xref: /netbsd-src/sys/netinet/sctp_output.c (revision e89934bbf778a6d6d6894877c4da59d0c7835b0f)
1 /*	$NetBSD: sctp_output.c,v 1.9 2016/12/23 11:11:28 maya Exp $ */
2 /*	$KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 #include <sys/cdefs.h>
33 __KERNEL_RCSID(0, "$NetBSD: sctp_output.c,v 1.9 2016/12/23 11:11:28 maya Exp $");
34 
35 #ifdef _KERNEL_OPT
36 #include "opt_ipsec.h"
37 #include "opt_inet.h"
38 #include "opt_sctp.h"
39 #endif /* _KERNEL_OPT */
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/domain.h>
46 #include <sys/protosw.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/proc.h>
50 #include <sys/kernel.h>
51 #include <sys/sysctl.h>
52 #include <sys/resourcevar.h>
53 #include <sys/uio.h>
54 #ifdef INET6
55 #include <sys/domain.h>
56 #endif
57 
58 #include <machine/limits.h>
59 #include <machine/cpu.h>
60 
61 #include <net/if.h>
62 #include <net/if_types.h>
63 
64 #include <net/route.h>
65 
66 #include <netinet/in.h>
67 #include <netinet/in_systm.h>
68 #include <netinet/ip.h>
69 #include <netinet/in_pcb.h>
70 #include <netinet/in_var.h>
71 #include <netinet/ip_var.h>
72 
73 #ifdef INET6
74 #include <netinet/ip6.h>
75 #include <netinet6/ip6_var.h>
76 #include <netinet6/scope6_var.h>
77 #include <netinet6/nd6.h>
78 
79 #include <netinet6/in6_pcb.h>
80 
81 #include <netinet/icmp6.h>
82 
83 #endif /* INET6 */
84 
85 #include <net/net_osdep.h>
86 
87 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__)
88 #ifndef in6pcb
89 #define in6pcb		inpcb
90 #endif
91 #endif
92 
93 #include <netinet/sctp_pcb.h>
94 
95 #ifdef IPSEC
96 #include <netipsec/ipsec.h>
97 #include <netipsec/key.h>
98 #endif /* IPSEC */
99 
100 #include <netinet/sctp_var.h>
101 #include <netinet/sctp_header.h>
102 #include <netinet/sctputil.h>
103 #include <netinet/sctp_pcb.h>
104 #include <netinet/sctp_output.h>
105 #include <netinet/sctp_uio.h>
106 #include <netinet/sctputil.h>
107 #include <netinet/sctp_hashdriver.h>
108 #include <netinet/sctp_timer.h>
109 #include <netinet/sctp_asconf.h>
110 #include <netinet/sctp_indata.h>
111 
112 #ifdef SCTP_DEBUG
113 extern uint32_t sctp_debug_on;
114 #endif
115 
116 extern int sctp_peer_chunk_oh;
117 
118 static int
119 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
120 {
121 	struct cmsghdr cmh;
122 	int tlen, at;
123 
124 	tlen = control->m_len;
125 	at = 0;
126 	/*
127 	 * Independent of how many mbufs, find the c_type inside the control
128 	 * structure and copy out the data.
129 	 */
130 	while (at < tlen) {
131 		if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
132 			/* not enough room for one more we are done. */
133 			return (0);
134 		}
135 		m_copydata(control, at, sizeof(cmh), (void *)&cmh);
136 		if ((cmh.cmsg_len + at) > tlen) {
137 			/*
138 			 * this is real messed up since there is not enough
139 			 * data here to cover the cmsg header. We are done.
140 			 */
141 			return (0);
142 		}
143 		if ((cmh.cmsg_level == IPPROTO_SCTP) &&
144 		    (c_type == cmh.cmsg_type)) {
145 			/* found the one we want, copy it out */
146 			at += CMSG_ALIGN(sizeof(struct cmsghdr));
147 			if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
148 				/*
149 				 * space of cmsg_len after header not
150 				 * big enough
151 				 */
152 				return (0);
153 			}
154 			m_copydata(control, at, cpsize, data);
155 			return (1);
156 		 } else {
157 			at += CMSG_ALIGN(cmh.cmsg_len);
158 			if (cmh.cmsg_len == 0) {
159 				break;
160 			}
161 		}
162 	}
163 	/* not found */
164 	return (0);
165 }
166 
167 static struct mbuf *
168 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
169 {
170 	struct sctp_paramhdr *parmh;
171 	struct mbuf *mret;
172 	int len;
173 	if (ifa->ifa_addr->sa_family == AF_INET) {
174 		len = sizeof(struct sctp_ipv4addr_param);
175 	} else if (ifa->ifa_addr->sa_family == AF_INET6) {
176 		len = sizeof(struct sctp_ipv6addr_param);
177 	} else {
178 		/* unknown type */
179 		return (m);
180 	}
181 
182 	if (M_TRAILINGSPACE(m) >= len) {
183 		/* easy side we just drop it on the end */
184 		parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
185 		mret = m;
186 	} else {
187 		/* Need more space */
188 		mret = m;
189 		while (mret->m_next != NULL) {
190 			mret = mret->m_next;
191 		}
192 		MGET(mret->m_next, M_DONTWAIT, MT_DATA);
193 		if (mret->m_next == NULL) {
194 			/* We are hosed, can't add more addresses */
195 			return (m);
196 		}
197 		mret = mret->m_next;
198 		parmh = mtod(mret, struct sctp_paramhdr *);
199 	}
200 	/* now add the parameter */
201 	if (ifa->ifa_addr->sa_family == AF_INET) {
202 		struct sctp_ipv4addr_param *ipv4p;
203 		struct sockaddr_in *sin;
204 		sin = (struct sockaddr_in *)ifa->ifa_addr;
205 		ipv4p = (struct sctp_ipv4addr_param *)parmh;
206 		parmh->param_type = htons(SCTP_IPV4_ADDRESS);
207 		parmh->param_length = htons(len);
208 		ipv4p->addr = sin->sin_addr.s_addr;
209 		mret->m_len += len;
210 	} else if (ifa->ifa_addr->sa_family == AF_INET6) {
211 		struct sctp_ipv6addr_param *ipv6p;
212 		struct sockaddr_in6 *sin6;
213 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
214 		ipv6p = (struct sctp_ipv6addr_param *)parmh;
215 		parmh->param_type = htons(SCTP_IPV6_ADDRESS);
216 		parmh->param_length = htons(len);
217 		memcpy(ipv6p->addr, &sin6->sin6_addr,
218 		    sizeof(ipv6p->addr));
219 		/* clear embedded scope in the address */
220 		in6_clearscope((struct in6_addr *)ipv6p->addr);
221 		mret->m_len += len;
222 	} else {
223 		return (m);
224 	}
225 	return (mret);
226 }
227 
228 
229 
230 static struct mbuf *
231 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
232     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
233 {
234 	struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
235 	struct sctp_state_cookie *stc;
236 	struct sctp_paramhdr *ph;
237 	uint8_t *signature;
238 	int sig_offset;
239 	uint16_t cookie_sz;
240 
241 	mret = NULL;
242 
243 	MGET(mret, M_DONTWAIT, MT_DATA);
244 	if (mret == NULL) {
245 		return (NULL);
246 	}
247 	copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT);
248 	if (copy_init == NULL) {
249 		sctp_m_freem(mret);
250 		return (NULL);
251 	}
252 	copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
253 	    M_DONTWAIT);
254 	if (copy_initack == NULL) {
255 		sctp_m_freem(mret);
256 		sctp_m_freem(copy_init);
257 		return (NULL);
258 	}
259 	/* easy side we just drop it on the end */
260 	ph = mtod(mret, struct sctp_paramhdr *);
261 	mret->m_len = sizeof(struct sctp_state_cookie) +
262 	    sizeof(struct sctp_paramhdr);
263 	stc = (struct sctp_state_cookie *)((vaddr_t)ph +
264 	    sizeof(struct sctp_paramhdr));
265 	ph->param_type = htons(SCTP_STATE_COOKIE);
266 	ph->param_length = 0;	/* fill in at the end */
267 	/* Fill in the stc cookie data */
268 	*stc = *stc_in;
269 
270 	/* tack the INIT and then the INIT-ACK onto the chain */
271 	cookie_sz = 0;
272 	m_at = mret;
273 	for (m_at = mret; m_at; m_at = m_at->m_next) {
274 		cookie_sz += m_at->m_len;
275 		if (m_at->m_next == NULL) {
276 			m_at->m_next = copy_init;
277 			break;
278 		}
279 	}
280 
281 	for (m_at = copy_init; m_at; m_at = m_at->m_next) {
282 		cookie_sz += m_at->m_len;
283 		if (m_at->m_next == NULL) {
284 			m_at->m_next = copy_initack;
285 			break;
286 		}
287 	}
288 
289 	for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
290 		cookie_sz += m_at->m_len;
291 		if (m_at->m_next == NULL) {
292 			break;
293 		}
294 	}
295 	MGET(sig, M_DONTWAIT, MT_DATA);
296 	if (sig == NULL) {
297 		/* no space */
298 		sctp_m_freem(mret);
299 		sctp_m_freem(copy_init);
300 		sctp_m_freem(copy_initack);
301 		return (NULL);
302 	}
303 	sig->m_len = 0;
304 	m_at->m_next = sig;
305 	sig_offset = 0;
306 	signature = (uint8_t *)(mtod(sig, vaddr_t) + sig_offset);
307 	/* Time to sign the cookie */
308 	sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
309 	    (int)(inp->sctp_ep.current_secret_number)],
310 	    SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
311 	    (uint8_t *)signature);
312 	sig->m_len += SCTP_SIGNATURE_SIZE;
313 	cookie_sz += SCTP_SIGNATURE_SIZE;
314 
315 	ph->param_length = htons(cookie_sz);
316 	return (mret);
317 }
318 
319 
320 static struct sockaddr_in *
321 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
322 {
323 	struct sockaddr_in *sin;
324 	/*
325 	 * Here we determine if its a prefered address. A
326 	 * prefered address means it is the same scope or
327 	 * higher scope then the destination.
328 	 *  L = loopback, P = private, G = global
329 	 * -----------------------------------------
330 	 *  src    |      dest     |    result
331 	 *-----------------------------------------
332 	 *   L     |       L       |    yes
333 	 *-----------------------------------------
334 	 *   P     |       L       |    yes
335 	 *-----------------------------------------
336 	 *   G     |       L       |    yes
337 	 *-----------------------------------------
338 	 *   L     |       P       |    no
339 	 *-----------------------------------------
340 	 *   P     |       P       |    yes
341 	 *-----------------------------------------
342 	 *   G     |       P       |    no
343 	 *-----------------------------------------
344 	 *   L     |       G       |    no
345 	 *-----------------------------------------
346 	 *   P     |       G       |    no
347 	 *-----------------------------------------
348 	 *   G     |       G       |    yes
349 	 *-----------------------------------------
350 	 */
351 
352 	if (ifa->ifa_addr->sa_family != AF_INET) {
353 		/* forget non-v4 */
354 		return (NULL);
355 	}
356 	/* Ok the address may be ok */
357 	sin = (struct sockaddr_in *)ifa->ifa_addr;
358 	if (sin->sin_addr.s_addr == 0) {
359 		return (NULL);
360 	}
361 	*sin_local = *sin_loop = 0;
362 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
363 	    (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
364 		*sin_loop = 1;
365 		*sin_local = 1;
366 	}
367 	if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
368 		*sin_local = 1;
369 	}
370 	if (!loopscope && *sin_loop) {
371 		/* Its a loopback address and we don't have loop scope */
372 		return (NULL);
373 	}
374 	if (!ipv4_scope && *sin_local) {
375 		/* Its a private address, and we don't have private address scope */
376 		return (NULL);
377 	}
378 	if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
379 		/* its a global src and a private dest */
380 		return (NULL);
381 	}
382 	/* its a prefered address */
383 	return (sin);
384 }
385 
386 static struct sockaddr_in *
387 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
388 {
389 	struct sockaddr_in *sin;
390 	/*
391 	 * Here we determine if its a acceptable address. A
392 	 * acceptable address means it is the same scope or
393 	 * higher scope but we can allow for NAT which means
394 	 * its ok to have a global dest and a private src.
395 	 *
396 	 *  L = loopback, P = private, G = global
397 	 * -----------------------------------------
398 	 *  src    |      dest     |    result
399 	 *-----------------------------------------
400 	 *   L     |       L       |    yes
401 	 *-----------------------------------------
402 	 *   P     |       L       |    yes
403 	 *-----------------------------------------
404 	 *   G     |       L       |    yes
405 	 *-----------------------------------------
406 	 *   L     |       P       |    no
407 	 *-----------------------------------------
408 	 *   P     |       P       |    yes
409 	 *-----------------------------------------
410 	 *   G     |       P       |    yes - probably this won't work.
411 	 *-----------------------------------------
412 	 *   L     |       G       |    no
413 	 *-----------------------------------------
414 	 *   P     |       G       |    yes
415 	 *-----------------------------------------
416 	 *   G     |       G       |    yes
417 	 *-----------------------------------------
418 	 */
419 
420 	if (ifa->ifa_addr->sa_family != AF_INET) {
421 		/* forget non-v4 */
422 		return (NULL);
423 	}
424 	/* Ok the address may be ok */
425 	sin = (struct sockaddr_in *)ifa->ifa_addr;
426 	if (sin->sin_addr.s_addr == 0) {
427 		return (NULL);
428 	}
429 	*sin_local = *sin_loop = 0;
430 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
431 	    (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
432 		*sin_loop = 1;
433 		*sin_local = 1;
434 	}
435 	if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
436 		*sin_local = 1;
437 	}
438 	if (!loopscope && *sin_loop) {
439 		/* Its a loopback address and we don't have loop scope */
440 		return (NULL);
441 	}
442 	/* its an acceptable address */
443 	return (sin);
444 }
445 
446 /*
447  * This treats the address list on the ep as a restricted list
448  * (negative list). If a the passed address is listed, then
449  * the address is NOT allowed on the association.
450  */
451 int
452 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
453 {
454 	struct sctp_laddr *laddr;
455 #ifdef SCTP_DEBUG
456 	int cnt=0;
457 #endif
458 	if (stcb == NULL) {
459 		/* There are no restrictions, no TCB :-) */
460 		return (0);
461 	}
462 #ifdef SCTP_DEBUG
463 	LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
464 		cnt++;
465 	}
466 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
467 		printf("There are %d addresses on the restricted list\n", cnt);
468 	}
469 	cnt = 0;
470 #endif
471 	LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
472 		if (laddr->ifa == NULL) {
473 #ifdef SCTP_DEBUG
474 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
475 				printf("Help I have fallen and I can't get up!\n");
476 			}
477 #endif
478 			continue;
479 		}
480 #ifdef SCTP_DEBUG
481 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
482 			cnt++;
483 			printf("Restricted address[%d]:", cnt);
484 			sctp_print_address(laddr->ifa->ifa_addr);
485 		}
486 #endif
487 		if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
488 			/* Yes it is on the list */
489 			return (1);
490 		}
491 	}
492 	return (0);
493 }
494 
495 static int
496 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
497 {
498 	struct sctp_laddr *laddr;
499 
500 	if (ifa == NULL)
501 		return (0);
502 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
503 		if (laddr->ifa == NULL) {
504 #ifdef SCTP_DEBUG
505 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
506 				printf("Help I have fallen and I can't get up!\n");
507 			}
508 #endif
509 			continue;
510 		}
511 		if (laddr->ifa->ifa_addr == NULL)
512 			continue;
513 		if (laddr->ifa == ifa)
514 			/* same pointer */
515 			return (1);
516 		if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
517 			/* skip non compatible address comparison */
518 			continue;
519 		}
520 		if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
521 			/* Yes it is restricted */
522 			return (1);
523 		}
524 	}
525 	return (0);
526 }
527 
528 
529 
530 static struct in_addr
531 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
532 				 struct rtentry *rt,
533 				 uint8_t ipv4_scope,
534 				 uint8_t loopscope)
535 {
536 	struct in_addr ans;
537 	struct sctp_laddr *laddr;
538 	struct sockaddr_in *sin;
539 	struct ifnet *ifn;
540 	struct ifaddr *ifa;
541 	uint8_t sin_loop, sin_local;
542 
543 	/* first question, is the ifn we will emit on
544 	 * in our list, if so, we want that one.
545 	 */
546 	ifn = rt->rt_ifp;
547 	if (ifn) {
548 		/* is a prefered one on the interface we route out? */
549 		IFADDR_READER_FOREACH(ifa, ifn) {
550 			sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
551 			if (sin == NULL)
552 				continue;
553 			if (sctp_is_addr_in_ep(inp, ifa)) {
554 				return (sin->sin_addr);
555 			}
556 		}
557 		/* is an acceptable one on the interface we route out? */
558 		IFADDR_READER_FOREACH(ifa, ifn) {
559 			sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
560 			if (sin == NULL)
561 				continue;
562 			if (sctp_is_addr_in_ep(inp, ifa)) {
563 				return (sin->sin_addr);
564 			}
565 		}
566 	}
567 	/* ok, what about a prefered address in the inp */
568 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
569 	     laddr && (laddr != inp->next_addr_touse);
570 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
571 		if (laddr->ifa == NULL) {
572 			/* address has been removed */
573 			continue;
574 		}
575 		sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
576 		if (sin == NULL)
577 			continue;
578 		return (sin->sin_addr);
579 
580 	}
581 	/* ok, what about an acceptable address in the inp */
582 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
583 	     laddr && (laddr != inp->next_addr_touse);
584 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
585 		if (laddr->ifa == NULL) {
586 			/* address has been removed */
587 			continue;
588 		}
589 		sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
590 		if (sin == NULL)
591 			continue;
592 		return (sin->sin_addr);
593 
594 	}
595 
596 	/* no address bound can be a source for the destination we are in trouble */
597 #ifdef SCTP_DEBUG
598 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
599 		printf("Src address selection for EP, no acceptable src address found for address\n");
600 	}
601 #endif
602 	memset(&ans, 0, sizeof(ans));
603 	return (ans);
604 }
605 
606 
607 
608 static struct in_addr
609 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
610 				  struct sctp_tcb *stcb,
611 				  struct sctp_nets *net,
612 				  struct rtentry *rt,
613  			          uint8_t ipv4_scope,
614 				  uint8_t loopscope,
615 				  int non_asoc_addr_ok)
616 {
617 	/*
618 	 * Here we have two cases, bound all asconf
619 	 * allowed. bound all asconf not allowed.
620 	 *
621 	 */
622 	struct sctp_laddr *laddr, *starting_point;
623 	struct in_addr ans;
624 	struct ifnet *ifn;
625 	struct ifaddr *ifa;
626 	uint8_t sin_loop, sin_local, start_at_beginning=0;
627 	struct sockaddr_in *sin;
628 
629 	/* first question, is the ifn we will emit on
630 	 * in our list, if so, we want that one.
631 	 */
632 	ifn = rt->rt_ifp;
633 
634  	if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
635 		/*
636 		 * Here we use the list of addresses on the endpoint. Then
637 		 * the addresses listed on the "restricted" list is just that,
638 		 * address that have not been added and can't be used (unless
639 		 * the non_asoc_addr_ok is set).
640 		 */
641 #ifdef SCTP_DEBUG
642 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
643 			printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
644 		}
645 #endif
646 		/* first question, is the ifn we will emit on
647 		 * in our list, if so, we want that one.
648 		 */
649 		if (ifn) {
650 			/* first try for an prefered address on the ep */
651 			IFADDR_READER_FOREACH(ifa, ifn) {
652 				if (sctp_is_addr_in_ep(inp, ifa)) {
653 					sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
654 					if (sin == NULL)
655 						continue;
656 					if ((non_asoc_addr_ok == 0) &&
657 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
658 						/* on the no-no list */
659 						continue;
660 					}
661 					return (sin->sin_addr);
662 				}
663 			}
664 			/* next try for an acceptable address on the ep */
665 			IFADDR_READER_FOREACH(ifa, ifn) {
666 				if (sctp_is_addr_in_ep(inp, ifa)) {
667 					sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
668 					if (sin == NULL)
669 						continue;
670 					if ((non_asoc_addr_ok == 0) &&
671 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
672 						/* on the no-no list */
673 						continue;
674 					}
675 					return (sin->sin_addr);
676 				}
677 			}
678 
679 		}
680 		/* if we can't find one like that then we must
681 		 * look at all addresses bound to pick one at
682 		 * first prefereable then secondly acceptable.
683 		 */
684 		starting_point = stcb->asoc.last_used_address;
685 	sctpv4_from_the_top:
686 		if (stcb->asoc.last_used_address == NULL) {
687 			start_at_beginning=1;
688 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
689 		}
690 		/* search beginning with the last used address */
691 		for (laddr = stcb->asoc.last_used_address; laddr;
692 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
693 			if (laddr->ifa == NULL) {
694 				/* address has been removed */
695 				continue;
696 			}
697 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
698 			if (sin == NULL)
699 				continue;
700 			if ((non_asoc_addr_ok == 0) &&
701 			    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
702 				/* on the no-no list */
703 				continue;
704 			}
705 			return (sin->sin_addr);
706 
707 		}
708 		if (start_at_beginning == 0) {
709 			stcb->asoc.last_used_address = NULL;
710 			goto sctpv4_from_the_top;
711 		}
712 		/* now try for any higher scope than the destination */
713 		stcb->asoc.last_used_address = starting_point;
714 		start_at_beginning = 0;
715 	sctpv4_from_the_top2:
716 		if (stcb->asoc.last_used_address == NULL) {
717 			start_at_beginning=1;
718 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
719 		}
720 		/* search beginning with the last used address */
721 		for (laddr = stcb->asoc.last_used_address; laddr;
722 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
723 			if (laddr->ifa == NULL) {
724 				/* address has been removed */
725 				continue;
726 			}
727 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
728 			if (sin == NULL)
729 				continue;
730 			if ((non_asoc_addr_ok == 0) &&
731 			    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
732 				/* on the no-no list */
733 				continue;
734 			}
735 			return (sin->sin_addr);
736 		}
737 		if (start_at_beginning == 0) {
738 			stcb->asoc.last_used_address = NULL;
739 			goto sctpv4_from_the_top2;
740 		}
741 	} else {
742 		/*
743 		 * Here we have an address list on the association, thats the
744 		 * only valid source addresses that we can use.
