strresp_jump_out;
8743 		}
8744 		chk->data->m_data += SCTP_MIN_OVERHEAD;
8745 	}
8746 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8747 		/* can't do it, no room */
8748 		/* Give up */
8749 		sctp_m_freem(chk->data);
8750 		chk->data = NULL;
8751 		goto strresp_jump_out;
8752 
8753 	}
8754 	chk->sent = SCTP_DATAGRAM_UNSENT;
8755 	chk->snd_count = 0;
8756 	chk->whoTo = asoc->primary_destination;
8757 	chk->whoTo->ref_count++;
8758 	strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8759 
8760 	strack->ch.chunk_type = SCTP_STREAM_RESET;
8761 	strack->ch.chunk_flags = 0;
8762 	strack->ch.chunk_length = htons(chk->send_size);
8763 
8764 	memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8765 
8766 	strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8767 	strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8768 
8769 
8770 
8771 	if (chk->send_size % 4) {
8772 		/* need a padding for the end */
8773 		int pad;
8774 		uint8_t *end;
8775 		end = (uint8_t *)((vaddr_t)strack + chk->send_size);
8776 		pad = chk->send_size % 4;
8777 		for (i = 0; i < pad; i++) {
8778 			end[i] = 0;
8779 		}
8780 		chk->send_size += pad;
8781 	}
8782 
8783         /* actual response */
8784 	if (req->reset_flags & SCTP_RESET_YOUR) {
8785 		strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8786 	} else {
8787 		strack->sr_resp.reset_flags = 0;
8788 	}
8789 
8790 	/* copied from reset request */
8791 	strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8792 	seq = ntohl(req->reset_req_seq);
8793 
8794 	list = req->list_of_streams;
8795 	/* copy the un-converted network byte order streams */
8796 	for (i=0; i<number_entries; i++) {
8797 		strack->sr_resp.list_of_streams[i] = list[i];
8798 	}
8799 	if (asoc->str_reset_seq_in == seq) {
8800 		/* is it the next expected? */
8801 		asoc->str_reset_seq_in++;
8802 		strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8803 		asoc->str_reset_sending_seq = asoc->sending_seq;
8804 		if (number_entries) {
8805 			uint16_t temp;
8806 			/* convert them to host byte order */
8807 			for (i=0 ; i<number_entries; i++) {
8808 				temp = ntohs(list[i]);
8809 				list[i] = temp;
8810 			}
8811 		}
8812 		if (req->reset_flags & SCTP_RESET_YOUR) {
8813 			/* reset my outbound streams */
8814 			sctp_reset_the_streams(stcb, req , number_entries, list);
8815 		}
8816 		if (req->reset_flags & SCTP_RECIPRICAL) {
8817 			/* reset peer too */
8818 			sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
8819 		}
8820 
8821 	} else {
8822 		/* no its a retran so I must just ack and do nothing */
8823 		strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
8824 	}
8825 	strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
8826 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8827 			  chk,
8828 			  sctp_next);
8829 	asoc->ctrl_queue_cnt++;
8830 }
8831 
8832 
8833 void
8834 sctp_send_str_reset_req(struct sctp_tcb *stcb,
8835      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
8836 {
8837 	/* Send a stream reset request. The number_entrys may be 0 and list NULL
8838 	 * if the request is to reset all streams. If two_way is true then we
8839 	 * not only request a RESET of the received streams but we also
8840 	 * request the peer to send a reset req to us too.
8841 	 * Flag combinations in table:
8842 	 *
8843 	 *       two_way | not_peer  | = | Flags
8844 	 *       ------------------------------
8845 	 *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
8846 	 *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
8847 	 *         0     |    1      | = | Not a Valid Request (not anyone)
8848 	 *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
8849 	 */
8850 	struct sctp_association *asoc;
8851 	struct sctp_stream_reset_req *strreq;
8852 	struct sctp_tmit_chunk *chk;
8853 
8854 
8855 	asoc = &stcb->asoc;
8856 	if (asoc->stream_reset_outstanding) {
8857 		/* Already one pending, must get ACK back
8858 		 * to clear the flag.
8859 		 */
8860 		return;
8861 	}
8862 
8863 	if ((two_way == 0) && (not_peer == 1)) {
8864 		/* not a valid request */
8865 		return;
8866 	}
8867 
8868 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8869 	if (chk == NULL) {
8870 		return;
8871 	}
8872 	sctppcbinfo.ipi_count_chunk++;
8873 	sctppcbinfo.ipi_gencnt_chunk++;
8874 	chk->rec.chunk_id = SCTP_STREAM_RESET;
8875 	chk->asoc = &stcb->asoc;
8876 	chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
8877 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8878 	if (chk->data == NULL) {
8879 	strreq_jump_out:
8880 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8881 		sctppcbinfo.ipi_count_chunk--;
8882 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8883 			panic("Chunk count is negative");
8884 		}
8885 		sctppcbinfo.ipi_gencnt_chunk++;
8886 		return;
8887 	}
8888 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8889 	chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8890 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8891 		MCLGET(chk->data, M_DONTWAIT);
8892 		if ((chk->data->m_flags & M_EXT) == 0) {
8893 			/* Give up */
8894 			sctp_m_freem(chk->data);
8895 			chk->data = NULL;
8896 			goto strreq_jump_out;
8897 		}
8898 		chk->data->m_data += SCTP_MIN_OVERHEAD;
8899 	}
8900 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8901 		/* can't do it, no room */
8902 		/* Give up */
8903 		sctp_m_freem(chk->data);
8904 		chk->data = NULL;
8905 		goto strreq_jump_out;
8906 	}
8907 	chk->sent = SCTP_DATAGRAM_UNSENT;
8908 	chk->snd_count = 0;
8909 	chk->whoTo = asoc->primary_destination;
8910 	chk->whoTo->ref_count++;
8911 
8912 	strreq = mtod(chk->data, struct sctp_stream_reset_req *);
8913 	strreq->ch.chunk_type = SCTP_STREAM_RESET;
8914 	strreq->ch.chunk_flags = 0;
8915 	strreq->ch.chunk_length = htons(chk->send_size);
8916 
8917 	strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
8918 	strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8919 
8920 	if (chk->send_size % 4) {
8921 		/* need a padding for the end */
8922 		int pad, i;
8923 		uint8_t *end;
8924 		end = (uint8_t *)((vaddr_t)strreq + chk->send_size);
8925 		pad = chk->send_size % 4;
8926 		for (i=0; i<pad; i++) {
8927 			end[i] = 0;
8928 		}
8929 		chk->send_size += pad;
8930 	}
8931 
8932 	strreq->sr_req.reset_flags = 0;
8933 	if (number_entrys == 0) {
8934 		strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
8935 	}
8936 	if (two_way == 0) {
8937 		strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
8938 	} else {
8939 		if (not_peer == 0) {
8940 			strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
8941 		} else {
8942 			strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
8943 		}
8944 	}
8945 	memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
8946 	strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
8947 	if (number_entrys) {
8948 		/* populate the specific entry's */
8949 		int i;
8950 		for (i=0; i < number_entrys; i++) {
8951 			strreq->sr_req.list_of_streams[i] = htons(list[i]);
8952 		}
8953 	}
8954 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8955 			  chk,
8956 			  sctp_next);
8957 	asoc->ctrl_queue_cnt++;
8958 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
8959 	asoc->stream_reset_outstanding = 1;
8960 }
8961 
8962 void
8963 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
8964     struct mbuf *err_cause)
8965 {
8966 	/*
8967 	 * Formulate the abort message, and send it back down.