745 		 */
746 #ifdef SCTP_DEBUG
747 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
748 			printf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
749 		}
750 #endif
751 		/* First look at all addresses for one that is on
752 		 * the interface we route out
753 		 */
754 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
755 			     sctp_nxt_addr) {
756 			if (laddr->ifa == NULL) {
757 				/* address has been removed */
758 				continue;
759 			}
760 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
761 			if (sin == NULL)
762 				continue;
763 			/* first question, is laddr->ifa an address associated with the emit interface */
764 			if (ifn) {
765 				IFADDR_READER_FOREACH(ifa, ifn) {
766 					if (laddr->ifa == ifa) {
767 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
768 						return (sin->sin_addr);
769 					}
770 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
771 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
772 						return (sin->sin_addr);
773 					}
774 				}
775 			}
776 		}
777 		/* what about an acceptable one on the interface? */
778 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
779 			     sctp_nxt_addr) {
780 			if (laddr->ifa == NULL) {
781 				/* address has been removed */
782 				continue;
783 			}
784 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
785 			if (sin == NULL)
786 				continue;
787 			/* first question, is laddr->ifa an address associated with the emit interface */
788 			if (ifn) {
789 				IFADDR_READER_FOREACH(ifa, ifn) {
790 					if (laddr->ifa == ifa) {
791 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
792 						return (sin->sin_addr);
793 					}
794 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
795 						sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
796 						return (sin->sin_addr);
797 					}
798 				}
799 			}
800 		}
801 		/* ok, next one that is preferable in general */
802 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
803 			     sctp_nxt_addr) {
804 			if (laddr->ifa == NULL) {
805 				/* address has been removed */
806 				continue;
807 			}
808 			sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
809 			if (sin == NULL)
810 				continue;
811 			return (sin->sin_addr);
812 		}
813 
814 		/* last, what about one that is acceptable */
815 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
816 			     sctp_nxt_addr) {
817 			if (laddr->ifa == NULL) {
818 				/* address has been removed */
819 				continue;
820 			}
821 			sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
822 			if (sin == NULL)
823 				continue;
824 			return (sin->sin_addr);
825 		}
826 	}
827 	memset(&ans, 0, sizeof(ans));
828 	return (ans);
829 }
830 
831 static struct sockaddr_in *
832 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
833 						    uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
834 {
835 	struct ifaddr *ifa;
836 	struct sockaddr_in *sin;
837 	uint8_t sin_loop, sin_local;
838 	int num_eligible_addr = 0;
839 	IFADDR_READER_FOREACH(ifa, ifn) {
840 		sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
841 		if (sin == NULL)
842 			continue;
843 		if (stcb) {
844 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
845 				/* It is restricted for some reason.. probably
846 				 * not yet added.
847 				 */
848 				continue;
849 			}
850 		}
851 		if (cur_addr_num == num_eligible_addr) {
852 			return (sin);
853 		}
854 	}
855 	return (NULL);
856 }
857 
858 
859 static int
860 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
861 				     uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
862 {
863 	struct ifaddr *ifa;
864 	struct sockaddr_in *sin;
865 	int num_eligible_addr = 0;
866 
867 	IFADDR_READER_FOREACH(ifa, ifn) {
868 		sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
869 		if (sin == NULL)
870 			continue;
871 		if (stcb) {
872 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
873 				/* It is restricted for some reason.. probably
874 				 * not yet added.
875 				 */
876 				continue;
877 			}
878 		}
879 		num_eligible_addr++;
880 	}
881 	return (num_eligible_addr);
882 
883 }
884 
885 static struct in_addr
886 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
887 			struct sctp_tcb *stcb,
888 			struct sctp_nets *net,
889 			struct rtentry *rt,
890 			uint8_t ipv4_scope,
891 			uint8_t loopscope,
892 			int non_asoc_addr_ok)
893 {
894 	int cur_addr_num=0, num_prefered=0;
895 	uint8_t sin_loop, sin_local;
896 	struct ifnet *ifn;
897 	struct sockaddr_in *sin;
898 	struct in_addr ans;
899 	struct ifaddr *ifa;
900 	int s;
901 	/*
902 	 * For v4 we can use (in boundall) any address in the association. If
903 	 * non_asoc_addr_ok is set we can use any address (at least in theory).
904 	 * So we look for prefered addresses first. If we find one, we use it.
905 	 * Otherwise we next try to get an address on the interface, which we
906 	 * should be able to do (unless non_asoc_addr_ok is false and we are
907 	 * routed out that way). In these cases where we can't use the address
908 	 * of the interface we go through all the ifn's looking for an address
909 	 * we can use and fill that in. Punting means we send back address
910 	 * 0, which will probably cause problems actually since then IP will
911 	 * fill in the address of the route ifn, which means we probably already
912 	 * rejected it.. i.e. here comes an abort :-<.
913 	 */
914 	ifn = rt->rt_ifp;
915 	if (net) {
916 		cur_addr_num = net->indx_of_eligible_next_to_use;
917 	}
918 	if (ifn == NULL) {
919  		goto bound_all_v4_plan_c;
920 	}
921 	num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
922 #ifdef SCTP_DEBUG
923 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
924 		printf("Found %d prefered source addresses\n", num_prefered);
925 	}
926 #endif
927 	if (num_prefered == 0) {
928 		/* no eligible addresses, we must use some other
929 		 * interface address if we can find one.
930 		 */
931  		goto bound_all_v4_plan_b;
932 	}
933 	/* Ok we have num_eligible_addr set with how many we can use,
934 	 * this may vary from call to call due to addresses being deprecated etc..
935 	 */
936 	if (cur_addr_num >= num_prefered) {
937 		cur_addr_num = 0;
938 	}
939 	/* select the nth address from the list (where cur_addr_num is the nth) and
940 	 * 0 is the first one, 1 is the second one etc...
941 	 */
942 #ifdef SCTP_DEBUG
943 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
944 		printf("cur_addr_num:%d\n", cur_addr_num);
945 	}
946 #endif
947 	sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
948 								   ipv4_scope, cur_addr_num);
949 
950 	/* if sin is NULL something changed??, plan_a now */
951 	if (sin) {
952 		return (sin->sin_addr);
953 	}
954 
955 	/*
956 	 * plan_b: Look at the interface that we emit on
957 	 *         and see if we can find an acceptable address.
958 	 */
959  bound_all_v4_plan_b:
960 	IFADDR_READER_FOREACH(ifa, ifn) {
961 		sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
962 		if (sin == NULL)
963 			continue;
964 		if (stcb) {
965 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
966 				/* It is restricted for some reason.. probably
967 				 * not yet added.
968 				 */
969 				continue;
970 			}
971 		}
972 		return (sin->sin_addr);
973 	}
974 	/*
975 	 * plan_c: Look at all interfaces and find a prefered
976 	 *         address. If we reache here we are in trouble I think.
977 	 */
978  bound_all_v4_plan_c:
979 	s = pserialize_read_enter();
980 	IFNET_READER_FOREACH(ifn) {
981 		if (ifn == inp->next_ifn_touse)
982 			break;
983 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
984 			/* wrong base scope */
985 			continue;
986 		}
987 		if (ifn == rt->rt_ifp)
988 			/* already looked at this guy */
989 			continue;
990 		num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
991 								    loopscope, ipv4_scope, &sin_loop, &sin_local);
992 #ifdef SCTP_DEBUG
993 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
994 			printf("Found ifn:%p %d prefered source addresses\n", ifn, num_prefered);
995 		}
996 #endif
997 		if (num_prefered == 0) {
998 			/*
999 			 * None on this interface.
1000 			 */
1001 			continue;
1002 		}
1003 		/* Ok we have num_eligible_addr set with how many we can use,
1004 		 * this may vary from call to call due to addresses being deprecated etc..
1005 		 */
1006 		if (cur_addr_num >= num_prefered) {
1007 			cur_addr_num = 0;
1008 		}
1009 		sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1010 									  ipv4_scope, cur_addr_num);
1011 		if (sin == NULL)
1012 			continue;
1013 		pserialize_read_exit(s);
1014 		return (sin->sin_addr);
1015 
1016 	}
1017 	pserialize_read_exit(s);
1018 
1019 	/*
1020 	 * plan_d: We are in deep trouble. No prefered address on
1021 	 *         any interface. And the emit interface does not
1022 	 *         even have an acceptable address. Take anything
1023 	 *         we can get! If this does not work we are
1024 	 *         probably going to emit a packet that will
1025 	 *         illicit an ABORT, falling through.
1026 	 */
1027 
1028 	s = pserialize_read_enter();
1029 	IFNET_READER_FOREACH(ifn) {
1030 		if (ifn == inp->next_ifn_touse)
1031 			break;
1032 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1033 			/* wrong base scope */
1034 			continue;
1035 		}
1036 		if (ifn == rt->rt_ifp)
1037 			/* already looked at this guy */
1038 			continue;
1039 
1040 		IFADDR_READER_FOREACH(ifa, ifn) {
1041 			sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1042 			if (sin == NULL)
1043 				continue;
1044 			if (stcb) {
1045 				if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1046 					/* It is restricted for some reason.. probably
1047 					 * not yet added.
1048 					 */
1049 					continue;
1050 				}
1051 			}
1052 			pserialize_read_exit(s);
1053 			return (sin->sin_addr);
1054 		}
1055 	}
1056 	pserialize_read_exit(s);
1057 	/*
1058 	 * Ok we can find NO address to source from that is
1059 	 * not on our negative list. It is either the special
1060 	 * ASCONF case where we are sourceing from a intf that
1061 	 * has been ifconfig'd to a different address (i.e.
1062 	 * it holds a ADD/DEL/SET-PRIM and the proper lookup
1063 	 * address. OR we are hosed, and this baby is going
1064 	 * to abort the association.
1065 	 */
1066 	if (non_asoc_addr_ok) {
1067 		return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1068 	} else {
1069 		memset(&ans, 0, sizeof(ans));
1070 		return (ans);
1071 	}
1072 }
1073 
1074 
1075 
1076 /* tcb may be NULL */
1077 struct in_addr
1078 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1079     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1080     int non_asoc_addr_ok)
1081 {
1082 	struct in_addr ans;
1083 	const struct sockaddr_in *to;
1084 	struct rtentry *rt;
1085 	uint8_t ipv4_scope, loopscope;
1086 
1087 	/*
1088 	 * Rules:
1089 	 * - Find the route if needed, cache if I can.
1090 	 * - Look at interface address in route, Is it
1091 	 *   in the bound list. If so we have the best source.
1092 	 * - If not we must rotate amongst the addresses.
1093 	 *
1094 	 * Cavets and issues
1095 	 *
1096 	 * Do we need to pay attention to scope. We can have
1097 	 * a private address or a global address we are sourcing
1098 	 * or sending to. So if we draw it out
1099 	 *      source     *      dest   *  result
1100 	 *  ------------------------------------------
1101 	 *  a   Private    *     Global  *  NAT?
1102 	 *  ------------------------------------------
1103 	 *  b   Private    *     Private *  No problem
1104 	 *  ------------------------------------------
1105 	 *  c   Global     *     Private *  Huh, How will this work?
1106 	 *  ------------------------------------------
1107 	 *  d   Global     *     Global  *  No Problem
1108 	 *  ------------------------------------------
1109 	 *
1110 	 * And then we add to that what happens if there are multiple
1111 	 * addresses assigned to an interface. Remember the ifa on a
1112 	 * ifn is a linked list of addresses. So one interface can
1113 	 * have more than one IPv4 address. What happens if we
1114 	 * have both a private and a global address? Do we then
1115 	 * use context of destination to sort out which one is
1116 	 * best? And what about NAT's sending P->G may get you
1117 	 * a NAT translation, or should you select the G thats
1118 	 * on the interface in preference.
1119 	 *
1120 	 * Decisions:
1121 	 *
1122 	 *  - count the number of addresses on the interface.
1123 	 *  - if its one, no problem except case <c>. For <a>
1124 	 *    we will assume a NAT out there.
1125 	 *  - if there are more than one, then we need to worry
1126 	 *    about scope P or G. We should prefer G -> G and
1127 	 *    P -> P if possible. Then as a secondary fall back
1128 	 *    to mixed types G->P being a last ditch one.
1129 	 *  - The above all works for bound all, but bound
1130 	 *    specific we need to use the same concept but instead
1131 	 *    only consider the bound addresses. If the bound set
1132 	 *    is NOT assigned to the interface then we must use
1133 	 *    rotation amongst them.
1134 	 *
1135 	 * Notes: For v4, we can always punt and let ip_output
1136 	 * decide by sending back a source of 0.0.0.0
1137 	 */
1138 
1139 	/*
1140 	 * Need a route to cache.
1141 	 *
1142 	 */
1143 	rt = rtcache_validate(ro);
1144 	if (rt == NULL) {
1145 		/* No route to host .. punt */
1146 		memset(&ans, 0, sizeof(ans));
1147 		return (ans);
1148 	} else {
1149 		to = satocsin(rtcache_getdst(ro));
1150 	}
1151 	/* Setup our scopes */
1152 	if (stcb) {
1153 		ipv4_scope = stcb->asoc.ipv4_local_scope;
1154 		loopscope = stcb->asoc.loopback_scope;
1155 	} else {
1156 		/* Scope based on outbound address */
1157 		if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1158 			ipv4_scope = 1;
1159 			loopscope = 0;
1160 		} else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1161 			ipv4_scope = 1;
1162 			loopscope = 1;
1163 		} else {
1164 			ipv4_scope = 0;
1165 			loopscope = 0;
1166 		}
1167 	}
1168 #ifdef SCTP_DEBUG
1169 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1170 		printf("Scope setup loop:%d ipv4_scope:%d\n",
1171 		       loopscope, ipv4_scope);
1172 	}
1173 #endif
1174 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1175 		/*
1176 		 * When bound to all if the address list is set
1177 		 * it is a negative list. Addresses being added
1178 		 * by asconf.
1179 		 */
1180 		ans = sctp_choose_v4_boundall(inp, stcb, net, rt,
1181 		    ipv4_scope, loopscope, non_asoc_addr_ok);
1182 		goto out;
1183         }
1184 	/*
1185  	 * Three possiblities here:
1186 	 *
1187 	 * a) stcb is NULL, which means we operate only from
1188 	 *    the list of addresses (ifa's) bound to the assoc and
1189 	 *    we care not about the list.
1190 	 * b) stcb is NOT-NULL, which means we have an assoc structure and
1191 	 *    auto-asconf is on. This means that the list of addresses is
1192          *    a NOT list. We use the list from the inp, but any listed address
1193 	 *    in our list is NOT yet added. However if the non_asoc_addr_ok is
1194 	 *    set we CAN use an address NOT available (i.e. being added). Its
1195 	 *    a negative list.
1196 	 * c) stcb is NOT-NULL, which means we have an assoc structure and
1197 	 *    auto-asconf is off. This means that the list of addresses is
1198          *    the ONLY addresses I can use.. its positive.
1199 	 *
1200 	 *    Note we collapse b & c into the same function just like in
1201 	 *    the v6 address selection.
1202 	 */
1203 	if (stcb) {
1204 		ans = sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1205 		    rt, ipv4_scope, loopscope, non_asoc_addr_ok);
1206 		goto out;
1207 	} else {
1208 		ans = sctp_choose_v4_boundspecific_inp(inp, rt,
1209 		    ipv4_scope, loopscope);
1210 		goto out;
1211 	}
1212 	/* this should not be reached */
1213 	memset(&ans, 0, sizeof(ans));
1214 out:
1215 	rtcache_unref(rt, ro);
1216 	return ans;
1217 }
1218 
1219 
1220 
1221 static struct sockaddr_in6 *
1222 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1223 {
1224 	struct in6_ifaddr *ifa6;
1225 	struct sockaddr_in6 *sin6;
1226 
1227 	if (ifa->ifa_addr->sa_family != AF_INET6) {
1228 		/* forget non-v6 */
1229 		return (NULL);
1230 	}
1231 	ifa6 = (struct in6_ifaddr *)ifa;
1232 	/* ok to use deprecated addresses? */
1233 	if (!ip6_use_deprecated) {
1234 		if (IFA6_IS_DEPRECATED(ifa6)) {
1235 			/* can't use this type */
1236 			return (NULL);
1237 		}
1238 	}
1239 	/* are we ok, with the current state of this address? */
1240 	if (ifa6->ia6_flags &
1241 	    (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1242 		/* Can't use these types */
1243 		return (NULL);
1244 	}
1245 	/* Ok the address may be ok */
1246 	sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1247 	*sin_local = *sin_loop = 0;
1248 	if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1249 	    (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1250 		*sin_loop = 1;
1251 	}
1252 	if (!loopscope && *sin_loop) {
1253 		/* Its a loopback address and we don't have loop scope */
1254 		return (NULL);
1255 	}
1256 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1257 		/* we skip unspecifed addresses */
1258 		return (NULL);
1259 	}
1260 
1261 	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1262 		*sin_local = 1;
1263 	}
1264 	if (!loc_scope && *sin_local) {
1265 		/* Its a link local address, and we don't have link local scope */
1266 		return (NULL);
1267 	}
1268 	return (sin6);
1269 }
1270 
1271 
1272 static struct sockaddr_in6 *
1273 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1274 				  struct sctp_tcb *stcb,
1275 				  struct sctp_nets *net,
1276 				  struct rtentry *rt,
1277  			          uint8_t loc_scope,
1278 				  uint8_t loopscope,
1279 				  int non_asoc_addr_ok)
1280 {
1281 	/*
1282 	 *   Each endpoint has a list of local addresses associated
1283 	 *   with it. The address list is either a "negative list" i.e.
1284 	 *   those addresses that are NOT allowed to be used as a source OR
1285 	 *   a "postive list" i.e. those addresses that CAN be used.
1286 	 *
1287 	 *   Its a negative list if asconf is allowed. What we do
1288 	 *   in this case is use the ep address list BUT we have
1289 	 *   to cross check it against the negative list.
1290 	 *
1291 	 *   In the case where NO asconf is allowed, we have just
1292 	 *   a straight association level list that we must use to
1293 	 *   find a source address.
1294 	 */
1295 	struct sctp_laddr *laddr, *starting_point;
1296 	struct sockaddr_in6 *sin6;
1297 	int sin_loop, sin_local;
1298 	int start_at_beginning=0;
1299 	struct ifnet *ifn;
1300 	struct ifaddr *ifa;
1301 
1302 	ifn = rt->rt_ifp;
1303 	if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1304 #ifdef SCTP_DEBUG
1305 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1306 			printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1307 		}
1308 #endif
1309 		/* first question, is the ifn we will emit on
1310 		 * in our list, if so, we want that one.
1311 		 */
1312 		if (ifn) {
1313 			IFADDR_READER_FOREACH(ifa, ifn) {
1314 				if (sctp_is_addr_in_ep(inp, ifa)) {
1315 					sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1316 					if (sin6 == NULL)
1317 						continue;
1318 					if ((non_asoc_addr_ok == 0) &&
1319 					    (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1320 						/* on the no-no list */
1321 						continue;
1322 					}
1323 					return (sin6);
1324 				}
1325 			}
1326 		}
1327 		starting_point = stcb->asoc.last_used_address;
1328 		/* First try for matching scope */
1329 	sctp_from_the_top:
1330 		if (stcb->asoc.last_used_address == NULL) {
1331 			start_at_beginning=1;
1332 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1333 		}
1334 		/* search beginning with the last used address */
1335 		for (laddr = stcb->asoc.last_used_address; laddr;
1336 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1337 			if (laddr->ifa == NULL) {
1338 				/* address has been removed */
1339 				continue;
1340 			}
1341 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1342 			if (sin6 == NULL)
1343 				continue;
1344 			if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1345 				/* on the no-no list */
1346 				continue;
1347 			}
1348 			/* is it of matching scope ? */
1349 			if ((loopscope == 0) &&
1350 			    (loc_scope == 0) &&
1351 			    (sin_loop == 0) &&
1352 			    (sin_local == 0)) {
1353 				/* all of global scope we are ok with it */
1354 				return (sin6);
1355 			}
1356 			if (loopscope && sin_loop)
1357 				/* both on the loopback, thats ok */
1358 				return (sin6);
1359 			if (loc_scope && sin_local)
1360 				/* both local scope */
1361 				return (sin6);
1362 
1363 		}
1364 		if (start_at_beginning == 0) {
1365 			stcb->asoc.last_used_address = NULL;
1366 			goto sctp_from_the_top;
1367 		}
1368 		/* now try for any higher scope than the destination */
1369 		stcb->asoc.last_used_address = starting_point;
1370 		start_at_beginning = 0;
1371 	sctp_from_the_top2:
1372 		if (stcb->asoc.last_used_address == NULL) {
1373 			start_at_beginning=1;
1374 			stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1375 		}
1376 		/* search beginning with the last used address */
1377 		for (laddr = stcb->asoc.last_used_address; laddr;
1378 		     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1379 			if (laddr->ifa == NULL) {
1380 				/* address has been removed */
1381 				continue;
1382 			}
1383 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1384 			if (sin6 == NULL)
1385 				continue;
1386 			if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1387 				/* on the no-no list */
1388 				continue;
1389 			}
1390 			return (sin6);
1391 		}
1392 		if (start_at_beginning == 0) {
1393 			stcb->asoc.last_used_address = NULL;
1394 			goto sctp_from_the_top2;
1395 		}
1396 	} else {
1397 #ifdef SCTP_DEBUG
1398 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1399 			printf("Have a STCB - no asconf allowed, not bound all have a postive list\n");
1400 		}
1401 #endif
1402 		/* First try for interface output match */
1403 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1404 			     sctp_nxt_addr) {
1405 			if (laddr->ifa == NULL) {
1406 				/* address has been removed */
1407 				continue;
1408 			}
1409 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1410 			if (sin6 == NULL)
1411 				continue;
1412 			/* first question, is laddr->ifa an address associated with the emit interface */
1413 			if (ifn) {
1414 				IFADDR_READER_FOREACH(ifa, ifn) {
1415 					if (laddr->ifa == ifa) {
1416 						sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1417 						return (sin6);
1418 					}
1419 					if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1420 						sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1421 						return (sin6);
1422 					}
1423 				}
1424 			}
1425 		}
1426 		/* Next try for matching scope */
1427 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1428 			     sctp_nxt_addr) {
1429 			if (laddr->ifa == NULL) {
1430 				/* address has been removed */
1431 				continue;
1432 			}
1433 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1434 			if (sin6 == NULL)
1435 				continue;
1436 
1437 			if ((loopscope == 0) &&
1438 			    (loc_scope == 0) &&
1439 			    (sin_loop == 0) &&
1440 			    (sin_local == 0)) {
1441 				/* all of global scope we are ok with it */
1442 				return (sin6);
1443 			}
1444 			if (loopscope && sin_loop)
1445 				/* both on the loopback, thats ok */
1446 				return (sin6);
1447 			if (loc_scope && sin_local)
1448 				/* both local scope */
1449 				return (sin6);
1450 		}
1451 		/* ok, now try for a higher scope in the source address */
1452 		/* First try for matching scope */
1453 		LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1454 			     sctp_nxt_addr) {
1455 			if (laddr->ifa == NULL) {
1456 				/* address has been removed */
1457 				continue;
1458 			}
1459 			sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1460 			if (sin6 == NULL)
1461 				continue;
1462 			return (sin6);
1463 		}
1464 	}
1465 	return (NULL);
1466 }
1467 
1468 static struct sockaddr_in6 *
1469 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1470 				 struct rtentry *rt,
1471 				 uint8_t loc_scope,
1472 				 uint8_t loopscope)
1473 {
1474 	/*
1475 	 * Here we are bound specific and have only
1476 	 * an inp. We must find an address that is bound
1477 	 * that we can give out as a src address. We
1478 	 * prefer two addresses of same scope if we can
1479 	 * find them that way.
1480 	 */
1481 	struct sctp_laddr *laddr;
1482 	struct sockaddr_in6 *sin6;
1483 	struct ifnet *ifn;
1484 	struct ifaddr *ifa;
1485 	int sin_loop, sin_local;
1486 
1487 	/* first question, is the ifn we will emit on
1488 	 * in our list, if so, we want that one.