8968 	 */
8969 	struct mbuf *mout;
8970 	struct sctp_abort_msg *abm;
8971 	struct ip *iph, *iph_out;
8972 	struct ip6_hdr *ip6, *ip6_out;
8973 	int iphlen_out;
8974 
8975 	/* don't respond to ABORT with ABORT */
8976 	if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
8977 		if (err_cause)
8978 			sctp_m_freem(err_cause);
8979 		return;
8980 	}
8981 	MGETHDR(mout, M_DONTWAIT, MT_HEADER);
8982 	if (mout == NULL) {
8983 		if (err_cause)
8984 			sctp_m_freem(err_cause);
8985 		return;
8986 	}
8987 	iph = mtod(m, struct ip *);
8988 	iph_out = NULL;
8989 	ip6_out = NULL;
8990 	if (iph->ip_v == IPVERSION) {
8991 		iph_out = mtod(mout, struct ip *);
8992 		mout->m_len = sizeof(*iph_out) + sizeof(*abm);
8993 		mout->m_next = err_cause;
8994 
8995 		/* Fill in the IP header for the ABORT */
8996 		iph_out->ip_v = IPVERSION;
8997 		iph_out->ip_hl = (sizeof(struct ip) / 4);
8998 		iph_out->ip_tos = (u_char)0;
8999 		iph_out->ip_id = 0;
9000 		iph_out->ip_off = 0;
9001 		iph_out->ip_ttl = MAXTTL;
9002 		iph_out->ip_p = IPPROTO_SCTP;
9003 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9004 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9005 		/* let IP layer calculate this */
9006 		iph_out->ip_sum = 0;
9007 
9008 		iphlen_out = sizeof(*iph_out);
9009 		abm = (struct sctp_abort_msg *)((vaddr_t)iph_out + iphlen_out);
9010 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9011 		ip6 = (struct ip6_hdr *)iph;
9012 		ip6_out = mtod(mout, struct ip6_hdr *);
9013 		mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9014 		mout->m_next = err_cause;
9015 
9016 		/* Fill in the IP6 header for the ABORT */
9017 		ip6_out->ip6_flow = ip6->ip6_flow;
9018 		ip6_out->ip6_hlim = ip6_defhlim;
9019 		ip6_out->ip6_nxt = IPPROTO_SCTP;
9020 		ip6_out->ip6_src = ip6->ip6_dst;
9021 		ip6_out->ip6_dst = ip6->ip6_src;
9022 
9023 		iphlen_out = sizeof(*ip6_out);
9024 		abm = (struct sctp_abort_msg *)((vaddr_t)ip6_out + iphlen_out);
9025 	} else {
9026 		/* Currently not supported */
9027 		return;
9028 	}
9029 
9030 	abm->sh.src_port = sh->dest_port;
9031 	abm->sh.dest_port = sh->src_port;
9032 	abm->sh.checksum = 0;
9033 	if (vtag == 0) {
9034 		abm->sh.v_tag = sh->v_tag;
9035 		abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9036 	} else {
9037 		abm->sh.v_tag = htonl(vtag);
9038 		abm->msg.ch.chunk_flags = 0;
9039 	}
9040 	abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9041 
9042 	if (err_cause) {
9043 		struct mbuf *m_tmp = err_cause;
9044 		int err_len = 0;
9045 		/* get length of the err_cause chain */
9046 		while (m_tmp != NULL) {
9047 			err_len += m_tmp->m_len;
9048 			m_tmp = m_tmp->m_next;
9049 		}
9050 		mout->m_pkthdr.len = mout->m_len + err_len;
9051 		if (err_len % 4) {
9052 			/* need pad at end of chunk */
9053 			u_int32_t cpthis=0;
9054 			int padlen;
9055 			padlen = 4 - (mout->m_pkthdr.len % 4);
9056 			m_copyback(mout, mout->m_pkthdr.len, padlen, (void *)&cpthis);
9057 		}
9058 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9059 	} else {
9060 		mout->m_pkthdr.len = mout->m_len;
9061 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9062 	}
9063 
9064 	/* add checksum */
9065 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
9066 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
9067 		abm->sh.checksum =  0;
9068 	} else {
9069 		abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9070 	}
9071 
9072 	/* zap the rcvif, it should be null */
9073 	m_reset_rcvif(mout);
9074 	if (iph_out != NULL) {
9075 		struct route ro;
9076 
9077 		/* zap the stack pointer to the route */
9078 		memset(&ro, 0, sizeof ro);
9079 #ifdef SCTP_DEBUG
9080 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9081                         printf("sctp_send_abort calling ip_output:\n");
9082 			sctp_print_address_pkt(iph_out, &abm->sh);
9083                 }
9084 #endif
9085 		/* set IPv4 length */
9086 		iph_out->ip_len = htons(mout->m_pkthdr.len);
9087 		/* out it goes */
9088 		(void)ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
9089 	} else if (ip6_out != NULL) {
9090 		struct route ro;
9091 
9092 		/* zap the stack pointer to the route */
9093 		memset(&ro, 0, sizeof(ro));
9094 #ifdef SCTP_DEBUG
9095 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9096                         printf("sctp_send_abort calling ip6_output:\n");
9097 			sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9098                 }
9099 #endif
9100 		ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
9101 	}
9102         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9103 }
9104 
9105 void
9106 sctp_send_operr_to(struct mbuf *m, int iphlen,
9107 		   struct mbuf *scm,
9108 		   uint32_t vtag)
9109 {
9110 	struct sctphdr *ihdr;
9111 	struct sctphdr *ohdr;
9112 	struct sctp_chunkhdr *ophdr;
9113 
9114 	struct ip *iph;
9115 #ifdef SCTP_DEBUG
9116 	struct sockaddr_in6 lsa6, fsa6;
9117 #endif
9118 	uint32_t val;
9119 	iph = mtod(m, struct ip *);
9120 	ihdr = (struct sctphdr *)((vaddr_t)iph + iphlen);
9121 	if (!(scm->m_flags & M_PKTHDR)) {
9122 		/* must be a pkthdr */
9123 		printf("Huh, not a packet header in send_operr\n");
9124 		m_freem(scm);
9125 		return;
9126 	}
9127 	M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT);
9128 	if (scm == NULL) {