1489 	 */
1490 
1491 	ifn = rt->rt_ifp;
1492 	if (ifn) {
1493 		IFADDR_READER_FOREACH(ifa, ifn) {
1494 			sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1495 			if (sin6 == NULL)
1496 				continue;
1497 			if (sctp_is_addr_in_ep(inp, ifa)) {
1498 				return (sin6);
1499 			}
1500 		}
1501 	}
1502 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1503 	     laddr && (laddr != inp->next_addr_touse);
1504 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1505 		if (laddr->ifa == NULL) {
1506 			/* address has been removed */
1507 			continue;
1508 		}
1509 		sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1510 		if (sin6 == NULL)
1511 			continue;
1512 
1513 		if ((loopscope == 0) &&
1514 		    (loc_scope == 0) &&
1515 		    (sin_loop == 0) &&
1516 		    (sin_local == 0)) {
1517 			/* all of global scope we are ok with it */
1518 			return (sin6);
1519 		}
1520 		if (loopscope && sin_loop)
1521 			/* both on the loopback, thats ok */
1522 			return (sin6);
1523 		if (loc_scope && sin_local)
1524 			/* both local scope */
1525 			return (sin6);
1526 
1527 	}
1528 	/* if we reach here, we could not find two addresses
1529 	 * of the same scope to give out. Lets look for any higher level
1530 	 * scope for a source address.
1531 	 */
1532 	for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1533 	     laddr && (laddr != inp->next_addr_touse);
1534 	     laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1535 		if (laddr->ifa == NULL) {
1536 			/* address has been removed */
1537 			continue;
1538 		}
1539 		sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1540 		if (sin6 == NULL)
1541 			continue;
1542 		return (sin6);
1543 	}
1544 	/* no address bound can be a source for the destination */
1545 #ifdef SCTP_DEBUG
1546 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1547 		printf("Src address selection for EP, no acceptable src address found for address\n");
1548 	}
1549 #endif
1550 	return (NULL);
1551 }
1552 
1553 
1554 static struct sockaddr_in6 *
1555 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1556 					   uint8_t loc_scope, int cur_addr_num, int match_scope)
1557 {
1558 	struct ifaddr *ifa;
1559 	struct sockaddr_in6 *sin6;
1560 	int sin_loop, sin_local;
1561 	int num_eligible_addr = 0;
1562 
1563 	IFADDR_READER_FOREACH(ifa, ifn) {
1564 		sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1565 		if (sin6 == NULL)
1566 			continue;
1567 		if (stcb) {
1568 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1569 				/* It is restricted for some reason.. probably
1570 				 * not yet added.
1571 				 */
1572 				continue;
1573 			}
1574 		}
1575 		if (match_scope) {
1576 			/* Here we are asked to match scope if possible */
1577 			if (loopscope && sin_loop)
1578 				/* src and destination are loopback scope */
1579 				return (sin6);
1580 			if (loc_scope && sin_local)
1581 				/* src and destination are local scope */
1582 				return (sin6);
1583 			if ((loopscope == 0) &&
1584 			    (loc_scope == 0)  &&
1585 			    (sin_loop == 0) &&
1586 			    (sin_local == 0)) {
1587 				/* src and destination are global scope */
1588 				return (sin6);
1589 			}
1590 			continue;
1591 		}
1592 		if (num_eligible_addr == cur_addr_num) {
1593 			/* this is it */
1594 			return (sin6);
1595 		}
1596 		num_eligible_addr++;
1597 	}
1598 	return (NULL);
1599 }
1600 
1601 
1602 static int
1603 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1604 				     int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1605 {
1606 	struct ifaddr *ifa;
1607 	struct sockaddr_in6 *sin6;
1608 	int num_eligible_addr = 0;
1609 	int sin_loop, sin_local;
1610 
1611 	IFADDR_READER_FOREACH(ifa, ifn) {
1612 		sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1613 		if (sin6 == NULL)
1614 			continue;
1615 		if (stcb) {
1616 			if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1617 				/* It is restricted for some reason.. probably
1618 				 * not yet added.
1619 				 */
1620 				continue;
1621 			}
1622 		}
1623 		num_eligible_addr++;
1624 	}
1625 	return (num_eligible_addr);
1626 }
1627 
1628 
1629 static struct sockaddr_in6 *
1630 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1631 			struct sctp_tcb *stcb,
1632 			struct sctp_nets *net,
1633 			struct rtentry *rt,
1634 			uint8_t loc_scope,
1635 			uint8_t loopscope,
1636 			int non_asoc_addr_ok)
1637 {
1638 	/* Ok, we are bound all SO any address
1639 	 * is ok to use as long as it is NOT in the negative
1640 	 * list.
1641 	 */
1642 	int num_eligible_addr;
1643 	int cur_addr_num=0;
1644 	int started_at_beginning=0;
1645 	int match_scope_prefered;
1646 	/* first question is, how many eligible addresses are
1647 	 * there for the destination ifn that we are using that
1648 	 * are within the proper scope?
1649 	 */
1650 	struct ifnet *ifn;
1651 	struct sockaddr_in6 *sin6;
1652 	int s;
1653 
1654 	ifn = rt->rt_ifp;
1655 	if (net) {
1656 		cur_addr_num = net->indx_of_eligible_next_to_use;
1657 	}
1658 	if (cur_addr_num == 0) {
1659 		match_scope_prefered = 1;
1660 	} else {
1661 		match_scope_prefered = 0;
1662 	}
1663 	num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1664 #ifdef SCTP_DEBUG
1665 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1666 		printf("Found %d eligible source addresses\n", num_eligible_addr);
1667 	}
1668 #endif
1669 	if (num_eligible_addr == 0) {
1670 		/* no eligible addresses, we must use some other
1671 		 * interface address if we can find one.
1672 		 */
1673  		goto bound_all_v6_plan_b;
1674 	}
1675 	/* Ok we have num_eligible_addr set with how many we can use,
1676 	 * this may vary from call to call due to addresses being deprecated etc..
1677 	 */
1678 	if (cur_addr_num >= num_eligible_addr) {
1679 		cur_addr_num = 0;
1680 	}
1681 	/* select the nth address from the list (where cur_addr_num is the nth) and
1682 	 * 0 is the first one, 1 is the second one etc...
1683 	 */
1684 #ifdef SCTP_DEBUG
1685 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1686 		printf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1687 		       cur_addr_num, match_scope_prefered);
1688 	}
1689 #endif
1690 	sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1691 							  loc_scope, cur_addr_num, match_scope_prefered);
1692 	if (match_scope_prefered && (sin6 == NULL)) {
1693 		/* retry without the preference for matching scope */
1694 #ifdef SCTP_DEBUG
1695 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1696 		printf("retry with no match_scope_prefered\n");
1697 	}
1698 #endif
1699 		sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1700 								  loc_scope, cur_addr_num, 0);
1701 	}
1702 	if (sin6) {
1703 #ifdef SCTP_DEBUG
1704 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1705 			printf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
1706 		}
1707 #endif
1708 		if (net) {
1709 			/* store so we get the next one */
1710 			if (cur_addr_num < 255)
1711 				net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1712 			else
1713 				net->indx_of_eligible_next_to_use = 0;
1714 		}
1715 		return (sin6);
1716 	}
1717 	num_eligible_addr = 0;
1718  bound_all_v6_plan_b:
1719 	/* ok, if we reach here we either fell through
1720 	 * due to something changing during an interupt (unlikely)
1721 	 * or we have NO eligible source addresses for the ifn
1722 	 * of the route (most likely). We must look at all the other
1723 	 * interfaces EXCEPT rt->rt_ifp and do the same game.
1724 	 */
1725 #ifdef SCTP_DEBUG
1726 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1727 		printf("bound-all Plan B\n");
1728 	}
1729 #endif
1730 	if (inp->next_ifn_touse == NULL) {
1731 		started_at_beginning=1;
1732 		inp->next_ifn_touse = IFNET_READER_FIRST();
1733 #ifdef SCTP_DEBUG
1734 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1735 			printf("Start at first IFN:%p\n", inp->next_ifn_touse);
1736 		}
1737 #endif
1738 	} else {
1739 		inp->next_ifn_touse = IFNET_READER_NEXT(inp->next_ifn_touse);
1740 #ifdef SCTP_DEBUG
1741 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1742 			printf("Resume at IFN:%p\n", inp->next_ifn_touse);
1743 		}
1744 #endif
1745 		if (inp->next_ifn_touse == NULL) {
1746 #ifdef SCTP_DEBUG
1747 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1748 				printf("IFN Resets\n");
1749 			}
1750 #endif
1751 			started_at_beginning=1;
1752 			inp->next_ifn_touse = IFNET_READER_FIRST();
1753 		}
1754 	}
1755 
1756 	s = pserialize_read_enter();
1757 	IFNET_READER_FOREACH(ifn) {
1758 		if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1759 			/* wrong base scope */
1760 			continue;
1761 		}
1762 		if (loc_scope && (ifn->if_index != loc_scope)) {
1763 			/* by definition the scope (from to->sin6_scopeid)
1764 			 * must match that of the interface. If not then
1765 			 * we could pick a wrong scope for the address.
1766 			 * Ususally we don't hit plan-b since the route
1767 			 * handles this. However we can hit plan-b when
1768 			 * we send to local-host so the route is the
1769 			 * loopback interface, but the destination is a
1770 			 * link local.
1771 			 */
1772 			continue;
1773 		}
1774 		if (ifn == rt->rt_ifp) {
1775 			/* already looked at this guy */
1776 			continue;
1777 		}
1778 		/* Address rotation will only work when we are not
1779 		 * rotating sourced interfaces and are using the interface
1780 		 * of the route. We would need to have a per interface index
1781 		 * in order to do proper rotation.
1782 		 */
1783 		num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1784 #ifdef SCTP_DEBUG
1785 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1786 			printf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
1787 		}
1788 #endif
1789 		if (num_eligible_addr == 0) {
1790 			/* none we can use */
1791 			continue;
1792 		}
1793 		/* Ok we have num_eligible_addr set with how many we can use,
1794 		 * this may vary from call to call due to addresses being deprecated etc..
1795 		 */
1796 		inp->next_ifn_touse = ifn;
1797 
1798 		/* select the first one we can find with perference for matching scope.
1799 		 */
1800 		sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1801 		if (sin6 == NULL) {
1802 			/* can't find one with matching scope how about a source with higher
1803 			 * scope
1804 			 */
1805  			sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1806 			if (sin6 == NULL)
1807 				/* Hmm, can't find one in the interface now */
1808 				continue;
1809 		}
1810 #ifdef SCTP_DEBUG
1811 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1812 			printf("Selected the %d'th address of ifn:%p\n",
1813 			       cur_addr_num, ifn);
1814 		}
1815 #endif
1816 		pserialize_read_exit(s);
1817 		return (sin6);
1818 	}
1819 	pserialize_read_exit(s);
1820 
1821 	if (started_at_beginning == 0) {
1822 		/* we have not been through all of them yet, force
1823 		 * us to go through them all.
1824 		 */
1825 #ifdef SCTP_DEBUG
1826 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1827 			printf("Force a recycle\n");
1828 		}
1829 #endif
1830 		inp->next_ifn_touse = NULL;
1831 		goto bound_all_v6_plan_b;
1832 	}
1833 	return (NULL);
1834 
1835 }
1836 
1837 /* stcb and net may be NULL */
1838 struct in6_addr
1839 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1840     struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1841     int non_asoc_addr_ok)
1842 {
1843 	struct in6_addr ans;
1844 	struct sockaddr_in6 *rt_addr;
1845 	uint8_t loc_scope, loopscope;
1846 	struct sockaddr_in6 to;
1847 	struct rtentry *rt;
1848 
1849 	/*
1850 	 * This routine is tricky standard v6 src address
1851 	 * selection cannot take into account what we have
1852 	 * bound etc, so we can't use it.
1853 	 *
1854 	 * Instead here is what we must do:
1855 	 * 1) Make sure we have a route, if we
1856 	 *    don't have a route we can never reach the peer.
1857 	 * 2) Once we have a route, determine the scope of the
1858 	 *     route. Link local, loopback or global.
1859 	 * 3) Next we divide into three types. Either we
1860 	 *    are bound all.. which means we want to use
1861 	 *    one of the addresses of the interface we are
1862 	 *    going out. <or>
1863 	 * 4a) We have not stcb, which means we are using the
1864 	 *    specific addresses bound on an inp, in this
1865 	 *    case we are similar to the stcb case (4b below)
1866 	 *    accept the list is always a positive list.<or>
1867 	 * 4b) We are bound specific with a stcb, which means we have a
1868 	 *    list of bound addresses and we must see if the
1869 	 *    ifn of the route is actually one of the bound addresses.
1870 	 *    If not, then we must rotate addresses amongst properly
1871 	 *    scoped bound addresses, if so we use the address
1872 	 *    of the interface.
1873 	 * 5) Always, no matter which path we take through the above
1874 	 *    we must be sure the source address we use is allowed to
1875 	 *    be used. I.e.  IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1876 	 *    addresses cannot be used.
1877 	 * 6) Addresses that are deprecated MAY be used
1878 	 * 		if (!ip6_use_deprecated) {
1879 	 *                    if (IFA6_IS_DEPRECATED(ifa6)) {
1880 	 *	                  skip the address
1881   	 *	              }
1882 	 *	        }
1883  	 */
1884 
1885 	/*** 1> determine route, if not already done */
1886 	rt = rtcache_validate(ro);
1887 	if (rt == NULL) {
1888 		/*
1889 		 * Need a route to cache.
1890 		 */
1891 		int scope_save;
1892 
1893 		memcpy(&to, rtcache_getdst(ro), sizeof(struct sockaddr));
1894 		scope_save = to.sin6_scope_id;
1895 		to.sin6_scope_id = 0;
1896 
1897 		rt = rtcache_lookup(ro, (struct sockaddr *)&to);
1898 		to.sin6_scope_id = scope_save;
1899 	}
1900 	if (rt == NULL) {
1901 		/*
1902 		 * no route to host. this packet is going no-where.
1903 		 * We probably should make sure we arrange to send back
1904 		 * an error.
1905 		 */
1906 #ifdef SCTP_DEBUG
1907 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1908 			printf("No route to host, this packet cannot be sent!\n");
1909 		}
1910 #endif
1911 		memset(&ans, 0, sizeof(ans));
1912 		return (ans);
1913 	}
1914 
1915 	/*** 2a> determine scope for outbound address/route */
1916 	loc_scope = loopscope = 0;
1917 	/*
1918 	 * We base our scope on the outbound packet scope and route,
1919 	 * NOT the TCB (if there is one). This way in local scope we will only
1920 	 * use a local scope src address when we send to a local address.
1921 	 */
1922 
1923 	if (IN6_IS_ADDR_LOOPBACK(&to.sin6_addr)) {
1924 		/* If the route goes to the loopback address OR
1925 		 * the address is a loopback address, we are loopback
1926 		 * scope.
1927 		 */
1928 #ifdef SCTP_DEBUG
1929 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1930 			printf("Loopback scope is set\n");
1931 		}
1932 #endif
1933 		loc_scope = 0;
1934 		loopscope = 1;
1935 		if (net != NULL) {
1936 			/* mark it as local */
1937 			net->addr_is_local = 1;
1938 		}
1939 
1940 	} else if (IN6_IS_ADDR_LINKLOCAL(&to.sin6_addr)) {
1941 #ifdef SCTP_DEBUG
1942 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1943 			printf("Link local scope is set, id:%d\n", to.sin6_scope_id);
1944 		}
1945 #endif
1946 		if (to.sin6_scope_id)
1947 			loc_scope = to.sin6_scope_id;
1948 		else {
1949 			loc_scope = 1;
1950 		}
1951 		loopscope = 0;
1952 	} else {
1953 #ifdef SCTP_DEBUG
1954 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1955 			printf("Global scope is set\n");
1956 		}
1957 #endif
1958 	}
1959 
1960 	/* now, depending on which way we are bound we call the appropriate
1961 	 * routine to do steps 3-6
1962 	 */
1963 #ifdef SCTP_DEBUG
1964 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1965 		printf("Destination address:");
1966 		sctp_print_address((struct sockaddr *)&to);
1967 	}
1968 #endif
1969 
1970 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1971 #ifdef SCTP_DEBUG
1972 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1973 			printf("Calling bound-all src addr selection for v6\n");
1974 		}
1975 #endif
1976 		rt_addr = sctp_choose_v6_boundall(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok);
1977 	} else {
1978 #ifdef SCTP_DEBUG
1979 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1980 			printf("Calling bound-specific src addr selection for v6\n");
1981 		}
1982 #endif
1983 		if (stcb)
1984 			rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, rt, loc_scope, loopscope,  non_asoc_addr_ok);
1985 		else
1986 			/* we can't have a non-asoc address since we have no association */
1987 			rt_addr = sctp_choose_v6_boundspecific_inp(inp,  rt, loc_scope, loopscope);
1988 	}
1989 	rtcache_unref(rt, ro);
1990 	if (rt_addr == NULL) {
1991 		/* no suitable address? */
1992 		struct in6_addr in6;
1993 #ifdef SCTP_DEBUG
1994 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1995 			printf("V6 packet will reach dead-end no suitable src address\n");
1996 		}
1997 #endif
1998 		memset(&in6, 0, sizeof(in6));
1999 		return (in6);
2000 	}
2001 #ifdef SCTP_DEBUG
2002 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2003 		printf("Source address selected is:");
2004 		sctp_print_address((struct sockaddr *)rt_addr);
2005 	}
2006 #endif
2007 	return (rt_addr->sin6_addr);
2008 }
2009 
2010 static uint8_t
2011 sctp_get_ect(struct sctp_tcb *stcb,
2012 	     struct sctp_tmit_chunk *chk)
2013 {
2014 	uint8_t this_random;
2015 
2016 	/* Huh? */
2017 	if (sctp_ecn == 0)
2018 		return (0);
2019 
2020 	if (sctp_ecn_nonce == 0)
2021 		/* no nonce, always return ECT0 */
2022 		return (SCTP_ECT0_BIT);
2023 
2024 	if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2025 		/* Peer does NOT support it, so we send a ECT0 only */
2026  		return (SCTP_ECT0_BIT);
2027 	}
2028 
2029 	if (chk == NULL)
2030 	   return (SCTP_ECT0_BIT);
2031 
2032 	if (((stcb->asoc.hb_random_idx == 3) &&
2033 	     (stcb->asoc.hb_ect_randombit > 7)) ||
2034 	     (stcb->asoc.hb_random_idx > 3)) {
2035 		uint32_t rndval;
2036 		rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2037 		memcpy(stcb->asoc.hb_random_values, &rndval,
2038 		       sizeof(stcb->asoc.hb_random_values));
2039 		this_random = stcb->asoc.hb_random_values[0];
2040 		stcb->asoc.hb_random_idx = 0;
2041 		stcb->asoc.hb_ect_randombit = 0;
2042 	} else {
2043 		if (stcb->asoc.hb_ect_randombit > 7) {
2044 		  stcb->asoc.hb_ect_randombit = 0;
2045 		  stcb->asoc.hb_random_idx++;
2046 		}
2047 		this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2048 	}
2049 	if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2050 		if (chk != NULL)
2051 			/* ECN Nonce stuff */
2052 			chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2053 		stcb->asoc.hb_ect_randombit++;
2054 		return (SCTP_ECT1_BIT);
2055 	} else {
2056 		stcb->asoc.hb_ect_randombit++;
2057 		return (SCTP_ECT0_BIT);
2058 	}
2059 }
2060 
2061 extern int sctp_no_csum_on_loopback;
2062 
2063 static int
2064 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2065 			   struct sctp_tcb *stcb,    /* may be NULL */
2066 			   struct sctp_nets *net,
2067 			   const struct sockaddr *to,
2068 			   struct mbuf *m,
2069 			   int nofragment_flag,
2070 			   int ecn_ok,
2071 			   struct sctp_tmit_chunk *chk,
2072 			   int out_of_asoc_ok)
2073 	/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2074 {
2075 	/*
2076 	 * Given a mbuf chain (via m_next) that holds a packet header
2077 	 * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2078 	 * - calculate SCTP checksum and fill in
2079 	 * - prepend a IP address header
2080 	 * - if boundall use INADDR_ANY
2081 	 * - if boundspecific do source address selection
2082 	 * - set fragmentation option for ipV4
2083 	 * - On return from IP output, check/adjust mtu size
2084 	 * - of output interface and smallest_mtu size as well.
2085 	 */
2086 	struct sctphdr *sctphdr;
2087 	int o_flgs;
2088 	uint32_t csum;
2089 	int ret;
2090 	unsigned int have_mtu;
2091 	struct route *ro;
2092 	struct rtentry *rt;
2093 
2094 	if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2095 		sctp_m_freem(m);
2096 		return (EFAULT);
2097 	}
2098 	if ((m->m_flags & M_PKTHDR) == 0) {
2099 #ifdef SCTP_DEBUG
2100 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2101 			printf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2102 		}
2103 #endif
2104 		sctp_m_freem(m);
2105 		return (EFAULT);
2106 	}
2107 	/* Calculate the csum and fill in the length of the packet */
2108 	sctphdr = mtod(m, struct sctphdr *);
2109 	have_mtu = 0;
2110 	if (sctp_no_csum_on_loopback &&
2111 	     (stcb) &&
2112 	     (stcb->asoc.loopback_scope)) {
2113 		sctphdr->checksum = 0;
2114 		m->m_pkthdr.len = sctp_calculate_len(m);
2115 	} else {
2116 		sctphdr->checksum = 0;
2117 		csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2118 		sctphdr->checksum = csum;
2119 	}
2120 	if (to->sa_family == AF_INET) {
2121 		struct ip *ip;
2122 		static struct route iproute;
2123 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
2124 		if (m == NULL) {
2125 			/* failed to prepend data, give up */
2126 			return (ENOMEM);
2127 		}
2128 		ip = mtod(m, struct ip *);
2129 		ip->ip_v = IPVERSION;
2130 		ip->ip_hl = (sizeof(struct ip) >> 2);
2131 		if (nofragment_flag) {
2132 			ip->ip_off = htons(IP_DF);
2133 		} else
2134 			ip->ip_off = 0;
2135 
2136 		ip->ip_id = htons(ip_newid(NULL));
2137 		ip->ip_ttl = inp->inp_ip_ttl;
2138 		ip->ip_len = htons(m->m_pkthdr.len);
2139 		if (stcb) {
2140 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2141 				/* Enable ECN */
2142 				ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2143 						      sctp_get_ect(stcb, chk));
2144 			} else {
2145 				/* No ECN */
2146 				ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2147 			}
2148 		} else {
2149 			/* no association at all */
2150 			ip->ip_tos = inp->inp_ip_tos;
2151 		}
2152 		ip->ip_p = IPPROTO_SCTP;
2153 		ip->ip_sum = 0;
2154 #ifdef SCTP_DEBUG
2155 		printf("chunk_output: net %p\n", net);
2156 #endif
2157 		if (net == NULL) {
2158 			ro = &iproute;
2159 			memset(&iproute, 0, sizeof(iproute));
2160 			/* XXX */
2161 			rt = rtcache_lookup(ro, to);
2162 			rtcache_unref(rt, ro);
2163 		} else {
2164 			ro = (struct route *)&net->ro;
2165 		}
2166 		/* Now the address selection part */
2167 		ip->ip_dst.s_addr = satocsin(to)->sin_addr.s_addr;
2168 
2169 		/* call the routine to select the src address */
2170 		if (net) {
2171 			if (net->src_addr_selected == 0) {
2172 				/* Cache the source address */
2173 				((struct sockaddr_in *)&net->_s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2174 				    stcb,
2175 				    ro, net, out_of_asoc_ok);
2176 				rt = rtcache_validate(ro);
2177 				if (rt != NULL) {
2178 					net->src_addr_selected = 1;
2179 				}
2180 				rtcache_unref(rt, ro);
2181 			}
2182 			ip->ip_src = ((struct sockaddr_in *)&net->_s_addr)->sin_addr;
2183 		} else {
2184 			ip->ip_src = sctp_ipv4_source_address_selection(inp,
2185 			    stcb, ro, net, out_of_asoc_ok);
2186 		}
2187 #ifdef SCTP_DEBUG
2188 		printf("src addr %x\n", ip->ip_src.s_addr);
2189 #endif
2190 		/*
2191 		 * If source address selection fails and we find no route then
2192 		 * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2193 		 * type error. We probably should catch that somewhere and
2194 		 * abort the association right away (assuming this is an INIT
2195 		 * being sent).
2196 		 */
2197 		rt = rtcache_validate(ro);
2198 		if (rt == NULL) {
2199 			/*
2200 			 * src addr selection failed to find a route (or valid
2201 			 * source addr), so we can't get there from here!
2202 			 */
2203 #ifdef SCTP_DEBUG
2204 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2205 				printf("low_level_output: dropped v4 packet- no valid source addr\n");
2206 				printf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2207 			}
2208 #endif /* SCTP_DEBUG */
2209 			if (net) {
2210 				if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2211 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2212 							stcb,
2213 							SCTP_FAILED_THRESHOLD,
2214 							(void *)net);
2215 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
2216 				net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2217 				if (stcb) {
2218 					if (net == stcb->asoc.primary_destination) {
2219 						/* need a new primary */
2220 						struct sctp_nets *alt;
2221 						alt = sctp_find_alternate_net(stcb, net);
2222 						if (alt != net) {
2223 							if (sctp_set_primary_addr(stcb,
2224 									      (struct sockaddr *)NULL,
2225 										 alt) == 0) {
2226 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2227 								net->src_addr_selected = 0;
2228 							}
2229 						}
2230 					}
2231 				}
2232 			}
2233 			sctp_m_freem(m);
2234 			return (EHOSTUNREACH);
2235 		} else {
2236 			have_mtu = rt->rt_ifp->if_mtu;
2237 		}
2238 
2239 		o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2240 #ifdef SCTP_DEBUG
2241 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2242 			printf("Calling ipv4 output routine from low level src addr:%x\n",
2243 			       (u_int)(ntohl(ip->ip_src.s_addr)));
2244 			printf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2245 			printf("RTP route is %p through\n", rt);
2246 			printf("length %d\n", ip->ip_len);
2247 		}
2248 #endif
2249 		if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2250 			rt->rt_ifp->if_mtu = net->mtu;
2251 		}
2252 		ret = ip_output(m, inp->ip_inp.inp.inp_options,
2253 				ro, o_flgs, inp->ip_inp.inp.inp_moptions,
2254                                 (struct socket *)inp->sctp_socket);
2255 		if ((rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2256 			rt->rt_ifp->if_mtu = have_mtu;
2257 		}
2258 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2259 #ifdef SCTP_DEBUG
2260 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2261 			printf("Ip output returns %d\n", ret);
2262 		}
2263 #endif
2264 		if (net == NULL) {
2265 		} else {
2266 			/* PMTU check versus smallest asoc MTU goes here */
2267 			if (rt != NULL) {
2268 				if (rt->rt_rmx.rmx_mtu &&
2269 				    (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
2270 					sctp_mtu_size_reset(inp, &stcb->asoc,
2271 					    rt->rt_rmx.rmx_mtu);
2272 				}
2273 			} else {
2274 				/* route was freed */
2275 				net->src_addr_selected = 0;
2276 			}
2277 		}
2278 		rtcache_unref(rt, ro);
2279 		return (ret);
2280 	}
2281 #ifdef INET6
2282 	else if (to->sa_family == AF_INET6) {
2283 		struct ip6_hdr *ip6h;
2284 		static struct route ip6route;
2285 		struct ifnet *ifp;
2286 		u_char flowTop;
2287 		uint16_t flowBottom;
2288 		u_char tosBottom, tosTop;
2289 		struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2290 		int prev_scope=0;
2291 		u_short prev_port=0;
2292 
2293 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
2294 		if (m == NULL) {
2295 			/* failed to prepend data, give up */
2296 			return (ENOMEM);
2297 		}
2298 		ip6h = mtod(m, struct ip6_hdr *);
2299 
2300 		/*
2301 		 * We assume here that inp_flow is in host byte order within
2302 		 * the TCB!
2303 		 */
2304 		flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2305 		flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2306 
2307 		tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2308 
2309 		/* protect *sin6 from overwrite */
2310 		memcpy(&tmp, to, sizeof(struct sockaddr_in6));
2311 		sin6 = &tmp;
2312 
2313 		/* KAME hack: embed scopeid */
2314 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
2315 		if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2316 #else
2317 		/*
2318 		 * XXX: appropriate scope zone must be provided or otherwise
2319 		 * ip6_use_defzone must be 1.
2320 		 */
2321 		if (sa6_embedscope(sin6, ip6_use_defzone) != 0)
2322 #endif
2323 			return (EINVAL);
2324 		if (net == NULL) {
2325 			memset(&ip6route, 0, sizeof(ip6route));
2326 			ro = (struct route *)&ip6route;
2327 			/* XXX */
2328 			rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
2329 			rtcache_unref(rt, ro);
2330 		} else {
2331 			ro = (struct route *)&net->ro;
2332 		}
2333 		if (stcb != NULL) {
2334 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2335 				/* Enable ECN */
2336 				tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2337 			} else {
2338 				/* No ECN */
2339 				tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2340 			}
2341 		} else {
2342 			/* we could get no asoc if it is a O-O-T-B packet */
2343 			tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2344 		}
2345 		ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2346 		ip6h->ip6_nxt = IPPROTO_SCTP;
2347 		ip6h->ip6_plen = m->m_pkthdr.len;
2348 		ip6h->ip6_dst = sin6->sin6_addr;
2349 
2350 		/*
2351 		 * Add SRC address selection here:
2352 		 * we can only reuse to a limited degree the kame src-addr-sel,
2353 		 * since we can try their selection but it may not be bound.
2354 		 */
2355 		memset(&lsa6_tmp, 0, sizeof(lsa6_tmp));
2356 		lsa6_tmp.sin6_family = AF_INET6;
2357 		lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2358 		lsa6 = &lsa6_tmp;
2359 		rt = rtcache_validate(ro);
2360 		if (net) {
2361 			if (net->src_addr_selected == 0) {
2362 				/* Cache the source address */
2363 				((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2364 				    stcb, ro, net, out_of_asoc_ok);
2365 
2366 				if (rt != NULL) {
2367 					net->src_addr_selected = 1;
2368 				}
2369 			}
2370 			lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr;
2371 		} else {
2372 			lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2373 			    inp, stcb, ro, net, out_of_asoc_ok);
2374 		}
2375 		lsa6->sin6_port = inp->sctp_lport;
2376 
2377 		if (rt ==  NULL) {
2378 			/*
2379 			 * src addr selection failed to find a route (or valid
2380 			 * source addr), so we can't get there from here!
2381 			 */
2382 #ifdef SCTP_DEBUG
2383 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2384 				printf("low_level_output: dropped v6 pkt- no valid source addr\n");
2385 			}
2386 #endif
2387 			sctp_m_freem(m);
2388 			if (net) {
2389 				if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2390 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2391 							stcb,
2392 							SCTP_FAILED_THRESHOLD,
2393 							(void *)net);
2394 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
2395 				net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2396 				if (stcb) {
2397 					if (net == stcb->asoc.primary_destination) {
2398 						/* need a new primary */
2399 						struct sctp_nets *alt;
2400 						alt = sctp_find_alternate_net(stcb, net);
2401 						if (alt != net) {
2402 							if (sctp_set_primary_addr(stcb,
2403 									      (struct sockaddr *)NULL,
2404 										 alt) == 0) {
2405 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2406 								net->src_addr_selected = 0;
2407 							}
2408 						}
2409 					}
2410 				}
2411 			}
2412 			return (EHOSTUNREACH);
2413 		}
2414 
2415 		ip6h->ip6_src = lsa6->sin6_addr;
2416 
2417 		/*
2418 		 * We set the hop limit now since there is a good chance that
2419 		 * our ro pointer is now filled
2420 		 */
2421 		ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2422 						(ro ?
2423 						 (rt ? (rt->rt_ifp) : (NULL)) :
2424 						 (NULL)));
2425 		o_flgs = 0;
2426 		ifp = rt->rt_ifp;
2427 #ifdef SCTP_DEBUG
2428 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2429 			/* Copy to be sure something bad is not happening */
2430 			sin6->sin6_addr = ip6h->ip6_dst;
2431 			lsa6->sin6_addr = ip6h->ip6_src;
2432 
2433 			printf("Calling ipv6 output routine from low level\n");
2434 			printf("src: ");
2435 			sctp_print_address((struct sockaddr *)lsa6);
2436 			printf("dst: ");
2437 			sctp_print_address((struct sockaddr *)sin6);
2438 		}
2439 #endif /* SCTP_DEBUG */
2440 		if (net) {
2441 			sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
2442 			/* preserve the port and scope for link local send */
2443 			prev_scope = sin6->sin6_scope_id;
2444 			prev_port = sin6->sin6_port;
2445 		}
2446 		/* XXX NOMPSAFE need to hold ifp here */
2447 		rtcache_unref(rt, ro);
2448 		ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2449 				 ro,
2450 				 o_flgs,
2451 				 ((struct in6pcb *)inp)->in6p_moptions,
2452 				 (struct socket *)inp->sctp_socket,
2453 				 &ifp);
2454 		if (net) {
2455 			/* for link local this must be done */
2456 			sin6->sin6_scope_id = prev_scope;
2457 			sin6->sin6_port = prev_port;
2458 		}
2459 #ifdef SCTP_DEBUG
2460 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2461 			printf("return from send is %d\n", ret);
2462 		}
2463 #endif /* SCTP_DEBUG_OUTPUT */
2464 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2465 		if (net) {
2466 			/* PMTU check versus smallest asoc MTU goes here */
2467 			rt = rtcache_validate(ro);
2468 			if (rt == NULL) {
2469 				/* Route was freed */
2470 				net->src_addr_selected = 0;
2471 			}
2472 			if (rt != NULL) {
2473 				if (rt->rt_rmx.rmx_mtu &&
2474 				    (stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
2475 					sctp_mtu_size_reset(inp,
2476 							    &stcb->asoc,
2477 							    rt->rt_rmx.rmx_mtu);
2478 				}
2479 				rtcache_unref(rt, ro);
2480 			} else if (ifp) {
2481 				if (ND_IFINFO(ifp)->linkmtu &&
2482 				    (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2483 					sctp_mtu_size_reset(inp,
2484 							    &stcb->asoc,
2485 							    ND_IFINFO(ifp)->linkmtu);
2486 				}
2487 			}
2488 		}
2489 		return (ret);
2490 	}
2491 #endif
2492 	else {
2493 #ifdef SCTP_DEBUG
2494 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2495 			printf("Unknown protocol (TSNH) type %d\n", ((const struct sockaddr *)to)->sa_family);
2496 		}
2497 #endif
2498 		sctp_m_freem(m);
2499 		return (EFAULT);
2500 	}
2501 }
2502 
2503 static
2504 int sctp_is_address_in_scope(struct ifaddr *ifa,
2505  			     int ipv4_addr_legal,
2506 			     int ipv6_addr_legal,
2507 			     int loopback_scope,
2508 			     int ipv4_local_scope,
2509 			     int local_scope,
2510 			     int site_scope)
2511 {
2512 	if ((loopback_scope == 0) &&
2513 	    (ifa->ifa_ifp) &&
2514 	    (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2515 		/* skip loopback if not in scope *
2516 		 */
2517 		return (0);
2518 	}
2519 	if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2520 		struct sockaddr_in *sin;
2521 		sin = (struct sockaddr_in *)ifa->ifa_addr;
2522 		if (sin->sin_addr.s_addr == 0) {
2523 			/* not in scope , unspecified */
2524 			return (0);
2525 		}
2526 		if ((ipv4_local_scope == 0) &&
2527 		    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2528 			/* private address not in scope */
2529 			return (0);
2530 		}
2531 	} else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2532 		struct sockaddr_in6 *sin6;
2533 		struct in6_ifaddr *ifa6;
2534 
2535 		ifa6 = (struct in6_ifaddr *)ifa;
2536 		/* ok to use deprecated addresses? */
2537 		if (!ip6_use_deprecated) {
2538 			if (ifa6->ia6_flags &
2539 			    IN6_IFF_DEPRECATED) {
2540 				return (0);
2541 			}
2542 		}
2543 		if (ifa6->ia6_flags &
2544 		    (IN6_IFF_DETACHED |
2545 		     IN6_IFF_ANYCAST |
2546 		     IN6_IFF_NOTREADY)) {
2547 			return (0);
2548 		}
2549 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2550 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2551 			/* skip unspecifed addresses */
2552 			return (0);
2553 		}
2554 		if (/*(local_scope == 0) && */
2555 		    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2556 			return (0);
2557 		}
2558 		if ((site_scope == 0) &&
2559 		    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2560 			return (0);
2561 		}
2562 	} else {
2563 		return (0);
2564 	}
2565 	return (1);
2566 }
2567 
2568 
2569 void
2570 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2571 {
2572 	struct mbuf *m, *m_at, *m_last;
2573 	struct sctp_nets *net;
2574 	struct sctp_init_msg *initm;
2575 	struct sctp_supported_addr_param *sup_addr;
2576 	struct sctp_ecn_supported_param *ecn;
2577 	struct sctp_prsctp_supported_param *prsctp;
2578 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
2579 	struct sctp_supported_chunk_types_param *pr_supported;
2580 	int cnt_inits_to=0;
2581 	int padval, ret;
2582 
2583 	/* INIT's always go to the primary (and usually ONLY address) */
2584 	m_last = NULL;
2585 	net = stcb->asoc.primary_destination;
2586 	if (net == NULL) {
2587 		net = TAILQ_FIRST(&stcb->asoc.nets);
2588 		if (net == NULL) {
2589 			/* TSNH */
2590 			return;
2591 		}
2592 		/* we confirm any address we send an INIT to */
2593 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2594 		sctp_set_primary_addr(stcb, NULL, net);
2595 	} else {
2596 		/* we confirm any address we send an INIT to */
2597 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2598 	}
2599 #ifdef SCTP_DEBUG
2600 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2601 		printf("Sending INIT to ");
2602 		sctp_print_address (rtcache_getdst(&net->ro));
2603 	}
2604 #endif
2605 	if (rtcache_getdst(&net->ro)->sa_family == AF_INET6) {
2606 		/* special hook, if we are sending to link local
2607 		 * it will not show up in our private address count.
2608 		 */
2609 		if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&net->ro)->sa_data))
2610 			cnt_inits_to = 1;
2611 	}
2612 	if (callout_pending(&net->rxt_timer.timer)) {
2613 		/* This case should not happen */
2614 		return;
2615 	}
2616 	/* start the INIT timer */
2617 	if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2618 		/* we are hosed since I can't start the INIT timer? */
2619 		return;
2620 	}
2621 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
2622 	if (m == NULL) {
2623 		/* No memory, INIT timer will re-attempt. */
2624 		return;
2625 	}
2626 	/* make it into a M_EXT */
2627 	MCLGET(m, M_DONTWAIT);
2628 	if ((m->m_flags & M_EXT) != M_EXT) {
2629 		/* Failed to get cluster buffer */
2630 		sctp_m_freem(m);
2631 		return;
2632 	}
2633 	m->m_data += SCTP_MIN_OVERHEAD;
2634 	m->m_len = sizeof(struct sctp_init_msg);
2635 	/* Now lets put the SCTP header in place */
2636 	initm = mtod(m, struct sctp_init_msg *);
2637 	initm->sh.src_port = inp->sctp_lport;
2638 	initm->sh.dest_port = stcb->rport;
2639 	initm->sh.v_tag = 0;
2640 	initm->sh.checksum = 0;	/* calculate later */
2641 	/* now the chunk header */
2642 	initm->msg.ch.chunk_type = SCTP_INITIATION;
2643 	initm->msg.ch.chunk_flags = 0;
2644 	/* fill in later from mbuf we build */
2645 	initm->msg.ch.chunk_length = 0;
2646 	/* place in my tag */
2647 	initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2648 	/* set up some of the credits. */
2649 	initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat,
2650 	    SCTP_MINIMAL_RWND));
2651 
2652 	initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2653 	initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2654 	initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2655 	/* now the address restriction */
2656 	sup_addr = (struct sctp_supported_addr_param *)((vaddr_t)initm +
2657 	    sizeof(*initm));
2658 	sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2659 	/* we support 2 types IPv6/IPv4 */
2660 	sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2661 					  sizeof(uint16_t));
2662 	sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2663 	sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2664 	m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2665 
2666 /*	if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2667 	if (inp->sctp_ep.adaption_layer_indicator) {
2668 		struct sctp_adaption_layer_indication *ali;
2669 		ali = (struct sctp_adaption_layer_indication *)(
2670 		    (vaddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2671 		ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2672 		ali->ph.param_length = htons(sizeof(*ali));
2673 		ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2674 		m->m_len += sizeof(*ali);
2675 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
2676 		    sizeof(*ali));
2677 	} else {
2678 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)sup_addr +
2679 		    sizeof(*sup_addr) + sizeof(uint16_t));
2680 	}
2681 
2682 	/* now any cookie time extensions */
2683 	if (stcb->asoc.cookie_preserve_req) {
2684 		struct sctp_cookie_perserve_param *cookie_preserve;
2685 		cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2686 		cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2687 		cookie_preserve->ph.param_length = htons(
2688 		    sizeof(*cookie_preserve));
2689 		cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2690 		m->m_len += sizeof(*cookie_preserve);
2691 		ecn = (struct sctp_ecn_supported_param *)(
2692 		    (vaddr_t)cookie_preserve + sizeof(*cookie_preserve));
2693 		stcb->asoc.cookie_preserve_req = 0;
2694 	}
2695 
2696 	/* ECN parameter */
2697 	if (sctp_ecn == 1) {
2698 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2699 		ecn->ph.param_length = htons(sizeof(*ecn));
2700 		m->m_len += sizeof(*ecn);
2701 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
2702 		    sizeof(*ecn));
2703 	} else {
2704 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
2705 	}
2706 	/* And now tell the peer we do pr-sctp */
2707 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2708 	prsctp->ph.param_length = htons(sizeof(*prsctp));
2709 	m->m_len += sizeof(*prsctp);
2710 
2711 
2712 	/* And now tell the peer we do all the extensions */
2713 	pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
2714 	   sizeof(*prsctp));
2715 
2716 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2717 	pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2718 	pr_supported->chunk_types[0] = SCTP_ASCONF;
2719 	pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2720 	pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2721 	pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2722 	pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2723 	pr_supported->chunk_types[5] = 0; /* pad */
2724 	pr_supported->chunk_types[6] = 0; /* pad */
2725 	pr_supported->chunk_types[7] = 0; /* pad */
2726 
2727 	m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2728 	/* ECN nonce: And now tell the peer we support ECN nonce */
2729 
2730 	if (sctp_ecn_nonce) {
2731 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
2732 		    sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2733 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2734 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2735 		m->m_len += sizeof(*ecn_nonce);
2736 	}
2737 
2738 	m_at = m;
2739 	/* now the addresses */
2740 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2741 		struct ifnet *ifn;
2742 		struct ifaddr *ifa;
2743 		int cnt;
2744 		int s;
2745 
2746 		cnt = cnt_inits_to;
2747 		s = pserialize_read_enter();
2748 		IFNET_READER_FOREACH(ifn) {
2749 			if ((stcb->asoc.loopback_scope == 0) &&
2750 			    (ifn->if_type == IFT_LOOP)) {
2751 				/*
2752 				 * Skip loopback devices if loopback_scope
2753 				 * not set
2754 				 */
2755 				continue;
2756 			}
2757 			IFADDR_READER_FOREACH(ifa, ifn) {
2758 				if (sctp_is_address_in_scope(ifa,
2759 				    stcb->asoc.ipv4_addr_legal,
2760 				    stcb->asoc.ipv6_addr_legal,
2761 				    stcb->asoc.loopback_scope,
2762 				    stcb->asoc.ipv4_local_scope,
2763 				    stcb->asoc.local_scope,
2764 				    stcb->asoc.site_scope) == 0) {
2765 					continue;
2766 				}
2767 				cnt++;
2768 			}
2769 		}
2770 		pserialize_read_exit(s);
2771 
2772 		if (cnt > 1) {
2773 			s = pserialize_read_enter();
2774 			IFNET_READER_FOREACH(ifn) {
2775 				if ((stcb->asoc.loopback_scope == 0) &&
2776 				    (ifn->if_type == IFT_LOOP)) {
2777 					/*
2778 					 * Skip loopback devices if loopback_scope
2779 					 * not set
2780 					 */
2781 					continue;
2782 				}
2783 				IFADDR_READER_FOREACH(ifa, ifn) {
2784 					if (sctp_is_address_in_scope(ifa,
2785 					    stcb->asoc.ipv4_addr_legal,
2786 					    stcb->asoc.ipv6_addr_legal,
2787 					    stcb->asoc.loopback_scope,
2788 					    stcb->asoc.ipv4_local_scope,
2789 					    stcb->asoc.local_scope,
2790 					    stcb->asoc.site_scope) == 0) {
2791 						continue;
2792 					}
2793 					m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2794 				}
2795 			}
2796 			pserialize_read_exit(s);
2797 		}
2798 	} else {
2799 		struct sctp_laddr *laddr;
2800 		int cnt;
2801 		cnt = cnt_inits_to;
2802 		/* First, how many ? */
2803 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2804 			if (laddr->ifa == NULL) {
2805 				continue;
2806 			}
2807 			if (laddr->ifa->ifa_addr == NULL)
2808 				continue;
2809 			if (sctp_is_address_in_scope(laddr->ifa,
2810 			    stcb->asoc.ipv4_addr_legal,
2811 			    stcb->asoc.ipv6_addr_legal,
2812 			    stcb->asoc.loopback_scope,
2813 			    stcb->asoc.ipv4_local_scope,
2814 			    stcb->asoc.local_scope,
2815 			    stcb->asoc.site_scope) == 0) {
2816 				continue;
2817 			}
2818 			cnt++;
2819 		}
2820 		/* To get through a NAT we only list addresses if
2821 		 * we have more than one. That way if you just
2822 		 * bind a single address we let the source of the init
2823 		 * dictate our address.
2824 		 */
2825 		if (cnt > 1) {
2826 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2827 				if (laddr->ifa == NULL) {
2828 					continue;
2829 				}
2830 				if (laddr->ifa->ifa_addr == NULL) {
2831 					continue;
2832 				}
2833 
2834 				if (sctp_is_address_in_scope(laddr->ifa,
2835 				    stcb->asoc.ipv4_addr_legal,
2836 				    stcb->asoc.ipv6_addr_legal,
2837 				    stcb->asoc.loopback_scope,
2838 				    stcb->asoc.ipv4_local_scope,
2839 				    stcb->asoc.local_scope,
2840 				    stcb->asoc.site_scope) == 0) {
2841 					continue;
2842 				}
2843 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2844 			}
2845 		}
2846 	}
2847 	/* calulate the size and update pkt header and chunk header */
2848 	m->m_pkthdr.len = 0;
2849 	for (m_at = m; m_at; m_at = m_at->m_next) {
2850 		if (m_at->m_next == NULL)
2851 			m_last = m_at;
2852 		m->m_pkthdr.len += m_at->m_len;
2853 	}
2854 	initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2855 	    sizeof(struct sctphdr)));
2856 #ifdef SCTP_DEBUG
2857 	printf("chunk_length %d\n", ntohs(initm->msg.ch.chunk_length));
2858 #endif
2859 	/* We pass 0 here to NOT set IP_DF if its IPv4, we
2860 	 * ignore the return here since the timer will drive
2861 	 * a retranmission.