9129 		/* can't send because we can't add a mbuf */
9130 		return;
9131 	}
9132 	ohdr = mtod(scm, struct sctphdr *);
9133 	ohdr->src_port = ihdr->dest_port;
9134 	ohdr->dest_port = ihdr->src_port;
9135 	ohdr->v_tag = vtag;
9136 	ohdr->checksum = 0;
9137 	ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9138 	ophdr->chunk_type = SCTP_OPERATION_ERROR;
9139 	ophdr->chunk_flags = 0;
9140 	ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9141 	if (scm->m_pkthdr.len % 4) {
9142 		/* need padding */
9143 		u_int32_t cpthis=0;
9144 		int padlen;
9145 		padlen = 4 - (scm->m_pkthdr.len % 4);
9146 		m_copyback(scm, scm->m_pkthdr.len, padlen, (void *)&cpthis);
9147 	}
9148 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
9149 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
9150 		val = 0;
9151 	} else {
9152 		val = sctp_calculate_sum(scm, NULL, 0);
9153 	}
9154 	ohdr->checksum = val;
9155 	if (iph->ip_v == IPVERSION) {
9156 		/* V4 */
9157 		struct ip *out;
9158 		struct route ro;
9159 		M_PREPEND(scm, sizeof(struct ip), M_DONTWAIT);
9160 		if (scm == NULL)
9161 			return;
9162 		memset(&ro, 0, sizeof ro);
9163 		out = mtod(scm, struct ip *);
9164 		out->ip_v = iph->ip_v;
9165 		out->ip_hl = (sizeof(struct ip)/4);
9166 		out->ip_tos = iph->ip_tos;
9167 		out->ip_id = iph->ip_id;
9168 		out->ip_off = 0;
9169 		out->ip_ttl = MAXTTL;
9170 		out->ip_p = IPPROTO_SCTP;
9171 		out->ip_sum = 0;
9172 		out->ip_src = iph->ip_dst;
9173 		out->ip_dst = iph->ip_src;
9174 		out->ip_len = htons(scm->m_pkthdr.len);
9175 		ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
9176 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9177 	} else {
9178 		/* V6 */
9179 		struct route ro;
9180 		struct ip6_hdr *out6, *in6;
9181 
9182 		M_PREPEND(scm, sizeof(struct ip6_hdr), M_DONTWAIT);
9183 		if (scm == NULL)
9184 			return;
9185 		memset(&ro, 0, sizeof ro);
9186 		in6 = mtod(m, struct ip6_hdr *);
9187 		out6 = mtod(scm, struct ip6_hdr *);
9188 		out6->ip6_flow = in6->ip6_flow;
9189 		out6->ip6_hlim = ip6_defhlim;
9190 		out6->ip6_nxt = IPPROTO_SCTP;
9191 		out6->ip6_src = in6->ip6_dst;
9192 		out6->ip6_dst = in6->ip6_src;
9193 
9194 #ifdef SCTP_DEBUG
9195 		memset(&lsa6, 0, sizeof(lsa6));
9196 		lsa6.sin6_len = sizeof(lsa6);
9197 		lsa6.sin6_family = AF_INET6;
9198 		lsa6.sin6_addr = out6->ip6_src;
9199 		memset(&fsa6, 0, sizeof(fsa6));
9200 		fsa6.sin6_len = sizeof(fsa6);
9201 		fsa6.sin6_family = AF_INET6;
9202 		fsa6.sin6_addr = out6->ip6_dst;
9203 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9204 			printf("sctp_operr_to calling ipv6 output:\n");
9205 			printf("src: ");
9206 			sctp_print_address((struct sockaddr *)&lsa6);
9207 			printf("dst ");
9208 			sctp_print_address((struct sockaddr *)&fsa6);
9209 		}
9210 #endif /* SCTP_DEBUG */
9211 		ip6_output(scm, NULL, &ro, 0, NULL, NULL, NULL);
9212 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9213 	}
9214 }
9215 
9216 static int
9217 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9218 {
9219 	int left, cancpy, willcpy, error;
9220 	left = cpsz;
9221 
9222 	if (m == NULL) {
9223 		/* TSNH */
9224 		*mbcnt = 0;
9225 		return (ENOMEM);
9226 	}
9227 	m->m_len = 0;
9228 	if ((left+resv_upfront) > (int)MHLEN) {
9229 		MCLGET(m, M_WAIT);
9230 		if (m == NULL) {
9231 			*mbcnt = 0;
9232 			return (ENOMEM);
9233 		}
9234 		if ((m->m_flags & M_EXT) == 0) {
9235 			*mbcnt = 0;
9236 			return (ENOMEM);
9237 		}
9238 		*mbcnt += m->m_ext.ext_size;
9239 	}
9240 	*mbcnt += MSIZE;
9241 	cancpy = M_TRAILINGSPACE(m);
9242 	willcpy = uimin(cancpy, left);
9243 	if ((willcpy + resv_upfront) > cancpy) {
9244 		willcpy -= resv_upfront;
9245 	}
9246 	while (left > 0) {
9247 		/* Align data to the end */
9248 		if ((m->m_flags & M_EXT) == 0) {
9249 			m_align(m, willcpy);
9250 		} else {
9251 			MC_ALIGN(m, willcpy);
9252 		}
9253 		error = uiomove(mtod(m, void *), willcpy, uio);
9254 		if (error) {
9255 			return (error);
9256 		}
9257 		m->m_len = willcpy;
9258 		m->m_nextpkt = 0;
9259 		left -= willcpy;
9260 		if (left > 0) {
9261 			MGET(m->m_next, M_WAIT, MT_DATA);
9262 			if (m->m_next == NULL) {
9263 				*mbcnt = 0;
9264 				return (ENOMEM);
9265 			}
9266 			m = m->m_next;
9267 			m->m_len = 0;
9268 			*mbcnt += MSIZE;
9269 			if (left > (int)MHLEN) {
9270 				MCLGET(m, M_WAIT);
9271 				if (m == NULL) {
9272 					*mbcnt = 0;
9273 					return (ENOMEM);
9274 				}
9275 				if ((m->m_flags & M_EXT) == 0) {
9276 					*mbcnt = 0;
9277 					return (ENOMEM);
9278 				}
9279 				*mbcnt += m->m_ext.ext_size;
9280 			}
9281 			cancpy = M_TRAILINGSPACE(m);
9282 			willcpy = uimin(cancpy, left);
9283 		}
9284 	}
9285 	return (0);
9286 }
9287 
9288 static int
9289 sctp_copy_it_in(struct sctp_inpcb *inp,
9290 		struct sctp_tcb *stcb,
9291 		struct sctp_association *asoc,
9292 		struct sctp_nets *net,
9293 		struct sctp_sndrcvinfo *srcv,
9294 		struct uio *uio,
9295 		int flags)
9296 {
9297 	/* This routine must be very careful in
9298 	 * its work. Protocol processing is
9299 	 * up and running so care must be taken to
9300 	 * spl...() when you need to do something
9301 	 * that may effect the stcb/asoc. The sb is
9302 	 * locked however. When data is copied the
9303 	 * protocol processing should be enabled since
9304 	 * this is a slower operation...