2862 	 */
2863 
2864 	/* I don't expect this to execute but we will be safe here */
2865 	padval = m->m_pkthdr.len % 4;
2866 	if ((padval) && (m_last)) {
2867 		/* The compiler worries that m_last may not be
2868 		 * set even though I think it is impossible :->
2869 		 * however we add m_last here just in case.
2870 		 */
2871 		ret = sctp_add_pad_tombuf(m_last, (4-padval));
2872 		if (ret) {
2873 			/* Houston we have a problem, no space */
2874 			sctp_m_freem(m);
2875 			return;
2876 		}
2877 		m->m_pkthdr.len += padval;
2878 	}
2879 #ifdef SCTP_DEBUG
2880 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2881 		printf("Calling lowlevel output stcb:%p net:%p\n",
2882 		       stcb, net);
2883 	}
2884 #endif
2885 	ret = sctp_lowlevel_chunk_output(inp, stcb, net,
2886 		  rtcache_getdst(&net->ro), m, 0, 0, NULL, 0);
2887 #ifdef SCTP_DEBUG
2888 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2889 		printf("Low level output returns %d\n", ret);
2890 	}
2891 #endif
2892 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
2893 	SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
2894 }
2895 
2896 struct mbuf *
2897 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
2898     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
2899 {
2900 	/* Given a mbuf containing an INIT or INIT-ACK
2901 	 * with the param_offset being equal to the
2902 	 * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
2903 	 * parse through the parameters to the end of the mbuf verifying
2904 	 * that all parameters are known.
2905 	 *
2906 	 * For unknown parameters build and return a mbuf with
2907 	 * UNRECOGNIZED_PARAMETER errors. If the flags indicate
2908 	 * to stop processing this chunk stop, and set *abort_processing
2909 	 * to 1.
2910 	 *
2911 	 * By having param_offset be pre-set to where parameters begin
2912 	 * it is hoped that this routine may be reused in the future
2913 	 * by new features.
2914 	 */
2915 	struct sctp_paramhdr *phdr, params;
2916 
2917 	struct mbuf *mat, *op_err;
2918 	char tempbuf[2048];
2919 	int at, limit, pad_needed;
2920 	uint16_t ptype, plen;
2921 	int err_at;
2922 
2923 	*abort_processing = 0;
2924 	mat = in_initpkt;
2925 	err_at = 0;
2926 	limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
2927 #ifdef SCTP_DEBUG
2928 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2929 		printf("Limit is %d bytes\n", limit);
2930 	}
2931 #endif
2932 	at = param_offset;
2933 	op_err = NULL;
2934 
2935 	phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
2936 	while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
2937 		ptype = ntohs(phdr->param_type);
2938 		plen = ntohs(phdr->param_length);
2939 		limit -= SCTP_SIZE32(plen);
2940 		if (plen < sizeof(struct sctp_paramhdr)) {
2941 #ifdef SCTP_DEBUG
2942 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2943 			printf("sctp_output.c:Impossible length in parameter < %d\n", plen);
2944 	}
2945 #endif
2946 			*abort_processing = 1;
2947 			break;
2948 		}
2949 		/* All parameters for all chunks that we
2950 		 * know/understand are listed here. We process
2951 		 * them other places and make appropriate
2952 		 * stop actions per the upper bits. However
2953 		 * this is the generic routine processor's can
2954 		 * call to get back an operr.. to either incorporate (init-ack)
2955 		 * or send.
2956 		 */
2957 		if ((ptype == SCTP_HEARTBEAT_INFO) ||
2958 		    (ptype == SCTP_IPV4_ADDRESS) ||
2959 		    (ptype == SCTP_IPV6_ADDRESS) ||
2960 		    (ptype == SCTP_STATE_COOKIE) ||
2961 		    (ptype == SCTP_UNRECOG_PARAM) ||
2962 		    (ptype == SCTP_COOKIE_PRESERVE) ||
2963 		    (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
2964 		    (ptype == SCTP_PRSCTP_SUPPORTED) ||
2965 		    (ptype == SCTP_ADD_IP_ADDRESS) ||
2966 		    (ptype == SCTP_DEL_IP_ADDRESS) ||
2967 		    (ptype == SCTP_ECN_CAPABLE) ||
2968 		    (ptype == SCTP_ULP_ADAPTION) ||
2969 		    (ptype == SCTP_ERROR_CAUSE_IND) ||
2970 		    (ptype == SCTP_SET_PRIM_ADDR) ||
2971 		    (ptype == SCTP_SUCCESS_REPORT) ||
2972 		    (ptype == SCTP_ULP_ADAPTION) ||
2973 		    (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
2974 		    (ptype == SCTP_ECN_NONCE_SUPPORTED)
2975 			) {
2976 			/* no skip it */
2977 			at += SCTP_SIZE32(plen);
2978 		} else if (ptype == SCTP_HOSTNAME_ADDRESS) {
2979 			/* We can NOT handle HOST NAME addresses!! */
2980 #ifdef SCTP_DEBUG
2981 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2982 		printf("Can't handle hostname addresses.. abort processing\n");
2983 	}
2984 #endif
2985 			*abort_processing = 1;
2986 			if (op_err == NULL) {
2987 				/* Ok need to try to get a mbuf */
2988 				MGETHDR(op_err, M_DONTWAIT, MT_DATA);
2989 				if (op_err) {
2990 					op_err->m_len = 0;
2991 					op_err->m_pkthdr.len = 0;
2992 					/* pre-reserve space for ip and sctp header  and chunk hdr*/
2993 					op_err->m_data += sizeof(struct ip6_hdr);
2994 					op_err->m_data += sizeof(struct sctphdr);
2995 					op_err->m_data += sizeof(struct sctp_chunkhdr);
2996 				}
2997 			}
2998 			if (op_err) {
2999 				/* If we have space */
3000 				struct sctp_paramhdr s;
3001 				if (err_at % 4) {
3002 					u_int32_t cpthis=0;
3003 					pad_needed = 4 - (err_at % 4);
3004 					m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
3005 					err_at += pad_needed;
3006 				}
3007 				s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3008 				s.param_length = htons(sizeof(s) + plen);
3009 				m_copyback(op_err, err_at, sizeof(s), (void *)&s);
3010 				err_at += sizeof(s);
3011 				phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3012 				if (phdr == NULL) {
3013 					sctp_m_freem(op_err);
3014 					/* we are out of memory but we
3015 					 * still need to have a look at what to
3016 					 * do (the system is in trouble though).
3017 					 */
3018 					return (NULL);
3019 				}
3020 				m_copyback(op_err, err_at, plen, (void *)phdr);
3021 				err_at += plen;
3022 			}
3023 			return (op_err);
3024 		} else {
3025 			/* we do not recognize the parameter
3026 			 * figure out what we do.
3027 			 */
3028 #ifdef SCTP_DEBUG
3029 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3030 				printf("Got parameter type %x - unknown\n",
3031 				       (u_int)ptype);
3032 			}
3033 #endif
3034 			if ((ptype & 0x4000) == 0x4000) {
3035 				/* Report bit is set?? */
3036 #ifdef SCTP_DEBUG
3037 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3038 					printf("Report bit is set\n");
3039 				}
3040 #endif
3041 				if (op_err == NULL) {
3042 					/* Ok need to try to get an mbuf */
3043 					MGETHDR(op_err, M_DONTWAIT, MT_DATA);
3044 					if (op_err) {
3045 						op_err->m_len = 0;
3046 						op_err->m_pkthdr.len = 0;
3047 						op_err->m_data += sizeof(struct ip6_hdr);
3048 						op_err->m_data += sizeof(struct sctphdr);
3049 						op_err->m_data += sizeof(struct sctp_chunkhdr);
3050 					}
3051 				}
3052 				if (op_err) {
3053 					/* If we have space */
3054 					struct sctp_paramhdr s;
3055 					if (err_at % 4) {
3056 						u_int32_t cpthis=0;
3057 						pad_needed = 4 - (err_at % 4);
3058 						m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
3059 						err_at += pad_needed;
3060  					}
3061 					s.param_type = htons(SCTP_UNRECOG_PARAM);
3062 					s.param_length = htons(sizeof(s) + plen);
3063 					m_copyback(op_err, err_at, sizeof(s), (void *)&s);
3064 					err_at += sizeof(s);
3065 					if (plen > sizeof(tempbuf)) {
3066 						plen = sizeof(tempbuf);
3067 					}
3068 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3069 					if (phdr == NULL) {
3070 						sctp_m_freem(op_err);
3071 						/* we are out of memory but we
3072 						 * still need to have a look at what to
3073 						 * do (the system is in trouble though).
3074 						 */
3075 						goto more_processing;
3076 					}
3077 					m_copyback(op_err, err_at, plen, (void *)phdr);
3078 					err_at += plen;
3079 				}
3080 			}
3081 		more_processing:
3082 			if ((ptype & 0x8000) == 0x0000) {
3083 #ifdef SCTP_DEBUG
3084 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3085 					printf("Abort bit is now setting1\n");
3086 				}
3087 #endif
3088 				return (op_err);
3089 			} else {
3090 				/* skip this chunk and continue processing */
3091 				at += SCTP_SIZE32(plen);
3092 			}
3093 
3094 		}
3095 		phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3096 	}
3097 	return (op_err);
3098 }
3099 
3100 static int
3101 sctp_are_there_new_addresses(struct sctp_association *asoc,
3102     struct mbuf *in_initpkt, int iphlen, int offset)
3103 {
3104 	/*
3105 	 * Given a INIT packet, look through the packet to verify that
3106 	 * there are NO new addresses. As we go through the parameters
3107 	 * add reports of any un-understood parameters that require an
3108 	 * error.  Also we must return (1) to drop the packet if we see
3109 	 * a un-understood parameter that tells us to drop the chunk.
3110 	 */
3111 	struct sockaddr_in sin4, *sa4;
3112 	struct sockaddr_in6 sin6, *sa6;
3113 	struct sockaddr *sa_touse;
3114 	struct sockaddr *sa;
3115 	struct sctp_paramhdr *phdr, params;
3116 	struct ip *iph;
3117 	struct mbuf *mat;
3118 	uint16_t ptype, plen;
3119 	uint8_t fnd;
3120 	struct sctp_nets *net;
3121 
3122 	memset(&sin4, 0, sizeof(sin4));
3123 	memset(&sin6, 0, sizeof(sin6));
3124 	sin4.sin_family = AF_INET;
3125 	sin4.sin_len = sizeof(sin4);
3126 	sin6.sin6_family = AF_INET6;
3127 	sin6.sin6_len = sizeof(sin6);
3128 
3129 	sa_touse = NULL;
3130 	/* First what about the src address of the pkt ? */
3131 	iph = mtod(in_initpkt, struct ip *);
3132 	if (iph->ip_v == IPVERSION) {
3133 		/* source addr is IPv4 */
3134 		sin4.sin_addr = iph->ip_src;
3135 		sa_touse = (struct sockaddr *)&sin4;
3136 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3137 		/* source addr is IPv6 */
3138 		struct ip6_hdr *ip6h;
3139 		ip6h = mtod(in_initpkt, struct ip6_hdr *);
3140 		sin6.sin6_addr = ip6h->ip6_src;
3141 		sa_touse = (struct sockaddr *)&sin6;
3142 	} else {
3143 		return (1);
3144 	}
3145 
3146 	fnd = 0;
3147 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3148 		sa = (struct sockaddr *)&net->ro.ro_sa;
3149 		if (sa->sa_family == sa_touse->sa_family) {
3150 			if (sa->sa_family == AF_INET) {
3151 			    sa4 = (struct sockaddr_in *)sa;
3152 				if (sa4->sin_addr.s_addr ==
3153 				    sin4.sin_addr.s_addr) {
3154 					fnd = 1;
3155 					break;
3156 				}
3157 			} else if (sa->sa_family == AF_INET6) {
3158 				sa6 = (struct sockaddr_in6 *)sa;
3159 				if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3160 				    &sin6.sin6_addr)) {
3161 					fnd = 1;
3162 					break;
3163 				}
3164 			}
3165 		}
3166 	}
3167 	if (fnd == 0) {
3168 		/* New address added! no need to look futher. */
3169 		return (1);
3170 	}
3171 	/* Ok so far lets munge through the rest of the packet */
3172 	mat = in_initpkt;
3173 	sa_touse = NULL;
3174 	offset += sizeof(struct sctp_init_chunk);
3175 	phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3176 	while (phdr) {
3177 		ptype = ntohs(phdr->param_type);
3178 		plen = ntohs(phdr->param_length);
3179 		if (ptype == SCTP_IPV4_ADDRESS) {
3180 			struct sctp_ipv4addr_param *p4, p4_buf;
3181 
3182 			phdr = sctp_get_next_param(mat, offset,
3183 			    (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3184 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
3185 			    phdr == NULL) {
3186                                 return (1);
3187                         }
3188 			p4 = (struct sctp_ipv4addr_param *)phdr;
3189 			sin4.sin_addr.s_addr = p4->addr;
3190 			sa_touse = (struct sockaddr *)&sin4;
3191 		} else if (ptype == SCTP_IPV6_ADDRESS) {
3192 			struct sctp_ipv6addr_param *p6, p6_buf;
3193 
3194 			phdr = sctp_get_next_param(mat, offset,
3195 			    (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3196 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
3197 			    phdr == NULL) {
3198                                 return (1);
3199                         }
3200 			p6 = (struct sctp_ipv6addr_param *)phdr;
3201 			memcpy((void *)&sin6.sin6_addr, p6->addr,
3202 			    sizeof(p6->addr));
3203 			sa_touse = (struct sockaddr *)&sin4;
3204 		}
3205 
3206 		if (sa_touse) {
3207 			/* ok, sa_touse points to one to check */
3208 			fnd = 0;
3209 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3210 				sa = (struct sockaddr *)&net->ro.ro_sa;
3211 				if (sa->sa_family != sa_touse->sa_family) {
3212 					continue;
3213 				}
3214 				if (sa->sa_family == AF_INET) {
3215 					sa4 = (struct sockaddr_in *)sa;
3216 					if (sa4->sin_addr.s_addr ==
3217 					    sin4.sin_addr.s_addr) {
3218 						fnd = 1;
3219 						break;
3220 					}
3221 				} else if (sa->sa_family == AF_INET6) {
3222 					sa6 = (struct sockaddr_in6 *)sa;
3223 					if (SCTP6_ARE_ADDR_EQUAL(
3224 					    &sa6->sin6_addr, &sin6.sin6_addr)) {
3225 						fnd = 1;
3226 						break;
3227 					}
3228 				}
3229 			}
3230 			if (!fnd) {
3231 				/* New addr added! no need to look further */
3232 				return (1);
3233 			}
3234 		}
3235 		offset += SCTP_SIZE32(plen);
3236 		phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3237 	}
3238 	return (0);
3239 }
3240 
3241 /*
3242  * Given a MBUF chain that was sent into us containing an
3243  * INIT. Build a INIT-ACK with COOKIE and send back.
3244  * We assume that the in_initpkt has done a pullup to
3245  * include IPv6/4header, SCTP header and initial part of
3246  * INIT message (i.e. the struct sctp_init_msg).
3247  */
3248 void
3249 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3250     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3251     struct sctp_init_chunk *init_chk)
3252 {
3253 	struct sctp_association *asoc;
3254 	struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3255 	struct sctp_init_msg *initackm_out;
3256 	struct sctp_ecn_supported_param *ecn;
3257 	struct sctp_prsctp_supported_param *prsctp;
3258 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
3259 	struct sctp_supported_chunk_types_param *pr_supported;
3260 	struct sockaddr_storage store;
3261 	struct sockaddr_in *sin;
3262 	struct sockaddr_in6 *sin6;
3263 	struct route *ro;
3264 	struct ip *iph;
3265 	struct ip6_hdr *ip6;
3266 	const struct sockaddr *to;
3267 	struct sctp_state_cookie stc;
3268 	struct sctp_nets *net=NULL;
3269 	int cnt_inits_to=0;
3270 	uint16_t his_limit, i_want;
3271 	int abort_flag, padval, sz_of;
3272 	struct rtentry *rt;
3273 
3274 	if (stcb) {
3275 		asoc = &stcb->asoc;
3276 	} else {
3277 		asoc = NULL;
3278 	}
3279 	m_last = NULL;
3280 	if ((asoc != NULL) &&
3281 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3282 	    (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3283 		/* new addresses, out of here in non-cookie-wait states */
3284 		/*
3285 		 * Send a ABORT, we don't add the new address error clause though
3286 		 * we even set the T bit and copy in the 0 tag.. this looks no
3287 		 * different than if no listner was present.
3288 		 */
3289 		sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3290 		return;
3291 	}
3292 	abort_flag = 0;
3293 	op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3294 	    (offset+sizeof(struct sctp_init_chunk)),
3295 	    &abort_flag, (struct sctp_chunkhdr *)init_chk);
3296 	if (abort_flag) {
3297 		sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3298 		return;
3299 	}
3300 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
3301 	if (m == NULL) {
3302 		/* No memory, INIT timer will re-attempt. */
3303 		if (op_err)
3304 			sctp_m_freem(op_err);
3305 		return;
3306 	}
3307 	MCLGET(m, M_DONTWAIT);
3308 	if ((m->m_flags & M_EXT) != M_EXT) {
3309 		/* Failed to get cluster buffer */
3310 		if (op_err)
3311 			sctp_m_freem(op_err);
3312 		sctp_m_freem(m);
3313 		return;
3314 	}
3315 	m->m_data += SCTP_MIN_OVERHEAD;
3316 	m_reset_rcvif(m);
3317 	m->m_len = sizeof(struct sctp_init_msg);
3318 
3319 	/* the time I built cookie */
3320 	SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3321 
3322 	/* populate any tie tags */
3323 	if (asoc != NULL) {
3324 		/* unlock before tag selections */
3325 		SCTP_TCB_UNLOCK(stcb);
3326 		if (asoc->my_vtag_nonce == 0)
3327 			asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3328 		stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3329 
3330 		if (asoc->peer_vtag_nonce == 0)
3331 			asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3332 		stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3333 
3334 		stc.cookie_life = asoc->cookie_life;
3335 		net = asoc->primary_destination;
3336 		/* now we must relock */
3337 		SCTP_INP_RLOCK(inp);
3338 		/* we may be in trouble here if the inp got freed
3339 		 * most likely this set of tests will protect
3340 		 * us but there is a chance not.
3341 		 */
3342 		if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3343 			if (op_err)
3344 				sctp_m_freem(op_err);
3345 			sctp_m_freem(m);
3346 			sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3347 			return;
3348 		}
3349 		SCTP_TCB_LOCK(stcb);
3350 		SCTP_INP_RUNLOCK(stcb->sctp_ep);
3351 	} else {
3352 		stc.tie_tag_my_vtag = 0;
3353 		stc.tie_tag_peer_vtag = 0;
3354 		/* life I will award this cookie */
3355 		stc.cookie_life = inp->sctp_ep.def_cookie_life;
3356 	}
3357 
3358 	/* copy in the ports for later check */
3359 	stc.myport = sh->dest_port;
3360 	stc.peerport = sh->src_port;
3361 
3362 	/*
3363 	 * If we wanted to honor cookie life extentions, we would add
3364 	 * to stc.cookie_life. For now we should NOT honor any extension
3365 	 */
3366 	stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3367 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3368 		struct inpcb *in_inp;
3369 		/* Its a V6 socket */
3370 		in_inp = (struct inpcb *)inp;
3371 		stc.ipv6_addr_legal = 1;
3372 		/* Now look at the binding flag to see if V4 will be legal */
3373 		if (
3374 #if defined(__FreeBSD__) || defined(__APPLE__)
3375 		    (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3376 #elif defined(__OpenBSD__)
3377 		    (0)	/* For openbsd we do dual bind only */
3378 #else
3379 		    (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3380 #endif
3381 		    == 0) {
3382 			stc.ipv4_addr_legal = 1;
3383 		} else {
3384 			/* V4 addresses are NOT legal on the association */
3385 			stc.ipv4_addr_legal = 0;
3386 		}
3387 	} else {
3388 		/* Its a V4 socket, no - V6 */
3389 		stc.ipv4_addr_legal = 1;
3390 		stc.ipv6_addr_legal = 0;
3391 	}
3392 
3393 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3394 	stc.ipv4_scope = 1;
3395 #else
3396 	stc.ipv4_scope = 0;
3397 #endif
3398 	/* now for scope setup */
3399 	memset((void *)&store, 0, sizeof(store));
3400 	sin = (struct sockaddr_in *)&store;
3401 	sin6 = (struct sockaddr_in6 *)&store;
3402 	if (net == NULL) {
3403 		to = (struct sockaddr *)&store;
3404 		iph = mtod(init_pkt, struct ip *);
3405 		if (iph->ip_v == IPVERSION) {
3406 			struct in_addr addr;
3407 			static struct route iproute;
3408 
3409 			sin->sin_family = AF_INET;
3410 			sin->sin_len = sizeof(struct sockaddr_in);
3411 			sin->sin_port = sh->src_port;
3412 			sin->sin_addr = iph->ip_src;
3413 			/* lookup address */
3414 			stc.address[0] = sin->sin_addr.s_addr;
3415 			stc.address[1] = 0;
3416 			stc.address[2] = 0;
3417 			stc.address[3] = 0;
3418 			stc.addr_type = SCTP_IPV4_ADDRESS;
3419 			/* local from address */
3420 			memset(&iproute, 0, sizeof(iproute));
3421 			ro = &iproute;
3422 
3423 			/* XXX */
3424 			rt = rtcache_lookup(ro, (struct sockaddr *) sin);
3425 			rtcache_unref(rt, ro);
3426 			addr = sctp_ipv4_source_address_selection(inp, NULL,
3427 			    ro, NULL, 0);
3428 			stc.laddress[0] = addr.s_addr;
3429 			stc.laddress[1] = 0;
3430 			stc.laddress[2] = 0;
3431 			stc.laddress[3] = 0;
3432 			stc.laddr_type = SCTP_IPV4_ADDRESS;
3433 			/* scope_id is only for v6 */
3434 			stc.scope_id = 0;
3435 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3436 			if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3437 				stc.ipv4_scope = 1;
3438 			}
3439 #else
3440 			stc.ipv4_scope = 1;
3441 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3442 			/* Must use the address in this case */
3443 			if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3444 				stc.loopback_scope = 1;
3445 				stc.ipv4_scope = 1;
3446 				stc.site_scope = 1;
3447 				stc.local_scope = 1;
3448 			}
3449 		} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3450 			struct in6_addr addr;
3451                         static struct route iproute6;
3452 			ip6 = mtod(init_pkt, struct ip6_hdr *);
3453 			sin6->sin6_family = AF_INET6;
3454 			sin6->sin6_len = sizeof(struct sockaddr_in6);
3455 			sin6->sin6_port = sh->src_port;
3456 			sin6->sin6_addr = ip6->ip6_src;
3457 			/* lookup address */
3458 			memcpy(&stc.address, &sin6->sin6_addr,
3459 			    sizeof(struct in6_addr));
3460 			sin6->sin6_scope_id = 0;
3461 			stc.addr_type = SCTP_IPV6_ADDRESS;
3462 			stc.scope_id = 0;
3463 			if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3464 				stc.loopback_scope = 1;
3465 				stc.local_scope = 1;
3466 				stc.site_scope = 1;
3467 				stc.ipv4_scope = 1;
3468 			} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3469 				/*
3470 				 * If the new destination is a LINK_LOCAL
3471 				 * we must have common both site and local
3472 				 * scope. Don't set local scope though since
3473 				 * we must depend on the source to be added
3474 				 * implicitly. We cannot assure just because
3475 				 * we share one link that all links are common.
3476 				 *
3477 				 * XXX: never treat link-local case explicitly.
3478 				 * Use general routines defined in scope6.c.
3479 				 * (jinmei@kame)
3480 				 */
3481 				stc.local_scope = 0;
3482 				stc.site_scope = 1;
3483  				stc.ipv4_scope = 1;
3484 				/* we start counting for the private
3485 				 * address stuff at 1. since the link
3486 				 * local we source from won't show
3487 				 * up in our scoped count.
3488 				 */
3489 				cnt_inits_to=1;
3490 				/* pull out the scope_id from incoming pkt */
3491 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
3492 				(void)in6_recoverscope(sin6, &in6_src,
3493 				    m_get_rcvif_NOMPSAFE(init_pkt));
3494 				in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3495 				    NULL);
3496 #else
3497 				(void)sa6_recoverscope(sin6);
3498 #endif
3499 				stc.scope_id = sin6->sin6_scope_id;
3500 
3501 			} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3502 				/*
3503 				 * If the new destination is SITE_LOCAL
3504 				 * then we must have site scope in common.
3505 				 */
3506 				stc.site_scope = 1;
3507 			}
3508 			/* local from address */
3509 			memset(&iproute6, 0, sizeof(iproute6));
3510 			ro = (struct route *)&iproute6;
3511 			/* XXX */
3512 			rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
3513 			rtcache_unref(rt, ro);
3514 			addr = sctp_ipv6_source_address_selection(inp, NULL,
3515 			    ro, NULL, 0);
3516 			memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3517 			stc.laddr_type = SCTP_IPV6_ADDRESS;
3518 		}
3519 	} else {
3520 		/* set the scope per the existing tcb */
3521 		struct sctp_nets *lnet;
3522 
3523 		stc.loopback_scope = asoc->loopback_scope;
3524 		stc.ipv4_scope = asoc->ipv4_local_scope;
3525 		stc.site_scope = asoc->site_scope;
3526 		stc.local_scope = asoc->local_scope;
3527 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3528 			if (rtcache_getdst(&lnet->ro)->sa_family == AF_INET6) {
3529 				if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&lnet->ro)->sa_data)) {
3530 					/* if we have a LL address, start counting
3531 					 * at 1.
3532 					 */
3533  					cnt_inits_to = 1;
3534 				}
3535 			}
3536 		}
3537 
3538 		/* use the net pointer */
3539 		to = rtcache_getdst(&net->ro);
3540 		if (to->sa_family == AF_INET) {
3541 			memcpy(&stc.address[0], to, sizeof(struct in_addr));
3542 			stc.address[1] = 0;
3543 			stc.address[2] = 0;
3544 			stc.address[3] = 0;
3545 			stc.addr_type = SCTP_IPV4_ADDRESS;
3546 			if (net->src_addr_selected == 0) {
3547 				/* strange case here, the INIT
3548 				 * should have did the selection.
3549 				 */
3550 				net->_s_addr.sin.sin_addr =
3551 				    sctp_ipv4_source_address_selection(inp,
3552 				    stcb, &net->ro, net, 0);
3553 				net->src_addr_selected = 1;
3554 
3555 			}
3556 
3557 			stc.laddress[0] = net->_s_addr.sin.sin_addr.s_addr;
3558 			stc.laddress[1] = 0;
3559 			stc.laddress[2] = 0;
3560 			stc.laddress[3] = 0;
3561 			stc.laddr_type = SCTP_IPV4_ADDRESS;
3562 		} else if (to->sa_family == AF_INET6) {
3563 			memcpy(&stc.address, &to->sa_data,
3564 			    sizeof(struct in6_addr));
3565 			stc.addr_type = SCTP_IPV6_ADDRESS;
3566 			if (net->src_addr_selected == 0) {
3567 				/* strange case here, the INIT
3568 				 * should have did the selection.
3569 				 */
3570 				net->_s_addr.sin6.sin6_addr =
3571 				    sctp_ipv6_source_address_selection(inp,
3572 				    stcb, &net->ro, net, 0);
3573 				net->src_addr_selected = 1;
3574 			}
3575 			memcpy(&stc.laddress, &net->_s_addr.sin6.sin6_addr,
3576 			    sizeof(struct in6_addr));
3577 			stc.laddr_type = SCTP_IPV6_ADDRESS;
3578 		}
3579 	}
3580 	/* Now lets put the SCTP header in place */
3581 	initackm_out = mtod(m, struct sctp_init_msg *);
3582 	initackm_out->sh.src_port = inp->sctp_lport;
3583 	initackm_out->sh.dest_port = sh->src_port;
3584 	initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3585 	/* Save it off for quick ref */
3586 	stc.peers_vtag = init_chk->init.initiate_tag;
3587 	initackm_out->sh.checksum = 0;	/* calculate later */
3588 	/* who are we */
3589 	strncpy(stc.identification, SCTP_VERSION_STRING,
3590 	   min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3591 	/* now the chunk header */
3592 	initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3593 	initackm_out->msg.ch.chunk_flags = 0;
3594 	/* fill in later from mbuf we build */
3595 	initackm_out->msg.ch.chunk_length = 0;
3596 	/* place in my tag */
3597 	if ((asoc != NULL) &&
3598 	    ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3599 	     (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3600 		/* re-use the v-tags and init-seq here */
3601 		initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3602 		initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3603 	} else {
3604 		initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3605 		/* get a TSN to use too */
3606 		initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3607 	}
3608 	/* save away my tag to */
3609 	stc.my_vtag = initackm_out->msg.init.initiate_tag;
3610 
3611 	/* set up some of the credits. */
3612 	initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND));
3613 	/* set what I want */
3614 	his_limit = ntohs(init_chk->init.num_inbound_streams);
3615 	/* choose what I want */
3616 	if (asoc != NULL) {
3617 		if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3618 			i_want = asoc->streamoutcnt;
3619 		} else {
3620 			i_want = inp->sctp_ep.pre_open_stream_count;
3621 		}
3622 	} else {
3623 		i_want = inp->sctp_ep.pre_open_stream_count;
3624 	}
3625 	if (his_limit < i_want) {
3626 		/* I Want more :< */
3627 		initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3628 	} else {
3629 		/* I can have what I want :> */
3630 		initackm_out->msg.init.num_outbound_streams = htons(i_want);
3631 	}
3632 	/* tell him his limt. */
3633 	initackm_out->msg.init.num_inbound_streams =
3634 	    htons(inp->sctp_ep.max_open_streams_intome);
3635 	/* setup the ECN pointer */
3636 
3637 /*	if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3638 	if (inp->sctp_ep.adaption_layer_indicator) {
3639 		struct sctp_adaption_layer_indication *ali;
3640 		ali = (struct sctp_adaption_layer_indication *)(
3641 		    (vaddr_t)initackm_out + sizeof(*initackm_out));
3642 		ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3643 		ali->ph.param_length = htons(sizeof(*ali));
3644 		ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3645 		m->m_len += sizeof(*ali);
3646 		ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
3647 		    sizeof(*ali));
3648 	} else {
3649 		ecn = (struct sctp_ecn_supported_param*)(
3650 		    (vaddr_t)initackm_out + sizeof(*initackm_out));
3651 	}
3652 
3653 	/* ECN parameter */
3654 	if (sctp_ecn == 1) {
3655 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3656 		ecn->ph.param_length = htons(sizeof(*ecn));
3657 		m->m_len += sizeof(*ecn);
3658 
3659 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
3660 		    sizeof(*ecn));
3661 	} else {
3662 		prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
3663 	}
3664 	/* And now tell the peer we do  pr-sctp */
3665 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3666 	prsctp->ph.param_length = htons(sizeof(*prsctp));
3667 	m->m_len += sizeof(*prsctp);
3668 
3669 
3670 	/* And now tell the peer we do all the extensions */
3671 	pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
3672 	   sizeof(*prsctp));
3673 
3674 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3675 	pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3676 	pr_supported->chunk_types[0] = SCTP_ASCONF;
3677 	pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3678 	pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3679 	pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3680 	pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3681 	pr_supported->chunk_types[5] = 0; /* pad */
3682 	pr_supported->chunk_types[6] = 0; /* pad */
3683 	pr_supported->chunk_types[7] = 0; /* pad */
3684 
3685 	m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3686 	if (sctp_ecn_nonce) {
3687 		/* ECN nonce: And now tell the peer we support ECN nonce */
3688 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
3689 		     sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3690 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3691 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3692 		m->m_len += sizeof(*ecn_nonce);
3693 	}
3694 
3695 	m_at = m;
3696 	/* now the addresses */
3697 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3698 		struct ifnet *ifn;
3699 		struct ifaddr *ifa;
3700 		int cnt = cnt_inits_to;
3701 		int s;
3702 
3703 		s = pserialize_read_enter();
3704 		IFNET_READER_FOREACH(ifn) {
3705 			if ((stc.loopback_scope == 0) &&
3706 			    (ifn->if_type == IFT_LOOP)) {
3707 				/*
3708 				 * Skip loopback devices if loopback_scope
3709 				 * not set
3710 				 */
3711 				continue;
3712 			}
3713 			IFADDR_READER_FOREACH(ifa, ifn) {
3714 				if (sctp_is_address_in_scope(ifa,
3715 				    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3716 				    stc.loopback_scope, stc.ipv4_scope,
3717 				    stc.local_scope, stc.site_scope) == 0) {
3718 					continue;
3719 				}
3720 				cnt++;
3721 			}
3722 		}
3723 		pserialize_read_exit(s);
3724 
3725 		if (cnt > 1) {
3726 			s = pserialize_read_enter();
3727 			IFNET_READER_FOREACH(ifn) {
3728 				if ((stc.loopback_scope == 0) &&
3729 				    (ifn->if_type == IFT_LOOP)) {
3730 					/*
3731 					 * Skip loopback devices if
3732 					 * loopback_scope not set
3733 					 */
3734 					continue;
3735 				}
3736 				IFADDR_READER_FOREACH(ifa, ifn) {
3737 					if (sctp_is_address_in_scope(ifa,
3738 					    stc.ipv4_addr_legal,
3739 					    stc.ipv6_addr_legal,
3740 					    stc.loopback_scope, stc.ipv4_scope,
3741 					    stc.local_scope, stc.site_scope) == 0) {
3742 						continue;
3743 					}
3744 					m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3745 				}
3746 			}
3747 			pserialize_read_exit(s);
3748 		}
3749 	} else {
3750 		struct sctp_laddr *laddr;
3751 		int cnt;
3752 		cnt = cnt_inits_to;
3753 		/* First, how many ? */
3754 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3755 			if (laddr->ifa == NULL) {
3756 				continue;
3757 			}
3758 			if (laddr->ifa->ifa_addr == NULL)
3759 				continue;
3760 			if (sctp_is_address_in_scope(laddr->ifa,
3761 			    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3762 			    stc.loopback_scope, stc.ipv4_scope,
3763 			    stc.local_scope, stc.site_scope) == 0) {
3764 				continue;
3765 			}
3766 			cnt++;
3767 		}
3768 		/* If we bind a single address only we won't list
3769 		 * any. This way you can get through a NAT
3770 		 */
3771 		if (cnt > 1) {
3772 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3773 				if (laddr->ifa == NULL) {
3774 #ifdef SCTP_DEBUG
3775 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3776 						printf("Help I have fallen and I can't get up!\n");
3777 					}
3778 #endif
3779 					continue;
3780 				}
3781 				if (laddr->ifa->ifa_addr == NULL)
3782 					continue;
3783 				if (sctp_is_address_in_scope(laddr->ifa,
3784 				    stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3785 				    stc.loopback_scope, stc.ipv4_scope,
3786 				    stc.local_scope, stc.site_scope) == 0) {
3787 					continue;
3788 				}
3789 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3790 			}
3791 		}
3792 	}
3793 
3794 	/* tack on the operational error if present */
3795 	if (op_err) {
3796 		if (op_err->m_pkthdr.len % 4) {
3797 			/* must add a pad to the param */
3798 			u_int32_t cpthis=0;
3799 			int padlen;
3800 			padlen = 4 - (op_err->m_pkthdr.len % 4);
3801 			m_copyback(op_err, op_err->m_pkthdr.len, padlen, (void *)&cpthis);
3802 		}
3803 		while (m_at->m_next != NULL) {
3804 			m_at = m_at->m_next;
3805 		}
3806 		m_at->m_next = op_err;
3807 		while (m_at->m_next != NULL) {
3808 			m_at = m_at->m_next;
3809 		}
3810 	}
3811 	/* Get total size of init packet */
3812 	sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3813 	/* pre-calulate the size and update pkt header and chunk header */
3814 	m->m_pkthdr.len = 0;
3815 	for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3816 		m->m_pkthdr.len += m_tmp->m_len;
3817 		if (m_tmp->m_next == NULL) {
3818 			/* m_tmp should now point to last one */
3819 			break;
3820 		}
3821 	}
3822 	/*
3823 	 * Figure now the size of the cookie. We know the size of the
3824 	 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3825 	 * COOKIE-STRUCTURE and SIGNATURE.
3826 	 */
3827 
3828 	/*
3829 	 * take our earlier INIT calc and add in the sz we just calculated
3830 	 * minus the size of the sctphdr (its not included in chunk size
3831 	 */
3832 
3833 	/* add once for the INIT-ACK */
3834 	sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3835 
3836 	/* add a second time for the INIT-ACK in the cookie */
3837 	sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3838 
3839 	/* Now add the cookie header and cookie message struct */
3840 	sz_of += sizeof(struct sctp_state_cookie_param);
3841 	/* ...and add the size of our signature */
3842 	sz_of += SCTP_SIGNATURE_SIZE;
3843 	initackm_out->msg.ch.chunk_length = htons(sz_of);
3844 
3845 	/* Now we must build a cookie */
3846 	m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3847 	    sizeof(struct sctphdr), &stc);
3848 	if (m_cookie == NULL) {
3849 		/* memory problem */
3850 		sctp_m_freem(m);
3851 		return;
3852 	}
3853 	/* Now append the cookie to the end and update the space/size */
3854 	m_tmp->m_next = m_cookie;
3855 
3856 	/*
3857 	 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3858 	 * return here since the timer will drive a retranmission.
3859 	 */
3860 	padval = m->m_pkthdr.len % 4;
3861 	if ((padval) && (m_last)) {
3862 		/* see my previous comments on m_last */
3863 		int ret;
3864 		ret = sctp_add_pad_tombuf(m_last, (4-padval));
3865 		if (ret) {
3866 			/* Houston we have a problem, no space */
3867 			sctp_m_freem(m);
3868 			return;
3869 		}
3870 		m->m_pkthdr.len += padval;
3871 	}
3872 	sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
3873 }
3874 
3875 
3876 static void
3877 sctp_insert_on_wheel(struct sctp_association *asoc,
3878 		     struct sctp_stream_out *strq)
3879 {
3880 	struct sctp_stream_out *stre, *strn;
3881 	stre = TAILQ_FIRST(&asoc->out_wheel);
3882 	if (stre == NULL) {
3883 		/* only one on wheel */
3884 		TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
3885 		return;
3886 	}
3887 	for (; stre; stre = strn) {
3888 		strn = TAILQ_NEXT(stre, next_spoke);
3889 		if (stre->stream_no > strq->stream_no) {
3890 			TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
3891 			return;
3892 		} else if (stre->stream_no == strq->stream_no) {
3893 			/* huh, should not happen */
3894 			return;
3895 		} else if (strn == NULL) {
3896 			/* next one is null */
3897 			TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
3898 					   next_spoke);
3899 		}
3900 	}
3901 }
3902 
3903 static void
3904 sctp_remove_from_wheel(struct sctp_association *asoc,
3905 		       struct sctp_stream_out *strq)
3906 {
3907 	/* take off and then setup so we know it is not on the wheel */
3908 	TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
3909 	strq->next_spoke.tqe_next = NULL;
3910 	strq->next_spoke.tqe_prev = NULL;
3911 }
3912 
3913 
3914 static void
3915 sctp_prune_prsctp(struct sctp_tcb *stcb,
3916 		  struct sctp_association *asoc,
3917 		  struct sctp_sndrcvinfo *srcv,
3918 		  int dataout
3919 	)
3920 {
3921 	int freed_spc=0;
3922 	struct sctp_tmit_chunk *chk, *nchk;
3923 	if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
3924 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
3925 			/*
3926 			 * Look for chunks marked with the PR_SCTP
3927 			 * flag AND the buffer space flag. If the one
3928 			 * being sent is equal or greater priority then
3929 			 * purge the old one and free some space.
3930 			 */
3931 			if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
3932 					   SCTP_PR_SCTP_BUFFER)) ==
3933 			    (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
3934 				/*
3935 				 * This one is PR-SCTP AND buffer space
3936 				 * limited type
3937 				 */
3938 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
3939 					/* Lower numbers equates to
3940 					 * higher priority so if the
3941 					 * one we are looking at has a
3942 					 * larger or equal priority we
3943 					 * want to drop the data and
3944 					 * NOT retransmit it.
3945 					 */
3946 					if (chk->data) {
3947 						/* We release the
3948 						 * book_size if the
3949 						 * mbuf is here
3950 						 */
3951 						int ret_spc;
3952 						int cause;
3953 						if (chk->sent > SCTP_DATAGRAM_UNSENT)
3954 							cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
3955 						else
3956 							cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
3957 						ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
3958 										      cause,
3959 										      &asoc->sent_queue);
3960 						freed_spc += ret_spc;
3961 						if (freed_spc >= dataout) {
3962 							return;
3963 						}
3964 					} /* if chunk was present */
3965 				} /* if of sufficent priority */
3966 			} /* if chunk has enabled */
3967 		} /* tailqforeach */
3968 
3969 		chk = TAILQ_FIRST(&asoc->send_queue);
3970 		while (chk) {
3971 			nchk = TAILQ_NEXT(chk, sctp_next);
3972 			/* Here we must move to the sent queue and mark */
3973 			if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
3974 					   SCTP_PR_SCTP_BUFFER)) ==
3975 			    (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
3976 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
3977 					if (chk->data) {
3978 						/* We release the
3979 						 * book_size if the
3980 						 * mbuf is here
3981 						 */
3982 						int ret_spc;
3983 						ret_spc  = sctp_release_pr_sctp_chunk(stcb, chk,
3984 						    SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
3985 						    &asoc->send_queue);
3986 
3987 						freed_spc += ret_spc;
3988 						if (freed_spc >= dataout) {
3989 							return;
3990 						}
3991 					} /* end if chk->data */
3992 				} /* end if right class */
3993 			} /* end if chk pr-sctp */
3994 			chk = nchk;
3995 		} /* end while (chk) */
3996 	} /* if enabled in asoc */
3997 }
3998 
3999 static void
4000 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4001 		   struct sctp_tcb *stcb,
4002 		   struct sctp_sndrcvinfo *srcv,
4003 		   struct sctp_stream_out *strq,
4004 		   struct sctp_nets *net)
4005 {
4006 	memset(template, 0, sizeof(struct sctp_tmit_chunk));
4007 	template->sent = SCTP_DATAGRAM_UNSENT;
4008 	if ((stcb->asoc.peer_supports_prsctp) &&
4009 	    (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4010 	    (srcv->sinfo_timetolive > 0)
4011 		) {
4012 		/* If:
4013 		 *  Peer supports PR-SCTP
4014 		 *  The flags is set against this send for PR-SCTP
4015 		 *  And timetolive is a postive value, zero is reserved
4016 		 *     to mean a reliable send for both buffer/time
4017 		 *     related one.
4018 		 */
4019 		if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4020 			/*
4021 			 * Time to live is a priority stored in tv_sec
4022 			 * when doing the buffer drop thing.
4023 			 */
4024 			template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4025 		} else {
4026 			struct timeval tv;
4027 
4028 			SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4029 			tv.tv_sec = srcv->sinfo_timetolive / 1000;
4030 			tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4031 #ifndef __FreeBSD__
4032 			timeradd(&template->rec.data.timetodrop, &tv,
4033 			    &template->rec.data.timetodrop);
4034 #else
4035 			timevaladd(&template->rec.data.timetodrop, &tv);
4036 #endif
4037 		}
4038 	}
4039 	if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4040 		template->rec.data.stream_seq = strq->next_sequence_sent;
4041 	} else {
4042 		template->rec.data.stream_seq = 0;
4043 	}
4044 	template->rec.data.TSN_seq = 0;	/* not yet assigned */
4045 
4046 	template->rec.data.stream_number = srcv->sinfo_stream;
4047 	template->rec.data.payloadtype = srcv->sinfo_ppid;
4048 	template->rec.data.context = srcv->sinfo_context;
4049 	template->rec.data.doing_fast_retransmit = 0;
4050 	template->rec.data.ect_nonce = 0;   /* ECN Nonce */
4051 
4052 	if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4053 		template->whoTo = net;
4054 	} else {
4055 		if (stcb->asoc.primary_destination)
4056 			template->whoTo = stcb->asoc.primary_destination;
4057 		else {
4058 			/* TSNH */
4059 			template->whoTo = net;
4060 		}
4061 	}
4062 	/* the actual chunk flags */
4063 	if (srcv->sinfo_flags & MSG_UNORDERED) {
4064 		template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4065 	} else {
4066 		template->rec.data.rcv_flags = 0;
4067 	}
4068 	/* no flags yet, FRAGMENT_OK goes here */
4069 	template->flags = 0;
4070 	/* PR sctp flags */
4071 	if (stcb->asoc.peer_supports_prsctp) {
4072 		if (srcv->sinfo_timetolive > 0) {
4073 			/*
4074 			 * We only set the flag if timetolive (or
4075 			 * priority) was set to a positive number.
4076 			 * Zero is reserved specifically to be
4077 			 * EXCLUDED and sent reliable.
4078 			 */
4079 			if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4080 				template->flags |= SCTP_PR_SCTP_ENABLED;
4081 			}
4082 			if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4083 				template->flags |= SCTP_PR_SCTP_BUFFER;
4084 			}
4085 		}
4086 	}
4087 	template->asoc = &stcb->asoc;
4088 }
4089 
4090 
4091 int
4092 sctp_get_frag_point(struct sctp_tcb *stcb,
4093 		    struct sctp_association *asoc)
4094 {
4095 	int siz, ovh;
4096 
4097 	/* For endpoints that have both 6 and 4 addresses
4098 	 * we must reserver room for the 6 ip header, for
4099 	 * those that are only dealing with V4 we use
4100 	 * a larger frag point.