9305 	 */
9306 	struct socket *so;
9307 	int error = 0;
9308 	int frag_size, mbcnt = 0, mbcnt_e = 0;
9309 	unsigned int sndlen;
9310 	unsigned int tot_demand;
9311 	int tot_out, dataout;
9312 	struct sctp_tmit_chunk *chk;
9313 	struct mbuf *mm;
9314 	struct sctp_stream_out *strq;
9315 	uint32_t my_vtag;
9316 	int resv_in_first;
9317 
9318 	so = stcb->sctp_socket;
9319 	solock(so);
9320 	chk = NULL;
9321 	mm = NULL;
9322 
9323 	sndlen = uio->uio_resid;
9324 	/* lock the socket buf */
9325 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
9326 	if (error)
9327 		goto out_locked;
9328 
9329 #ifdef SCTP_DEBUG
9330 	printf("sctp_copy_it_in: %d\n", sndlen);
9331 #endif
9332 	/* will it ever fit ? */
9333 	if (sndlen > so->so_snd.sb_hiwat) {
9334 		/* It will NEVER fit */
9335 		error = EMSGSIZE;
9336 		goto release;
9337 	}
9338 	/* Do I need to block? */
9339 	if ((so->so_snd.sb_hiwat <
9340 	    (sndlen + asoc->total_output_queue_size)) ||
9341 	    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9342 	    (asoc->total_output_mbuf_queue_size >
9343 	    so->so_snd.sb_mbmax)
9344 	) {
9345 		/* prune any prsctp bufs out */
9346 		if (asoc->peer_supports_prsctp) {
9347 			sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9348 		}
9349 		/*
9350 		 * We store off a pointer to the endpoint.
9351 		 * Since on return from this we must check to
9352 		 * see if an so_error is set. If so we may have
9353 		 * been reset and our stcb destroyed. Returning
9354 		 * an error will flow back to the user...
9355 		 */
9356 		while ((so->so_snd.sb_hiwat <
9357 		    (sndlen + asoc->total_output_queue_size)) ||
9358 		    (asoc->chunks_on_out_queue >
9359 		    sctp_max_chunks_on_queue) ||
9360 		    (asoc->total_output_mbuf_queue_size >
9361 		    so->so_snd.sb_mbmax)
9362 		) {
9363 			if ((so->so_state & SS_NBIO)
9364 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
9365 			    || (flags & MSG_NBIO)
9366 #endif
9367 				) {
9368 				/* Non-blocking io in place */
9369 				error = EWOULDBLOCK;
9370 				goto release;
9371 			}
9372 			inp->sctp_tcb_at_block = (void *)stcb;
9373 			inp->error_on_block = 0;
9374 #ifdef SCTP_BLK_LOGGING
9375 			sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9376 			    so, asoc);
9377 #endif
9378 			sbunlock(&so->so_snd);
9379 			SCTP_TCB_UNLOCK(stcb);
9380 			error = sbwait(&so->so_snd);
9381 			SCTP_INP_RLOCK(inp);
9382 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9383 			    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9384 				/* Should I really unlock ? */
9385 				SCTP_INP_RUNLOCK(inp);
9386 				error = EFAULT;
9387 				goto out_locked;
9388 			}
9389 			SCTP_TCB_LOCK(stcb);
9390 			SCTP_INP_RUNLOCK(inp);
9391 
9392 			inp->sctp_tcb_at_block = 0;
9393 #ifdef SCTP_BLK_LOGGING
9394 			sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9395 			    so, asoc);
9396 #endif
9397 			if (inp->error_on_block) {
9398 				/*
9399 				 * if our asoc was killed, the free code
9400 				 * (in sctp_pcb.c) will save a error in
9401 				 * here for us
9402 				 */
9403  				error = inp->error_on_block;
9404 				goto out_locked;
9405 			}
9406 			if (error) {
9407 				goto out_locked;
9408 			}
9409 			/* did we encounter a socket error? */
9410 			if (so->so_error) {
9411 				error = so->so_error;
9412 				goto out_locked;
9413 			}
9414 			error = sblock(&so->so_snd, M_WAITOK);
9415 			if (error) {
9416 				/* Can't acquire the lock */
9417 				goto out_locked;
9418 			}
9419 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9420 			if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9421 #else
9422 			if (so->so_state & SS_CANTSENDMORE) {
9423 #endif
9424 				/* The socket is now set not to sendmore.. its gone */
9425 				error = EPIPE;
9426 				goto release;
9427 			}
9428 			if (so->so_error) {
9429 				error = so->so_error;
9430 				goto release;
9431 			}
9432 			if (asoc->peer_supports_prsctp) {
9433 				sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9434 			}
9435 		}
9436 	}
9437 	dataout = tot_out = uio->uio_resid;
9438  	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9439 		resv_in_first = SCTP_MED_OVERHEAD;
9440 	} else {
9441 		resv_in_first = SCTP_MED_V4_OVERHEAD;
9442 	}
9443 
9444 	/* Are we aborting? */
9445 	if (srcv->sinfo_flags & SCTP_ABORT) {
9446 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9447 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9448 			/* It has to be up before we abort */
9449 			/* how big is the user initiated abort? */
9450 
9451 			/* I wonder about doing a MGET without a splnet set.