4101 	 */
4102  	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4103 		ovh = SCTP_MED_OVERHEAD;
4104 	} else {
4105 		ovh = SCTP_MED_V4_OVERHEAD;
4106 	}
4107 
4108 	if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4109 		siz = asoc->smallest_mtu - ovh;
4110 	else
4111 		siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4112 /*
4113   if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4114 		/* A data chunk MUST fit in a cluster */
4115 /*		siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4116 /*	}*/
4117 
4118 	if (siz % 4) {
4119 		/* make it an even word boundary please */
4120 		siz -= (siz % 4);
4121 	}
4122 	return (siz);
4123 }
4124 extern unsigned int sctp_max_chunks_on_queue;
4125 
4126 #define   SBLOCKWAIT(f)   (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4127 
4128 static int
4129 sctp_msg_append(struct sctp_tcb *stcb,
4130 		struct sctp_nets *net,
4131 		struct mbuf *m,
4132 		struct sctp_sndrcvinfo *srcv,
4133 		int flags)
4134 {
4135 	struct socket *so;
4136 	struct sctp_association *asoc;
4137 	struct sctp_stream_out *strq;
4138 	struct sctp_tmit_chunk *chk;
4139 	struct sctpchunk_listhead tmp;
4140 	struct sctp_tmit_chunk template;
4141 	struct mbuf *n, *mnext;
4142 	struct mbuf *mm;
4143 	unsigned int dataout, siz;
4144 	int mbcnt = 0;
4145 	int mbcnt_e = 0;
4146 	int error = 0;
4147 
4148 	if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4149 		/* Software fault, you blew it on the call */
4150 #ifdef SCTP_DEBUG
4151 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4152 			printf("software error in sctp_msg_append:1\n");
4153 			printf("stcb:%p net:%p m:%p srcv:%p\n",
4154 			       stcb, net, m, srcv);
4155 		}
4156 #endif
4157 		if (m)
4158 			sctp_m_freem(m);
4159 		return (EFAULT);
4160 	}
4161 	so = stcb->sctp_socket;
4162 	asoc = &stcb->asoc;
4163 	if (srcv->sinfo_flags & MSG_ABORT) {
4164 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4165 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4166 			/* It has to be up before we abort */
4167 			/* how big is the user initiated abort? */
4168 			if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4169 				dataout = m->m_pkthdr.len;
4170 			} else {
4171 				/* we must count */
4172 				dataout = 0;
4173 				for (n = m; n; n = n->m_next) {
4174 					dataout += n->m_len;
4175 				}
4176 			}
4177 			M_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT);
4178 			if (m) {
4179 				struct sctp_paramhdr *ph;
4180 				m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4181 				ph = mtod(m, struct sctp_paramhdr *);
4182 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4183 				ph->param_length = htons(m->m_len);
4184 			}
4185 			sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4186 			m = NULL;
4187 		} else {
4188 			/* Only free if we don't send an abort */
4189 			;
4190 		}
4191 		goto out;
4192 	}
4193 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4194 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4195 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4196 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4197 		/* got data while shutting down */
4198 		error = ECONNRESET;
4199 		goto out;
4200 	}
4201 
4202 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4203 		/* Invalid stream number */
4204 		error = EINVAL;
4205 		goto out;
4206 	}
4207 	if (asoc->strmout == NULL) {
4208 		/* huh? software error */
4209 #ifdef SCTP_DEBUG
4210 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4211 			printf("software error in sctp_msg_append:2\n");
4212 		}
4213 #endif
4214 		error = EFAULT;
4215 		goto out;
4216 	}
4217 	strq = &asoc->strmout[srcv->sinfo_stream];
4218 	/* how big is it ? */
4219 	if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4220 		dataout = m->m_pkthdr.len;
4221 	} else {
4222 		/* we must count */
4223 		dataout = 0;
4224 		for (n = m; n; n = n->m_next) {
4225 			dataout += n->m_len;
4226 		}
4227 	}
4228 #ifdef SCTP_DEBUG
4229 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4230 		printf("Attempt to send out %d bytes\n",
4231 		       dataout);
4232 	}
4233 #endif
4234 
4235 	/* lock the socket buf */
4236 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
4237 	if (error)
4238 		goto out_locked;
4239 
4240 	if (dataout > so->so_snd.sb_hiwat) {
4241 		/* It will NEVER fit */
4242 		error = EMSGSIZE;
4243 		goto release;
4244 	}
4245 	if ((srcv->sinfo_flags & MSG_EOF) &&
4246 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4247 	    (dataout == 0)
4248 		) {
4249 		goto zap_by_it_all;
4250 	}
4251 	if ((so->so_snd.sb_hiwat <
4252 	     (dataout + asoc->total_output_queue_size)) ||
4253 	    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4254 	    (asoc->total_output_mbuf_queue_size >
4255 	     so->so_snd.sb_mbmax)
4256 		) {
4257 		/* XXX Buffer space hunt for data to skip */
4258 		if (asoc->peer_supports_prsctp) {
4259 			sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4260 		}
4261 		while ((so->so_snd.sb_hiwat <
4262 		    (dataout + asoc->total_output_queue_size)) ||
4263 		    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4264 		    (asoc->total_output_mbuf_queue_size >
4265 		    so->so_snd.sb_mbmax)) {
4266 			struct sctp_inpcb *inp;
4267 			/* Now did we free up enough room? */
4268 			if (so->so_state & SS_NBIO) {
4269 				/* Non-blocking io in place */
4270 				error = EWOULDBLOCK;
4271 				goto release;
4272 			}
4273 			/*
4274 			 * We store off a pointer to the endpoint.
4275 			 * Since on return from this we must check to
4276 			 * see if an so_error is set. If so we may have
4277 			 * been reset and our stcb destroyed. Returning
4278 			 * an error will cause the correct error return
4279 			 * through and fix this all.
4280 			 */
4281 			inp = stcb->sctp_ep;
4282 			/*
4283 			 * Not sure how else to do this since
4284 			 * the level we suspended at is not
4285 			 * known deep down where we are. I will
4286 			 * drop to spl0() so that others can
4287 			 * get in.
4288 			 */
4289 
4290 			inp->sctp_tcb_at_block = (void *)stcb;
4291 			inp->error_on_block = 0;
4292 			sbunlock(&so->so_snd);
4293 			error = sbwait(&so->so_snd);
4294 			/*
4295 			 * XXX: This is ugly but I have
4296 			 * recreated most of what goes on to
4297 			 * block in the sb. UGHH
4298 			 * May want to add the bit about being
4299 			 * no longer connected.. but this then
4300 			 * further dooms the UDP model NOT to
4301 			 * allow this.
4302 			 */
4303 			inp->sctp_tcb_at_block = 0;
4304 			if (inp->error_on_block)
4305 				error = inp->error_on_block;
4306 			if (so->so_error)
4307 				error = so->so_error;
4308 			if (error) {
4309 				goto out_locked;
4310 			}
4311 			error = sblock(&so->so_snd, M_WAITOK);
4312 			if (error)
4313 				goto out_locked;
4314 			/* Otherwise we cycle back and recheck
4315 			 * the space
4316 			 */
4317 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4318 			if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4319 #else
4320 			if (so->so_state & SS_CANTSENDMORE) {
4321 #endif
4322 				error = EPIPE;
4323 				goto release;
4324 			}
4325 			if (so->so_error) {
4326 				error = so->so_error;
4327 				goto release;
4328 			}
4329 		}
4330 	}
4331 	/* If we have a packet header fix it if it was broke */
4332 	if (m->m_flags & M_PKTHDR) {
4333 		m->m_pkthdr.len = dataout;
4334 	}
4335 	/* use the smallest one, user set value or
4336 	 * smallest mtu of the asoc
4337 	 */
4338 	siz = sctp_get_frag_point(stcb, asoc);
4339 	if ((dataout) && (dataout <= siz)) {
4340 		/* Fast path */
4341 		chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4342 		if (chk == NULL) {
4343 			error = ENOMEM;
4344 			goto release;
4345 		}
4346 		sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4347 		chk->whoTo->ref_count++;
4348 		chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4349 
4350 		/* no flags yet, FRAGMENT_OK goes here */
4351 		sctppcbinfo.ipi_count_chunk++;
4352 		sctppcbinfo.ipi_gencnt_chunk++;
4353 		asoc->chunks_on_out_queue++;
4354 		chk->data = m;
4355 		m = NULL;
4356 		/* Total in the MSIZE */
4357 		for (mm = chk->data; mm; mm = mm->m_next) {
4358 			mbcnt += MSIZE;
4359 			if (mm->m_flags & M_EXT) {
4360 				mbcnt += chk->data->m_ext.ext_size;
4361 			}
4362 		}
4363 		/* fix up the send_size if it is not present */
4364 		chk->send_size = dataout;
4365 		chk->book_size = chk->send_size;
4366 		chk->mbcnt = mbcnt;
4367 		/* ok, we are commited */
4368 		if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4369 			/* bump the ssn if we are unordered. */
4370 			strq->next_sequence_sent++;
4371 		}
4372 		chk->data->m_nextpkt = 0;
4373 		asoc->stream_queue_cnt++;
4374 		TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4375 		/* now check if this stream is on the wheel */
4376 		if ((strq->next_spoke.tqe_next == NULL) &&
4377 		    (strq->next_spoke.tqe_prev == NULL)) {
4378 			/* Insert it on the wheel since it is not
4379 			 * on it currently
4380 			 */
4381 			sctp_insert_on_wheel(asoc, strq);
4382 		}
4383 	} else if ((dataout) && (dataout > siz)) {
4384 		/* Slow path */
4385 		if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4386 		    (dataout > siz)) {
4387 			error = EMSGSIZE;
4388 			goto release;
4389 		}
4390 		/* setup the template */
4391 		sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4392 
4393 		n = m;
4394 		while (dataout > siz) {
4395 			/*
4396 			 * We can wait since this is called from the user
4397 			 * send side
4398 			 */
4399 			n->m_nextpkt = m_split(n, siz, M_WAIT);
4400 			if (n->m_nextpkt == NULL) {
4401 				error = EFAULT;
4402 				goto release;
4403 			}
4404 			dataout -= siz;
4405 			n = n->m_nextpkt;
4406 		}
4407 		/*
4408 		 * ok, now we have a chain on m where m->m_nextpkt points to
4409 		 * the next chunk and m/m->m_next chain is the piece to send.
4410 		 * We must go through the chains and thread them on to
4411 		 * sctp_tmit_chunk chains and place them all on the stream
4412 		 * queue, breaking the m->m_nextpkt pointers as we go.
4413 		 */
4414 		n = m;
4415 		TAILQ_INIT(&tmp);
4416 		while (n) {
4417 			/*
4418 			 * first go through and allocate a sctp_tmit chunk
4419 			 * for each chunk piece
4420 			 */
4421 			chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4422 			if (chk == NULL) {
4423 				/*
4424 				 * ok we must spin through and dump anything
4425 				 * we have allocated and then jump to the
4426 				 * no_membad
4427 				 */
4428 				chk = TAILQ_FIRST(&tmp);
4429 				while (chk) {
4430 					TAILQ_REMOVE(&tmp, chk, sctp_next);
4431 					SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4432 					sctppcbinfo.ipi_count_chunk--;
4433 					asoc->chunks_on_out_queue--;
4434 					if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4435 						panic("Chunk count is negative");
4436 					}
4437 					sctppcbinfo.ipi_gencnt_chunk++;
4438 					chk = TAILQ_FIRST(&tmp);
4439 				}
4440 				error = ENOMEM;
4441 				goto release;
4442 			}
4443 			sctppcbinfo.ipi_count_chunk++;
4444 			asoc->chunks_on_out_queue++;
4445 
4446 			sctppcbinfo.ipi_gencnt_chunk++;
4447 			*chk = template;
4448 			chk->whoTo->ref_count++;
4449 			chk->data = n;
4450 			/* Total in the MSIZE */
4451 			mbcnt_e = 0;
4452 			for (mm = chk->data; mm; mm = mm->m_next) {
4453 				mbcnt_e += MSIZE;
4454 				if (mm->m_flags & M_EXT) {
4455 					mbcnt_e += chk->data->m_ext.ext_size;
4456 				}
4457 			}
4458 			/* now fix the chk->send_size */
4459 			if (chk->data->m_flags & M_PKTHDR) {
4460 				chk->send_size = chk->data->m_pkthdr.len;
4461 			} else {
4462 				struct mbuf *nn;
4463 				chk->send_size = 0;
4464 				for (nn = chk->data; nn; nn = nn->m_next) {
4465 					chk->send_size += nn->m_len;
4466 				}
4467 			}
4468 			chk->book_size = chk->send_size;
4469 			chk->mbcnt = mbcnt_e;
4470 			mbcnt += mbcnt_e;
4471 			if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4472 				asoc->sent_queue_cnt_removeable++;
4473 			}
4474 			n = n->m_nextpkt;
4475 			TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4476 		}
4477 		m = NULL;
4478 		/* now that we have enough space for all de-couple the
4479 		 * chain of mbufs by going through our temp array
4480 		 * and breaking the pointers.
4481 		 */
4482 		/* ok, we are commited */
4483 		if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4484 			/* bump the ssn if we are unordered. */
4485 			strq->next_sequence_sent++;
4486 		}
4487 		/* Mark the first/last flags. This will
4488 		 * result int a 3 for a single item on the list
4489 		 */
4490 		chk = TAILQ_FIRST(&tmp);
4491 		chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4492 		chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4493 		chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4494 		/* now break any chains on the queue and
4495 		 * move it to the streams actual queue.
4496 		 */
4497 		chk = TAILQ_FIRST(&tmp);
4498 		while (chk) {
4499 			chk->data->m_nextpkt = 0;
4500 			TAILQ_REMOVE(&tmp, chk, sctp_next);
4501 			asoc->stream_queue_cnt++;
4502 			TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4503 			chk = TAILQ_FIRST(&tmp);
4504 		}
4505 		/* now check if this stream is on the wheel */
4506 		if ((strq->next_spoke.tqe_next == NULL) &&
4507 		    (strq->next_spoke.tqe_prev == NULL)) {
4508 			/* Insert it on the wheel since it is not
4509 			 * on it currently
4510 			 */
4511 			sctp_insert_on_wheel(asoc, strq);
4512 		}
4513 	}
4514 	/* has a SHUTDOWN been (also) requested by the user on this asoc? */
4515 zap_by_it_all:
4516 
4517 	if ((srcv->sinfo_flags & MSG_EOF) &&
4518 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4519 
4520 		int some_on_streamwheel = 0;
4521 
4522 		if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4523 			/* Check to see if some data queued */
4524 			struct sctp_stream_out *outs;
4525 			TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4526 				if (!TAILQ_EMPTY(&outs->outqueue)) {
4527 					some_on_streamwheel = 1;
4528 					break;
4529 				}
4530 			}
4531 		}
4532 
4533 		if (TAILQ_EMPTY(&asoc->send_queue) &&
4534 		    TAILQ_EMPTY(&asoc->sent_queue) &&
4535 		    (some_on_streamwheel == 0)) {
4536 			/* there is nothing queued to send, so I'm done... */
4537 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4538 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4539 				/* only send SHUTDOWN the first time through */
4540 #ifdef SCTP_DEBUG
4541 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4542 					printf("%s:%d sends a shutdown\n",
4543 					       __FILE__,
4544 					       __LINE__
4545 						);
4546 				}
4547 #endif
4548 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4549 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4550 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4551 						 asoc->primary_destination);
4552 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4553 						 asoc->primary_destination);
4554 			}
4555 		} else {
4556 			/*
4557 			 * we still got (or just got) data to send, so set
4558 			 * SHUTDOWN_PENDING
4559 			 */
4560 			/*
4561 			 * XXX sockets draft says that MSG_EOF should be sent
4562 			 * with no data.  currently, we will allow user data
4563 			 * to be sent first and move to SHUTDOWN-PENDING
4564 			 */
4565 			asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4566 		}
4567 	}
4568 #ifdef SCTP_MBCNT_LOGGING
4569 	sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4570 		       asoc->total_output_queue_size,
4571 		       dataout,
4572 		       asoc->total_output_mbuf_queue_size,
4573 		       mbcnt);
4574 #endif
4575 	asoc->total_output_queue_size += dataout;
4576 	asoc->total_output_mbuf_queue_size += mbcnt;
4577 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4578 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4579 		so->so_snd.sb_cc += dataout;
4580 		so->so_snd.sb_mbcnt += mbcnt;
4581 	}
4582 
4583 #ifdef SCTP_DEBUG
4584 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4585 		printf("++total out:%d total_mbuf_out:%d\n",
4586 		       (int)asoc->total_output_queue_size,
4587 		       (int)asoc->total_output_mbuf_queue_size);
4588 	}
4589 #endif
4590 
4591 release:
4592 	sbunlock(&so->so_snd);
4593 out_locked:
4594 
4595 out:
4596 	if (m && m->m_nextpkt) {
4597 		n = m;
4598 		while (n) {
4599 			mnext = n->m_nextpkt;
4600 			n->m_nextpkt = NULL;
4601 			sctp_m_freem(n);
4602 			n = mnext;
4603 		}
4604 	} else if (m)
4605 		sctp_m_freem(m);
4606 
4607 	return (error);
4608 }
4609 
4610 static struct mbuf *
4611 sctp_copy_mbufchain(struct mbuf *clonechain,
4612 		    struct mbuf *outchain)
4613 {
4614 	struct mbuf *appendchain;
4615 #if defined(__FreeBSD__) || defined(__NetBSD__)
4616 	/* Supposedly m_copypacket is an optimization, use it if we can */
4617 	if (clonechain->m_flags & M_PKTHDR) {
4618 		appendchain = m_copypacket(clonechain, M_DONTWAIT);
4619 		sctp_pegs[SCTP_CACHED_SRC]++;
4620 	} else
4621 		appendchain = m_copy(clonechain, 0, M_COPYALL);
4622 #elif defined(__APPLE__)
4623 	appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT);
4624 #else
4625 	appendchain = m_copy(clonechain, 0, M_COPYALL);
4626 #endif
4627 
4628 	if (appendchain == NULL) {
4629 		/* error */
4630 		if (outchain)
4631 			sctp_m_freem(outchain);
4632 		return (NULL);
4633 	}
4634 	if (outchain) {
4635 		/* tack on to the end */
4636 		struct mbuf *m;
4637 		m = outchain;
4638 		while (m) {
4639 			if (m->m_next == NULL) {
4640 				m->m_next = appendchain;
4641 				break;
4642 			}
4643 			m = m->m_next;
4644 		}
4645 		if (outchain->m_flags & M_PKTHDR) {
4646 			int append_tot;
4647 			struct mbuf *t;
4648 			t = appendchain;
4649 			append_tot = 0;
4650 			while (t) {
4651 				append_tot += t->m_len;
4652 				t = t->m_next;
4653 			}
4654 			outchain->m_pkthdr.len += append_tot;
4655 		}
4656 		return (outchain);
4657 	} else {
4658 		return (appendchain);
4659 	}
4660 }
4661 
4662 static void
4663 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4664 {
4665 	struct sctp_copy_all *ca;
4666 	struct mbuf *m;
4667 	int turned_on_nonblock=0, ret;
4668 
4669 	ca = (struct sctp_copy_all *)ptr;
4670 	if (ca->m == NULL) {
4671 		return;
4672 	}
4673 	if (ca->inp != inp) {
4674 		/* TSNH */
4675 		return;
4676 	}
4677 	m = sctp_copy_mbufchain(ca->m, NULL);
4678 	if (m == NULL) {
4679 		/* can't copy so we are done */
4680 		ca->cnt_failed++;
4681 		return;
4682 	}
4683 	if ((stcb->sctp_socket->so_state & SS_NBIO) == 0) {
4684 		/* we have to do this non-blocking */
4685 		turned_on_nonblock = 1;
4686 		stcb->sctp_socket->so_state |= SS_NBIO;
4687 	}
4688 	ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, &ca->sndrcv, 0);
4689 	if (turned_on_nonblock) {
4690 		/* we turned on non-blocking so turn it off */
4691 		stcb->sctp_socket->so_state &= ~SS_NBIO;
4692 	}
4693 	if (ret) {
4694 		ca->cnt_failed++;
4695 	} else {
4696 		ca->cnt_sent++;
4697 	}
4698 }
4699 
4700 static void
4701 sctp_sendall_completes(void *ptr, u_int32_t val)
4702 {
4703 	struct sctp_copy_all *ca;
4704 	ca = (struct sctp_copy_all *)ptr;
4705 	/* Do a notify here?
4706 	 * Kacheong suggests that the notify
4707 	 * be done at the send time.. so you would
4708 	 * push up a notification if any send failed.
4709 	 * Don't know if this is feasable since the
4710 	 * only failures we have is "memory" related and
4711 	 * if you cannot get an mbuf to send the data
4712 	 * you surely can't get an mbuf to send up
4713 	 * to notify the user you can't send the data :->
4714 	 */
4715 
4716 	/* now free everything */
4717 	m_freem(ca->m);
4718 	free(ca, M_PCB);
4719 }
4720 
4721 
4722 #define	MC_ALIGN(m, len) do {						\
4723 	(m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1);		\
4724 } while (0)
4725 
4726 
4727 
4728 static struct mbuf *
4729 sctp_copy_out_all(struct uio *uio, int len)
4730 {
4731 	struct mbuf *ret, *at;
4732 	int left, willcpy, cancpy, error;
4733 
4734 	MGETHDR(ret, M_WAIT, MT_HEADER);
4735 	if (ret == NULL) {
4736 		/* TSNH */
4737 		return (NULL);
4738 	}
4739 	left = len;
4740 	ret->m_len = 0;
4741 	ret->m_pkthdr.len = len;
4742 	MCLGET(ret, M_WAIT);
4743 	if (ret == NULL) {
4744 		return (NULL);
4745 	}
4746 	if ((ret->m_flags & M_EXT) == 0) {
4747 		m_freem (ret);
4748 		return (NULL);
4749 	}
4750 	cancpy = M_TRAILINGSPACE(ret);
4751 	willcpy = min(cancpy, left);
4752 	at = ret;
4753 	while (left > 0) {
4754 		/* Align data to the end */
4755 		MC_ALIGN(at, willcpy);
4756 		error = uiomove(mtod(at, void *), willcpy, uio);
4757 		if (error) {
4758 		err_out_now:
4759 			m_freem(ret);
4760 			return (NULL);
4761 		}
4762 		at->m_len = willcpy;
4763 		at->m_nextpkt = at->m_next = 0;
4764 		left -= willcpy;
4765 		if (left > 0) {
4766 			MGET(at->m_next, M_WAIT, MT_DATA);
4767 			if (at->m_next == NULL) {
4768 				goto err_out_now;
4769 			}
4770 			at = at->m_next;
4771 			at->m_len = 0;
4772 			MCLGET(at, M_WAIT);
4773 			if (at == NULL) {
4774 				goto err_out_now;
4775 			}
4776 			if ((at->m_flags & M_EXT) == 0) {
4777 				goto err_out_now;
4778 			}
4779 			cancpy = M_TRAILINGSPACE(at);
4780 			willcpy = min(cancpy, left);
4781 		}
4782 	}
4783 	return (ret);
4784 }
4785 
4786 static int
4787 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4788 {
4789 	int ret;
4790 	struct sctp_copy_all *ca;
4791 	ca = malloc(sizeof(struct sctp_copy_all), M_PCB, M_WAIT);
4792 	if (ca == NULL) {
4793 		m_freem(m);
4794 		return (ENOMEM);
4795 	}
4796 	memset (ca, 0, sizeof(struct sctp_copy_all));
4797 
4798 	ca->inp = inp;
4799 	ca->sndrcv = *srcv;
4800 	/* take off the sendall flag, it would
4801 	 * be bad if we failed to do this  :-0
4802 	 */
4803  	ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4804 
4805 	/* get length and mbuf chain */
4806 	if (uio) {
4807 		ca->sndlen = uio->uio_resid;
4808 		ca->m = sctp_copy_out_all(uio, ca->sndlen);
4809 		if (ca->m == NULL) {
4810 			free(ca, M_PCB);
4811 			return (ENOMEM);
4812 		}
4813 	} else {
4814 		if ((m->m_flags & M_PKTHDR) == 0) {
4815 			ca->sndlen = 0;
4816 			while(m) {
4817 				ca->sndlen += m->m_len;
4818 				m = m->m_next;
4819 			}
4820 		} else {
4821 			ca->sndlen = m->m_pkthdr.len;
4822 		}
4823 		ca->m = m;
4824 	}
4825 
4826 	ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4827 				     (void *)ca, 0, sctp_sendall_completes, inp);
4828 	if (ret) {
4829 #ifdef SCTP_DEBUG
4830 		printf("Failed to initate iterator to takeover associations\n");
4831 #endif
4832 		free(ca, M_PCB);
4833 		return (EFAULT);
4834 
4835 	}
4836 	return (0);
4837 }
4838 
4839 
4840 void
4841 sctp_toss_old_cookies(struct sctp_association *asoc)
4842 {
4843 	struct sctp_tmit_chunk *chk, *nchk;
4844 	chk = TAILQ_FIRST(&asoc->control_send_queue);
4845 	while (chk) {
4846 		nchk = TAILQ_NEXT(chk, sctp_next);
4847 		if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4848 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4849 			if (chk->data) {
4850 				sctp_m_freem(chk->data);
4851 				chk->data = NULL;
4852 			}
4853 			asoc->ctrl_queue_cnt--;
4854 			if (chk->whoTo)
4855 				sctp_free_remote_addr(chk->whoTo);
4856 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4857 			sctppcbinfo.ipi_count_chunk--;
4858 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4859 				panic("Chunk count is negative");
4860 			}
4861 			sctppcbinfo.ipi_gencnt_chunk++;
4862 		}
4863 		chk = nchk;
4864 	}
4865 }
4866 
4867 void
4868 sctp_toss_old_asconf(struct sctp_tcb *stcb)
4869 {
4870 	struct sctp_association *asoc;
4871 	struct sctp_tmit_chunk *chk, *chk_tmp;
4872 
4873 	asoc = &stcb->asoc;
4874 	for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
4875 	     chk = chk_tmp) {
4876 		/* get next chk */
4877 		chk_tmp = TAILQ_NEXT(chk, sctp_next);
4878 		/* find SCTP_ASCONF chunk in queue (only one ever in queue) */
4879 		if (chk->rec.chunk_id == SCTP_ASCONF) {
4880 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4881 			if (chk->data) {
4882 				sctp_m_freem(chk->data);
4883 				chk->data = NULL;
4884 			}
4885 			asoc->ctrl_queue_cnt--;
4886 			if (chk->whoTo)
4887 				sctp_free_remote_addr(chk->whoTo);
4888 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4889 			sctppcbinfo.ipi_count_chunk--;
4890 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4891 				panic("Chunk count is negative");
4892 			}
4893 			sctppcbinfo.ipi_gencnt_chunk++;
4894 		}
4895 	}
4896 }
4897 
4898 
4899 static void
4900 sctp_clean_up_datalist(struct sctp_tcb *stcb,
4901 		       struct sctp_association *asoc,
4902 		       struct sctp_tmit_chunk **data_list,
4903 		       int bundle_at,
4904 		       struct sctp_nets *net)
4905 {
4906 	int i;
4907 	for (i = 0; i < bundle_at; i++) {
4908 		/* off of the send queue */
4909 		if (i) {
4910 			/* Any chunk NOT 0 you zap the time
4911 			 * chunk 0 gets zapped or set based on
4912 			 * if a RTO measurment is needed.