9452 			 * it is done that way in the sosend code so I guess
9453 			 * it is ok :-0
9454 			 */
9455  			MGETHDR(mm, M_WAIT, MT_DATA);
9456 			if (mm) {
9457 				struct sctp_paramhdr *ph;
9458 
9459 				tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9460 				if (tot_demand > MHLEN) {
9461 					if (tot_demand > MCLBYTES) {
9462 						/* truncate user data */
9463 						tot_demand = MCLBYTES;
9464 						tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9465 					}
9466 					MCLGET(mm, M_WAIT);
9467 					if ((mm->m_flags & M_EXT) == 0) {
9468 						/* truncate further */
9469 						tot_demand = MHLEN;
9470 						tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9471 					}
9472 				}
9473 				/* now move forward the data pointer */
9474 				ph = mtod(mm, struct sctp_paramhdr *);
9475 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9476 				ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9477 				ph++;
9478 				mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9479 				mm->m_len = mm->m_pkthdr.len;
9480 				error = uiomove((void *)ph, (int)tot_out, uio);
9481 				if (error) {
9482 					/*
9483 					 * Here if we can't get his data we
9484 					 * still abort we just don't get to
9485 					 * send the users note :-0
9486 					 */
9487 					sctp_m_freem(mm);
9488 					mm = NULL;
9489 				}
9490 			}
9491 			sbunlock(&so->so_snd);
9492 			sctp_abort_an_association(stcb->sctp_ep, stcb,
9493 						  SCTP_RESPONSE_TO_USER_REQ,
9494 						  mm);
9495 			mm = NULL;
9496 			goto out_locked;
9497 		}
9498 		goto release;
9499 	}
9500 
9501 	/* Now can we send this? */
9502 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9503 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9504 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9505 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9506 		/* got data while shutting down */
9507 		error = ECONNRESET;
9508 		goto release;
9509  	}
9510  	/* Is the stream no. valid? */
9511 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9512  		/* Invalid stream number */
9513 		error = EINVAL;
9514 		goto release;
9515  	}
9516 	if (asoc->strmout == NULL) {
9517 		/* huh? software error */
9518 #ifdef SCTP_DEBUG
9519  		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9520  			printf("software error in sctp_copy_it_in\n");
9521  		}
9522 #endif
9523 		error = EFAULT;
9524 		goto release;
9525 	}
9526 	if ((srcv->sinfo_flags & SCTP_EOF) &&
9527 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9528 	    (tot_out == 0)) {
9529 		sounlock(so);
9530 		goto zap_by_it_now;
9531 	}
9532  	if (tot_out == 0) {
9533  		/* not allowed */
9534  		error = EMSGSIZE;
9535 		goto release;
9536  	}
9537 	/* save off the tag */
9538 	my_vtag = asoc->my_vtag;
9539 	strq = &asoc->strmout[srcv->sinfo_stream];
9540 	/* First lets figure out the "chunking" point */
9541 	frag_size = sctp_get_frag_point(stcb, asoc);
9542 
9543 	/* two choices here, it all fits in one chunk or
9544 	 * we need multiple chunks.
9545 	 */
9546 	sounlock(so);
9547 	if (tot_out <= frag_size) {
9548 		/* no need to setup a template */
9549 		chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9550 		if (chk == NULL) {
9551 			error = ENOMEM;
9552 			goto release;
9553 		}
9554 		sctppcbinfo.ipi_count_chunk++;
9555 		sctppcbinfo.ipi_gencnt_chunk++;
9556 		asoc->chunks_on_out_queue++;
9557 		MGETHDR(mm, M_WAIT, MT_DATA);
9558 		if (mm == NULL) {
9559 			error = ENOMEM;
9560 			goto clean_up;
9561 		}
9562 		error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9563 		if (error)
9564 			goto clean_up;
9565 		sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9566 		chk->mbcnt = mbcnt_e;
9567 		mbcnt += mbcnt_e;
9568 		mbcnt_e = 0;
9569 		mm->m_pkthdr.len = tot_out;
9570 		chk->data = mm;
9571 		mm = NULL;
9572 
9573 		/* the actual chunk flags */
9574 		chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9575 		chk->whoTo->ref_count++;
9576 
9577 		/* fix up the send_size if it is not present */
9578 		chk->send_size = tot_out;
9579 		chk->book_size = chk->send_size;
9580 		/* ok, we are committed */
9581 		if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
9582 			/* bump the ssn if we are unordered. */
9583 			strq->next_sequence_sent++;
9584 		}
9585 		if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9586 			asoc->sent_queue_cnt_removeable++;
9587 		}
9588 		solock(so);
9589 		if ((asoc->state == 0) ||
9590 		    (my_vtag != asoc->my_vtag) ||
9591 		    (so != inp->sctp_socket) ||
9592 		    (inp->sctp_socket == 0)) {
9593 			/* connection was aborted */
9594 			sounlock(so);
9595 			error = ECONNRESET;
9596 			goto clean_up;
9597 		}
9598 		asoc->stream_queue_cnt++;
9599 		TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9600 		/* now check if this stream is on the wheel */
9601 		if ((strq->next_spoke.tqe_next == NULL) &&
9602 		    (strq->next_spoke.tqe_prev == NULL)) {
9603 			/* Insert it on the wheel since it is not
9604 			 * on it currently
9605 			 */
9606 			sctp_insert_on_wheel(asoc, strq);
9607 		}
9608 		sounlock(so);
9609 clean_up:
9610 		if (error) {
9611 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9612 			sctppcbinfo.ipi_count_chunk--;
9613 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9614 				panic("Chunk count is negative");
9615 			}
9616 			goto release;
9617 		}
9618 	} else {
9619 		/* we need to setup a template */
9620 		struct sctp_tmit_chunk template;
9621 		struct sctpchunk_listhead tmp;
9622 
9623 		/* setup the template */
9624 		sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9625 
9626 		/* Prepare the temp list */
9627 		TAILQ_INIT(&tmp);
9628 
9629 		/* Template is complete, now time for the work */
9630 		while (tot_out > 0) {
9631 			/* Get a chunk */
9632  			chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9633 			if (chk == NULL) {
9634 				/*
9635 				 * ok we must spin through and dump anything
9636 				 * we have allocated and then jump to the
9637 				 * no_membad
9638 				 */
9639 				error = ENOMEM;
9640 			}
9641 			sctppcbinfo.ipi_count_chunk++;
9642 			asoc->chunks_on_out_queue++;
9643 
9644 			sctppcbinfo.ipi_gencnt_chunk++;
9645 			*chk = template;
9646 			chk->whoTo->ref_count++;
9647 			MGETHDR(chk->data, M_WAIT, MT_DATA);
9648 			if (chk->data == NULL) {
9649 				error = ENOMEM;
9650 				goto temp_clean_up;
9651 			}
9652 			tot_demand = uimin(tot_out, frag_size);
9653 			error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9654 			if (error)
9655 				goto temp_clean_up;
9656 			/* now fix the chk->send_size */
9657 			chk->mbcnt = mbcnt_e;
9658 			mbcnt += mbcnt_e;
9659 			mbcnt_e = 0;
9660 			chk->send_size = tot_demand;
9661 			chk->data->m_pkthdr.len = tot_demand;
9662 			chk->book_size = chk->send_size;
9663 			if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9664 				asoc->sent_queue_cnt_removeable++;
9665 			}
9666 			TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9667 			tot_out -= tot_demand;
9668 		}
9669 		/* Now the tmp list holds all chunks and data */
9670 		if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
9671 			/* bump the ssn if we are unordered. */
9672 			strq->next_sequence_sent++;
9673 		}
9674 		/* Mark the first/last flags. This will
9675 		 * result int a 3 for a single item on the list
9676 		 */
9677 		chk = TAILQ_FIRST(&tmp);
9678 		chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9679 		chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9680 		chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9681 
9682 		/* now move it to the streams actual queue */
9683 		/* first stop protocol processing */
9684 		mutex_enter(softnet_lock);
9685 		if ((asoc->state == 0) ||
9686 		    (my_vtag != asoc->my_vtag) ||
9687 		    (so != inp->sctp_socket) ||
9688 		    (inp->sctp_socket == 0)) {
9689 			/* connection was aborted */
9690 			mutex_exit(softnet_lock);
9691 			error = ECONNRESET;
9692 			goto temp_clean_up;
9693 		}
9694 		chk = TAILQ_FIRST(&tmp);
9695 		while (chk) {
9696 			chk->data->m_nextpkt = 0;
9697 			TAILQ_REMOVE(&tmp, chk, sctp_next);
9698 			asoc->stream_queue_cnt++;
9699 			TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9700 			chk = TAILQ_FIRST(&tmp);
9701 		}
9702 		/* now check if this stream is on the wheel */
9703 		if ((strq->next_spoke.tqe_next == NULL) &&
9704 		    (strq->next_spoke.tqe_prev == NULL)) {
9705 			/* Insert it on the wheel since it is not
9706 			 * on it currently
9707 			 */
9708 			sctp_insert_on_wheel(asoc, strq);
9709 		}
9710 		/* Ok now we can allow pping */
9711 		mutex_exit(softnet_lock);
9712 temp_clean_up:
9713 		if (error) {
9714 			chk = TAILQ_FIRST(&tmp);
9715 			while (chk) {
9716 				if (chk->data) {
9717 					sctp_m_freem(chk->data);
9718 					chk->data = NULL;
9719 				}
9720 				TAILQ_REMOVE(&tmp, chk, sctp_next);
9721 				SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9722 				sctppcbinfo.ipi_count_chunk--;
9723 				asoc->chunks_on_out_queue--;
9724 				if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9725 					panic("Chunk count is negative");
9726 				}
9727 				sctppcbinfo.ipi_gencnt_chunk++;
9728 				chk = TAILQ_FIRST(&tmp);
9729 			}
9730 			goto release;
9731 		}
9732 	}
9733 zap_by_it_now:
9734 #ifdef SCTP_MBCNT_LOGGING
9735 	sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9736 		       asoc->total_output_queue_size,
9737 		       dataout,
9738 		       asoc->total_output_mbuf_queue_size,
9739 		       mbcnt);
9740 #endif
9741 	solock(so);
9742 	asoc->total_output_queue_size += dataout;
9743 	asoc->total_output_mbuf_queue_size += mbcnt;
9744 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
9745 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
9746 		so->so_snd.sb_cc += dataout;
9747 		so->so_snd.sb_mbcnt += mbcnt;
9748 	}
9749 	if ((srcv->sinfo_flags & SCTP_EOF) &&
9750 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
9751 		) {
9752 		int some_on_streamwheel = 0;
9753 		error = 0;
9754 		if (!TAILQ_EMPTY(&asoc->out_wheel)) {
9755 			/* Check to see if some data queued */
9756 			struct sctp_stream_out *outs;
9757 			TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
9758 				if (!TAILQ_EMPTY(&outs->outqueue)) {
9759 					some_on_streamwheel = 1;
9760 					break;
9761 				}
9762 			}
9763 		}
9764 		if (TAILQ_EMPTY(&asoc->send_queue) &&
9765 		    TAILQ_EMPTY(&asoc->sent_queue) &&
9766 		    (some_on_streamwheel == 0)) {
9767 			/* there is nothing queued to send, so I'm done... */
9768 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
9769 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
9770 				/* only send SHUTDOWN the first time through */
9771 #ifdef SCTP_DEBUG
9772 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
9773 					printf("%s:%d sends a shutdown\n",
9774 					       __FILE__,
9775 					       __LINE__
9776 						);
9777 				}
9778 #endif
9779 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
9780 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
9781 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
9782 						 asoc->primary_destination);
9783 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
9784 						 asoc->primary_destination);
9785 			}
9786 		} else {
9787 			/*
9788 			 * we still got (or just got) data to send, so set
9789 			 * SHUTDOWN_PENDING
9790 			 */
9791 			/*
9792 			 * XXX sockets draft says that SCTP_EOF should be sent
9793 			 * with no data.  currently, we will allow user data
9794 			 * to be sent first and move to SHUTDOWN-PENDING
9795 			 */
9796 			asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
9797 		}
9798 	}
9799 #ifdef SCTP_DEBUG
9800 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9801 		printf("++total out:%d total_mbuf_out:%d\n",
9802 		       (int)asoc->total_output_queue_size,
9803 		       (int)asoc->total_output_mbuf_queue_size);
9804 	}
9805 #endif
9806 
9807 release:
9808 	sbunlock(&so->so_snd);
9809 out_locked:
9810 	sounlock(so);
9811 
9812 	if (mm)
9813 		sctp_m_freem(mm);
9814 	return (error);
9815 }
9816 
9817 
9818 int
9819 sctp_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
9820 	    struct mbuf *top, struct mbuf *control, int flags, struct lwp *p)
9821 {
9822 	int error, use_rcvinfo;
9823 	int queue_only = 0, queue_only_for_init=0;
9824 	int un_sent = 0;
9825 	int now_filled=0;
9826 	struct sctp_inpcb *inp;
9827  	struct sctp_tcb *stcb=NULL;
9828 	struct sctp_sndrcvinfo srcv;
9829 	struct timeval now;
9830 	struct sctp_nets *net;
9831 	struct sctp_association *asoc;
9832 	struct sctp_inpcb *t_inp;
9833 	int create_lock_applied = 0;
9834 
9835 	error = use_rcvinfo = 0;
9836 	net = NULL;
9837 	stcb = NULL;
9838 	asoc = NULL;
9839 	t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
9840 
9841 	solock(so);
9842 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
9843 	    (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
9844 		/* The listner can NOT send */
9845 		error = EFAULT;
9846 		sounlock(so);
9847 		goto out;
9848 	}
9849 	if (addr) {
9850 		SCTP_ASOC_CREATE_LOCK(inp);
9851 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9852 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9853 			/* Should I really unlock ? */
9854 			error = EFAULT;
9855 			sounlock(so);
9856 			goto out;
9857 
9858 		}
9859 		create_lock_applied = 1;
9860 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
9861 		    (addr->sa_family == AF_INET6)) {
9862 			error = EINVAL;
9863 			sounlock(so);
9864 			goto out;
9865 		}
9866 	}
9867 	/* now we must find the assoc */
9868 	if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
9869 		SCTP_INP_RLOCK(inp);
9870 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
9871 		if (stcb == NULL) {
9872 			SCTP_INP_RUNLOCK(inp);
9873 			error = ENOTCONN;
9874 			sounlock(so);
9875 			goto out;
9876 		}
9877 		SCTP_TCB_LOCK(stcb);
9878 		SCTP_INP_RUNLOCK(inp);
9879 		net = stcb->asoc.primary_destination;
9880 	}
9881 #ifdef SCTP_DEBUG
9882 	printf("sctp_sosend: get control\n");
9883 #endif
9884 	/* get control */
9885 	if (control) {
9886 		/* process cmsg snd/rcv info (maybe a assoc-id) */
9887 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
9888 				   sizeof(srcv))) {
9889 			/* got one */
9890 			if (srcv.sinfo_flags & SCTP_SENDALL) {
9891 				/* its a sendall */
9892 				sctppcbinfo.mbuf_track--;
9893 				sctp_m_freem(control);
9894 
9895 				if (create_lock_applied) {
9896 					SCTP_ASOC_CREATE_UNLOCK(inp);
9897 					create_lock_applied = 0;
9898 				}
9899 				return (sctp_sendall(inp, uio, top, &srcv));
9900 			}
9901 			use_rcvinfo = 1;
9902 		}
9903 	}
9904 #ifdef SCTP_DEBUG
9905 	printf("sctp_sosend: doing lookup\n");
9906 #endif
9907 	if (stcb == NULL) {
9908 		/* Need to do a lookup */
9909 		if (use_rcvinfo && srcv.sinfo_assoc_id) {
9910 			stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
9911 			/*
9912 			 * Question: Should I error here if the assoc_id is
9913 			 * no longer valid? i.e. I can't find it?
9914 			 */
9915 			if ((stcb) &&
9916 			    (addr != NULL)) {
9917 				/* Must locate the net structure */
9918 				net = sctp_findnet(stcb, addr);
9919 			}
9920 		}
9921 		if (stcb == NULL) {
9922 			if (addr != NULL) {
9923 				/* Since we did not use findep we must
9924 				 * increment it, and if we don't find a
9925 				 * tcb decrement it.
9926 				 */
9927 				SCTP_INP_WLOCK(inp);
9928 				SCTP_INP_INCR_REF(inp);
9929 				SCTP_INP_WUNLOCK(inp);
9930 				stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
9931 				if (stcb == NULL) {
9932 					SCTP_INP_WLOCK(inp);
9933 					SCTP_INP_DECR_REF(inp);
9934 					SCTP_INP_WUNLOCK(inp);
9935 				}
9936 			}
9937 		}
9938 	}
9939 	if ((stcb == NULL) &&
9940 	    (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
9941 		error = ENOTCONN;
9942 		sounlock(so);
9943 		goto out;
9944 	} else if ((stcb == NULL) && (addr == NULL)) {
9945 		error = ENOENT;
9946 		sounlock(so);
9947 		goto out;
9948 	} else if (stcb == NULL) {
9949 		/* UDP style, we must go ahead and start the INIT process */
9950 		if ((use_rcvinfo) &&
9951 		    (srcv.sinfo_flags & SCTP_ABORT)) {
9952 			/* User asks to abort a non-existent asoc */
9953 			error = ENOENT;
9954 			sounlock(so);
9955 			goto out;
9956 		}
9957 		/* get an asoc/stcb struct */
9958 		stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
9959 		if (stcb == NULL) {
9960 			/* Error is setup for us in the call */
9961 			sounlock(so);
9962 			goto out;
9963 		}
9964 		if (create_lock_applied) {
9965 			SCTP_ASOC_CREATE_UNLOCK(inp);
9966 			create_lock_applied = 0;
9967 		} else {
9968 			printf("Huh-3? create lock should have been on??\n");
9969 		}
9970 		/* Turn on queue only flag to prevent data from being sent */
9971  		queue_only = 1;
9972 		asoc = &stcb->asoc;
9973 		asoc->state = SCTP_STATE_COOKIE_WAIT;
9974 		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
9975 		if (control) {
9976 			/* see if a init structure exists in cmsg headers */
9977 			struct sctp_initmsg initm;
9978 			int i;
9979 			if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
9980 				/* we have an INIT override of the default */
9981 				if (initm.sinit_max_attempts)
9982 					asoc->max_init_times = initm.sinit_max_attempts;
9983 				if (initm.sinit_num_ostreams)
9984 					asoc->pre_open_streams = initm.sinit_num_ostreams;
9985 				if (initm.sinit_max_instreams)
9986 					asoc->max_inbound_streams = initm.sinit_max_instreams;
9987 				if (initm.sinit_max_init_timeo)
9988 					asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
9989 				if (asoc->streamoutcnt < asoc->pre_open_streams) {
9990 					/* Default is NOT correct */
9991 #ifdef SCTP_DEBUG
9992 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9993 						printf("Ok, defout:%d pre_open:%d\n",
9994 						       asoc->streamoutcnt, asoc->pre_open_streams);
9995 					}
9996 #endif
9997 					free(asoc->strmout, M_PCB);
9998 					asoc->strmout = NULL;
9999 					asoc->streamoutcnt = asoc->pre_open_streams;
10000 
10001 					/* What happesn if this fails? .. we panic ...*/
10002 					asoc->strmout = malloc(
10003 					       asoc->streamoutcnt *
10004 					       sizeof(struct sctp_stream_out),
10005 					       M_PCB, M_WAIT);
10006 					for (i = 0; i < asoc->streamoutcnt; i++) {
10007 						/*
10008 						 * inbound side must be set to 0xffff,
10009 						 * also NOTE when we get the INIT-ACK
10010 						 * back (for INIT sender) we MUST
10011 						 * reduce the count (streamoutcnt) but
10012 						 * first check if we sent to any of the
10013 						 * upper streams that were dropped (if
10014 						 * some were). Those that were dropped
10015 						 * must be notified to the upper layer
10016 						 * as failed to send.
10017 						 */
10018 						asoc->strmout[i].next_sequence_sent = 0x0;
10019 						TAILQ_INIT(&asoc->strmout[i].outqueue);
10020 						asoc->strmout[i].stream_no = i;
10021 						asoc->strmout[i].next_spoke.tqe_next = 0;
10022 						asoc->strmout[i].next_spoke.tqe_prev = 0;
10023 					}
10024 				}
10025 			}
10026 
10027 		}
10028 		/* out with the INIT */
10029 		queue_only_for_init = 1;
10030 		sctp_send_initiate(inp, stcb);
10031 		/*
10032 		 * we may want to dig in after this call and adjust the MTU
10033 		 * value. It defaulted to 1500 (constant) but the ro structure
10034 		 * may now have an update and thus we may need to change it
10035 		 * BEFORE we append the message.
10036 		 */
10037 		net = stcb->asoc.primary_destination;
10038 		asoc = &stcb->asoc;
10039 	} else {
10040 		asoc = &stcb->asoc;
10041 	}
10042 	if (create_lock_applied) {
10043 		SCTP_ASOC_CREATE_UNLOCK(inp);
10044 		create_lock_applied = 0;
10045 	}
10046 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10047 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10048 		queue_only = 1;
10049 	}
10050 	if (use_rcvinfo == 0) {
10051 		/* Grab the default stuff from the asoc */
10052 		srcv = stcb->asoc.def_send;
10053 	}
10054 	/* we are now done with all control */
10055 	if (control) {
10056 		sctp_m_freem(control);
10057 		control = NULL;
10058 	}
10059 
10060 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10061 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10062 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10063 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10064 		if ((use_rcvinfo) &&
10065 		    (srcv.sinfo_flags & SCTP_ABORT)) {
10066 			;
10067 		} else {
10068 			error = ECONNRESET;
10069 			sounlock(so);
10070 			goto out;
10071 		}
10072 	}
10073 	/* Ok, we will attempt a msgsnd :> */
10074 #if 0	/* XXX */
10075 	if (p)
10076 		p->p_stats->p_ru.ru_msgsnd++;
10077 #endif
10078 
10079 	if (stcb) {
10080 		if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) {
10081 			/* we take the override or the unconfirmed */
10082 			;
10083 		} else {
10084 			net = stcb->asoc.primary_destination;
10085 		}
10086 	}
10087 
10088 #ifdef SCTP_DEBUG
10089 	printf("sctp_sosend: before copying in %p\n", top);
10090 #endif
10091 	if (top == NULL) {
10092 		/* Must copy it all in from user land. The
10093 		 * socket buf is locked but we don't suspend
10094 		 * protocol processing until we are ready to
10095 		 * send/queue it.
10096 		 */
10097 		sounlock(so);
10098 #ifdef SCTP_DEBUG
10099 		printf("sctp_sosend: before cii\n");
10100 #endif
10101 		error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10102 #ifdef SCTP_DEBUG
10103 		printf("sctp_sosend: after cii\n");
10104 #endif
10105 		if (error)
10106 			goto out;
10107 	} else {
10108 		/* Here we must either pull in the user data to chunk
10109 		 * buffers, or use top to do a msg_append.
10110 		 */
10111  		error = sctp_msg_append(stcb, net, top, &srcv, flags);
10112 		sounlock(so);
10113 		if (error)
10114 			goto out;
10115 		/* zap the top since it is now being used */
10116 		top = 0;
10117 	}
10118 #ifdef SCTP_DEBUG
10119 	printf("sctp_sosend: after copying in\n");
10120 #endif
10121 	if (net->flight_size > net->cwnd) {
10122 		sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10123 		queue_only = 1;
10124 
10125 	} else if (asoc->ifp_had_enobuf) {
10126 		sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10127 		queue_only = 1;
10128  	} else {
10129 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10130 			   ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10131 			   SCTP_MED_OVERHEAD);
10132 
10133 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10134 		    (stcb->asoc.total_flight > 0) &&
10135 		    (un_sent < (int)stcb->asoc.smallest_mtu)) {
10136 
10137 			/* Ok, Nagle is set on and we have data outstanding. Don't
10138 			 * send anything and let SACKs drive out the data unless we
10139 			 * have a "full" segment to send.
10140 			 */
10141 			sctp_pegs[SCTP_NAGLE_NOQ]++;
10142 			queue_only = 1;
10143 		} else {
10144 			sctp_pegs[SCTP_NAGLE_OFF]++;
10145 		}
10146 	}
10147 	if (queue_only_for_init) {
10148 		/* It is possible to have a turn around of the
10149 		 * INIT/INIT-ACK/COOKIE before I have a chance to
10150 		 * copy in the data. In such a case I DO want to
10151 		 * send it out by reversing the queue only flag.
10152 		 */
10153 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10154 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10155 			/* yep, reverse it */
10156 			queue_only = 0;
10157 		}
10158  	}
10159 
10160 #ifdef SCTP_DEBUG
10161 	printf("sctp_sosend: before sending chunk\n");
10162 #endif
10163 	if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10164 		/* we can attempt to send too.*/
10165 #ifdef SCTP_DEBUG
10166 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10167 			printf("USR Send calls sctp_chunk_output\n");
10168 		}
10169 #endif
10170 		solock(so);
10171 		sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10172 		sctp_chunk_output(inp, stcb, 0);
10173 		sounlock(so);
10174 	} else if ((queue_only == 0) &&
10175 		   (stcb->asoc.peers_rwnd == 0) &&
10176 		   (stcb->asoc.total_flight == 0)) {
10177 		/* We get to have a probe outstanding */
10178 		solock(so);
10179 		sctp_from_user_send = 1;
10180 		sctp_chunk_output(inp, stcb, 0);
10181 		sctp_from_user_send = 0;
10182 		sounlock(so);
10183 
10184 	} else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10185 		int num_out, reason, cwnd_full;
10186 		/* Here we do control only */
10187 		solock(so);
10188 		sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10189 				      &reason, 1, &cwnd_full, 1, &now, &now_filled);
10190 		sounlock(so);
10191 	}
10192 #ifdef SCTP_DEBUG
10193 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10194 		printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10195 		       queue_only, stcb->asoc.peers_rwnd, un_sent,
10196 		       stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10197 		       stcb->asoc.total_output_queue_size);
10198 	}
10199 #endif
10200  out:
10201 	if (create_lock_applied) {
10202 		SCTP_ASOC_CREATE_UNLOCK(inp);
10203 		create_lock_applied = 0;
10204 	}
10205 	if (stcb) {
10206 		SCTP_TCB_UNLOCK(stcb);
10207 	}
10208 	if (top)
10209 		sctp_m_freem(top);
10210 	if (control)
10211 		sctp_m_freem(control);
10212 	return (error);
10213 }
10214