4913 			 */
4914 			data_list[i]->do_rtt = 0;
4915 		}
4916 		/* record time */
4917 		data_list[i]->sent_rcv_time = net->last_sent_time;
4918 		TAILQ_REMOVE(&asoc->send_queue,
4919 			     data_list[i],
4920 			     sctp_next);
4921 		/* on to the sent queue */
4922 		TAILQ_INSERT_TAIL(&asoc->sent_queue,
4923 				  data_list[i],
4924 				  sctp_next);
4925 		/* This does not lower until the cum-ack passes it */
4926 		asoc->sent_queue_cnt++;
4927 		asoc->send_queue_cnt--;
4928 		if ((asoc->peers_rwnd <= 0) &&
4929 		    (asoc->total_flight == 0) &&
4930 		    (bundle_at == 1)) {
4931 			/* Mark the chunk as being a window probe */
4932 #ifdef SCTP_DEBUG
4933 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4934 				printf("WINDOW PROBE SET\n");
4935 			}
4936 #endif
4937 			sctp_pegs[SCTP_WINDOW_PROBES]++;
4938 			data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
4939 		} else {
4940 			data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
4941 		}
4942 #ifdef SCTP_AUDITING_ENABLED
4943 		sctp_audit_log(0xC2, 3);
4944 #endif
4945 		data_list[i]->sent = SCTP_DATAGRAM_SENT;
4946 		data_list[i]->snd_count = 1;
4947 		net->flight_size += data_list[i]->book_size;
4948 		asoc->total_flight += data_list[i]->book_size;
4949 		asoc->total_flight_count++;
4950 #ifdef SCTP_LOG_RWND
4951 		sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
4952 			      asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
4953 #endif
4954 		asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
4955 						    (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
4956 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4957 			/* SWS sender side engages */
4958 			asoc->peers_rwnd = 0;
4959 		}
4960 	}
4961 }
4962 
4963 static void
4964 sctp_clean_up_ctl(struct sctp_association *asoc)
4965 {
4966 	struct sctp_tmit_chunk *chk, *nchk;
4967 	for (chk = TAILQ_FIRST(&asoc->control_send_queue);
4968 	    chk; chk = nchk) {
4969 		nchk = TAILQ_NEXT(chk, sctp_next);
4970 		if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
4971 		    (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
4972 		    (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
4973 		    (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
4974 		    (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
4975 		    (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
4976 		    (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
4977 		    (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
4978 		    (chk->rec.chunk_id == SCTP_ECN_CWR) ||
4979 		    (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
4980 			/* Stray chunks must be cleaned up */
4981 		clean_up_anyway:
4982 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4983 			if (chk->data) {
4984 				sctp_m_freem(chk->data);
4985 				chk->data = NULL;
4986 			}
4987 			asoc->ctrl_queue_cnt--;
4988 			sctp_free_remote_addr(chk->whoTo);
4989 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4990 			sctppcbinfo.ipi_count_chunk--;
4991 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4992 				panic("Chunk count is negative");
4993 			}
4994 			sctppcbinfo.ipi_gencnt_chunk++;
4995 		} else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
4996 			struct sctp_stream_reset_req *strreq;
4997 			/* special handling, we must look into the param */
4998 			strreq = mtod(chk->data, struct sctp_stream_reset_req *);
4999 			if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5000 				goto clean_up_anyway;
5001 			}
5002 		}
5003 	}
5004 }
5005 
5006 static int
5007 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5008 		      struct sctp_stream_out *strq)
5009 {
5010 	/* Move from the stream to the send_queue keeping track of the total */
5011 	struct sctp_association *asoc;
5012 	int tot_moved = 0;
5013 	int failed = 0;
5014 	int padval;
5015 	struct sctp_tmit_chunk *chk, *nchk;
5016 	struct sctp_data_chunk *dchkh;
5017 	struct sctpchunk_listhead tmp;
5018 	struct mbuf *orig;
5019 
5020 	asoc = &stcb->asoc;
5021 	TAILQ_INIT(&tmp);
5022 	chk = TAILQ_FIRST(&strq->outqueue);
5023 	while (chk) {
5024 		nchk = TAILQ_NEXT(chk, sctp_next);
5025 		/* now put in the chunk header */
5026 		orig = chk->data;
5027 		M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT);
5028 		if (chk->data == NULL) {
5029 			/* HELP */
5030 			failed++;
5031 			break;
5032 		}
5033 		if (orig != chk->data) {
5034 			/* A new mbuf was added, account for it */
5035 			if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5036 			    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5037 				stcb->sctp_socket->so_snd.sb_mbcnt += MSIZE;
5038 			}
5039 #ifdef SCTP_MBCNT_LOGGING
5040 			sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5041 				       asoc->total_output_queue_size,
5042 				       0,
5043 				       asoc->total_output_mbuf_queue_size,
5044 				       MSIZE);
5045 #endif
5046 			stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5047 			chk->mbcnt += MSIZE;
5048 		}
5049 		chk->send_size += sizeof(struct sctp_data_chunk);
5050 		/* This should NOT have to do anything, but
5051 		 * I would rather be cautious
5052 		 */
5053 		if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5054 			m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5055 			if (chk->data == NULL) {
5056 				failed++;
5057 				break;
5058 			}
5059 		}
5060 		dchkh = mtod(chk->data, struct sctp_data_chunk *);
5061 		dchkh->ch.chunk_length = htons(chk->send_size);
5062 		/* Chunks must be padded to even word boundary */
5063 		padval = chk->send_size % 4;
5064 		if (padval) {
5065 			/* For fragmented messages this should not
5066 			 * run except possibly on the last chunk
5067 			 */
5068 			if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5069 				/* we are in big big trouble no mbufs :< */
5070 				failed++;
5071 				break;
5072 			}
5073 			chk->send_size += (4 - padval);
5074 		}
5075 		/* pull from stream queue */
5076 		TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5077 		asoc->stream_queue_cnt--;
5078 		TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5079 		/* add it in to the size of moved chunks */
5080 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5081 			/* we pull only one message */
5082 			break;
5083 		}
5084 		chk = nchk;
5085 	}
5086 	if (failed) {
5087 		/* Gak, we just lost the user message */
5088 		chk = TAILQ_FIRST(&tmp);
5089 		while (chk) {
5090 			nchk = TAILQ_NEXT(chk, sctp_next);
5091 			TAILQ_REMOVE(&tmp, chk, sctp_next);
5092 
5093 			sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5094 					(SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5095 					chk);
5096 
5097 			if (chk->data) {
5098 				sctp_m_freem(chk->data);
5099 				chk->data = NULL;
5100 			}
5101 			if (chk->whoTo) {
5102 				sctp_free_remote_addr(chk->whoTo);
5103 				chk->whoTo = NULL;
5104 			}
5105 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5106 			sctppcbinfo.ipi_count_chunk--;
5107 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5108 				panic("Chunk count is negative");
5109 			}
5110 			sctppcbinfo.ipi_gencnt_chunk++;
5111 			chk = nchk;
5112 		}
5113 		return (0);
5114 	}
5115 	/* now pull them off of temp wheel */
5116 	chk = TAILQ_FIRST(&tmp);
5117 	while (chk) {
5118 		nchk = TAILQ_NEXT(chk, sctp_next);
5119 		/* insert on send_queue */
5120 		TAILQ_REMOVE(&tmp, chk, sctp_next);
5121 		TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5122 		asoc->send_queue_cnt++;
5123 		/* assign TSN */
5124 		chk->rec.data.TSN_seq = asoc->sending_seq++;
5125 
5126 		dchkh = mtod(chk->data, struct sctp_data_chunk *);
5127 		/* Put the rest of the things in place now. Size
5128 		 * was done earlier in previous loop prior to
5129 		 * padding.
5130 		 */
5131 		dchkh->ch.chunk_type = SCTP_DATA;
5132 		dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5133 		dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5134 		dchkh->dp.stream_id = htons(strq->stream_no);
5135 		dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5136 		dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5137 		/* total count moved */
5138 		tot_moved += chk->send_size;
5139 		chk = nchk;
5140 	}
5141 	return (tot_moved);
5142 }
5143 
5144 static void
5145 sctp_fill_outqueue(struct sctp_tcb *stcb,
5146 		   struct sctp_nets *net)
5147 {
5148 	struct sctp_association *asoc;
5149 	struct sctp_tmit_chunk *chk;
5150 	struct sctp_stream_out *strq, *strqn;
5151 	int mtu_fromwheel, goal_mtu;
5152 	unsigned int moved, seenend, cnt_mvd=0;
5153 
5154 	asoc = &stcb->asoc;
5155 	/* Attempt to move at least 1 MTU's worth
5156 	 * onto the wheel for each destination address
5157 	 */
5158 	goal_mtu = net->cwnd - net->flight_size;
5159 	if ((unsigned int)goal_mtu < net->mtu) {
5160 		goal_mtu = net->mtu;
5161 	}
5162 	if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5163 		sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5164 	}
5165 	seenend = moved = mtu_fromwheel = 0;
5166 	if (asoc->last_out_stream == NULL) {
5167 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5168 		if (asoc->last_out_stream == NULL) {
5169 			/* huh nothing on the wheel, TSNH */
5170 			return;
5171 		}
5172 		goto done_it;
5173 	}
5174 	strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5175  done_it:
5176 	if (strq == NULL) {
5177 		asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5178 	}
5179 	while (mtu_fromwheel < goal_mtu) {
5180 		if (strq == NULL) {
5181 			if (seenend == 0) {
5182 				seenend = 1;
5183 				strq = TAILQ_FIRST(&asoc->out_wheel);
5184 			} else if ((moved == 0) && (seenend)) {
5185 				/* none left on the wheel */
5186 				sctp_pegs[SCTP_MOVED_NLEF]++;
5187 				return;
5188 			} else if (moved) {
5189 				/*
5190 				 * clear the flags and rotate back through
5191 				 * again
5192 				 */
5193 				moved = 0;
5194 				seenend = 0;
5195 				strq = TAILQ_FIRST(&asoc->out_wheel);
5196 			}
5197 			if (strq == NULL)
5198 				break;
5199 			continue;
5200 		}
5201 		strqn = TAILQ_NEXT(strq, next_spoke);
5202 		if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5203 			/* none left on this queue, prune a spoke?  */
5204 			sctp_remove_from_wheel(asoc, strq);
5205 			if (strq == asoc->last_out_stream) {
5206 			    /* the last one we used went off the wheel */
5207 			    asoc->last_out_stream = NULL;
5208 			}
5209 			strq = strqn;
5210 			continue;
5211 		}
5212 		if (chk->whoTo != net) {
5213 			/* Skip this stream, first one on stream
5214 			 * does not head to our current destination.
5215 			 */
5216 			strq = strqn;
5217 			continue;
5218 		}
5219 		mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5220 		cnt_mvd++;
5221 		moved++;
5222 		asoc->last_out_stream = strq;
5223 		strq = strqn;
5224 	}
5225 	sctp_pegs[SCTP_MOVED_MAX]++;
5226 #ifdef SCTP_DEBUG
5227 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5228 		printf("Ok we moved %d chunks to send queue\n",
5229 		       moved);
5230 	}
5231 #endif
5232 	if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5233 		sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5234 	}
5235 }
5236 
5237 void
5238 sctp_fix_ecn_echo(struct sctp_association *asoc)
5239 {
5240 	struct sctp_tmit_chunk *chk;
5241 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5242 		if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5243 			chk->sent = SCTP_DATAGRAM_UNSENT;
5244 		}
5245 	}
5246 }
5247 
5248 static void
5249 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5250 		    struct sctp_association *asoc,
5251 		    struct sctp_nets *net)
5252 {
5253 	struct sctp_tmit_chunk *chk;
5254 	struct sctp_nets *a_net;
5255 	a_net = sctp_find_alternate_net(stcb, net);
5256 	if ((a_net != net) &&
5257 	    ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5258 		/*
5259 		 * We only proceed if a valid alternate is found that is
5260 		 * not this one and is reachable. Here we must move all
5261 		 * chunks queued in the send queue off of the destination
5262 		 * address to our alternate.
5263 		 */
5264 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5265 			if (chk->whoTo == net) {
5266 				/* Move the chunk to our alternate */
5267 				sctp_free_remote_addr(chk->whoTo);
5268 				chk->whoTo = a_net;
5269 				a_net->ref_count++;
5270 			}
5271 		}
5272 	}
5273 }
5274 
5275 static int sctp_from_user_send=0;
5276 
5277 static int
5278 sctp_med_chunk_output(struct sctp_inpcb *inp,
5279 		      struct sctp_tcb *stcb,
5280 		      struct sctp_association *asoc,
5281 		      int *num_out,
5282 		      int *reason_code,
5283 		      int control_only, int *cwnd_full, int from_where,
5284 		      struct timeval *now, int *now_filled)
5285 {
5286 	/*
5287 	 * Ok this is the generic chunk service queue.
5288 	 * we must do the following:
5289 	 *  - Service the stream queue that is next, moving any message
5290 	 *    (note I must get a complete message i.e. FIRST/MIDDLE and
5291 	 *    LAST to the out queue in one pass) and assigning TSN's
5292 	 *  - Check to see if the cwnd/rwnd allows any output, if so we
5293 	 *    go ahead and fomulate and send the low level chunks. Making
5294 	 *    sure to combine any control in the control chunk queue also.
5295 	 */
5296 	struct sctp_nets *net;
5297 	struct mbuf *outchain;
5298 	struct sctp_tmit_chunk *chk, *nchk;
5299 	struct sctphdr *shdr;
5300 	/* temp arrays for unlinking */
5301 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5302 	int no_fragmentflg, error;
5303 	int one_chunk, hbflag;
5304 	int asconf, cookie, no_out_cnt;
5305 	int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5306         unsigned int mtu, r_mtu, omtu;
5307 	*num_out = 0;
5308 	cwnd_full_ind = 0;
5309 	ctl_cnt = no_out_cnt = asconf = cookie = 0;
5310 	/*
5311 	 * First lets prime the pump. For each destination, if there
5312 	 * is room in the flight size, attempt to pull an MTU's worth
5313 	 * out of the stream queues into the general send_queue
5314 	 */
5315 #ifdef SCTP_AUDITING_ENABLED
5316 	sctp_audit_log(0xC2, 2);
5317 #endif
5318 #ifdef SCTP_DEBUG
5319 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5320 		printf("***********************\n");
5321 	}
5322 #endif
5323 	hbflag = 0;
5324 	if (control_only)
5325 		no_data_chunks = 1;
5326 	else
5327 		no_data_chunks = 0;
5328 
5329 	/* Nothing to possible to send? */
5330 	if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5331 	    TAILQ_EMPTY(&asoc->send_queue) &&
5332 	    TAILQ_EMPTY(&asoc->out_wheel)) {
5333 #ifdef SCTP_DEBUG
5334 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5335 			printf("All wheels empty\n");
5336 		}
5337 #endif
5338 		return (0);
5339 	}
5340 	if (asoc->peers_rwnd <= 0) {
5341 		/* No room in peers rwnd */
5342 		*cwnd_full = 1;
5343 		*reason_code = 1;
5344 		if (asoc->total_flight > 0) {
5345 			/* we are allowed one chunk in flight */
5346 			no_data_chunks = 1;
5347 			sctp_pegs[SCTP_RWND_BLOCKED]++;
5348 		}
5349 	}
5350 #ifdef SCTP_DEBUG
5351 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5352 		printf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5353 		       (int)no_data_chunks,
5354 		       (int)asoc->total_flight, (int)asoc->peers_rwnd);
5355 	}
5356 #endif
5357 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5358 #ifdef SCTP_DEBUG
5359 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5360 			printf("net:%p fs:%d  cwnd:%d\n",
5361 			       net, net->flight_size, net->cwnd);
5362 		}
5363 #endif
5364 		if (net->flight_size >= net->cwnd) {
5365 			/* skip this network, no room */
5366 			cwnd_full_ind++;
5367 #ifdef SCTP_DEBUG
5368 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5369 				printf("Ok skip fillup->fs:%d > cwnd:%d\n",
5370 				       net->flight_size,
5371 				       net->cwnd);
5372 			}
5373 #endif
5374 			sctp_pegs[SCTP_CWND_NOFILL]++;
5375 			continue;
5376 		}
5377 		/*
5378 		 * spin through the stream queues moving one message and
5379 		 * assign TSN's as appropriate.
5380 		 */
5381 		sctp_fill_outqueue(stcb, net);
5382 	}
5383 	*cwnd_full = cwnd_full_ind;
5384 	/* now service each destination and send out what we can for it */
5385 #ifdef SCTP_DEBUG
5386 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5387 		int chk_cnt = 0;
5388 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5389 			chk_cnt++;
5390 		}
5391 		printf("We have %d chunks on the send_queue\n", chk_cnt);
5392 		chk_cnt = 0;
5393 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5394 			chk_cnt++;
5395 		}
5396 		printf("We have %d chunks on the sent_queue\n", chk_cnt);
5397 		TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5398 			chk_cnt++;
5399 		}
5400 		printf("We have %d chunks on the control_queue\n", chk_cnt);
5401 	}
5402 #endif
5403 	/* If we have data to send, and DSACK is running, stop it
5404 	 * and build a SACK to dump on to bundle with output. This
5405 	 * actually MAY make it so the bundling does not occur if
5406 	 * the SACK is big but I think this is ok because basic SACK
5407 	 * space is pre-reserved in our fragmentation size choice.
5408 	 */
5409 	if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5410 	    (no_data_chunks == 0)) {
5411 		/* We will be sending something */
5412 		if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5413 			/* Yep a callout is pending */
5414 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5415 					stcb->sctp_ep,
5416 					stcb, NULL);
5417 			sctp_send_sack(stcb);
5418 		}
5419 	}
5420 	/* Nothing to send? */
5421 	if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5422 	    (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5423 		return (0);
5424 	}
5425 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5426 		struct rtentry *rt;
5427 		/* how much can we send? */
5428 		if (net->ref_count < 2) {
5429 			/* Ref-count of 1 so we cannot have data or control
5430 			 * queued to this address. Skip it.
5431 			 */
5432  			continue;
5433 		}
5434 		ctl_cnt = bundle_at = 0;
5435 		outchain = NULL;
5436 		no_fragmentflg = 1;
5437 		one_chunk = 0;
5438 
5439 		rt = rtcache_validate(&net->ro);
5440 		if (rt != NULL) {
5441 			/* if we have a route and an ifp
5442 			 * check to see if we have room to
5443 			 * send to this guy
5444 			 */
5445 			struct ifnet *ifp;
5446 			ifp = net->ro._ro_rt->rt_ifp;
5447 			if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
5448 				sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
5449 #ifdef SCTP_LOG_MAXBURST
5450 				sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
5451   #endif
5452 				rtcache_unref(rt, &net->ro);
5453 				continue;
5454 			}
5455 			rtcache_unref(rt, &net->ro);
5456 		}
5457 		if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
5458 			mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5459 		} else {
5460 			mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5461 		}
5462 		if (mtu > asoc->peers_rwnd) {
5463 			if (asoc->total_flight > 0) {
5464 				/* We have a packet in flight somewhere */
5465 				r_mtu = asoc->peers_rwnd;
5466 			} else {
5467 				/* We are always allowed to send one MTU out */
5468 				one_chunk = 1;
5469 				r_mtu = mtu;
5470 			}
5471 		} else {
5472 			r_mtu = mtu;
5473 		}
5474 #ifdef SCTP_DEBUG
5475 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5476 			printf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5477 			       r_mtu, mtu, net, one_chunk);
5478 		}
5479 #endif
5480 		/************************/
5481 		/* Control transmission */
5482 		/************************/
5483 		/* Now first lets go through the control queue */
5484 		for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5485 		     chk; chk = nchk) {
5486 			nchk = TAILQ_NEXT(chk, sctp_next);
5487 			if (chk->whoTo != net) {
5488 				/*
5489 				 * No, not sent to the network we are
5490 				 * looking at
5491 				 */
5492 				continue;
5493 			}
5494 			if (chk->data == NULL) {
5495 				continue;
5496 			}
5497 			if ((chk->data->m_flags & M_PKTHDR) == 0) {
5498 				/*
5499 				 * NOTE: the chk queue MUST have the PKTHDR
5500 				 * flag set on it with a total in the
5501 				 * m_pkthdr.len field!! else the chunk will
5502 				 * ALWAYS be skipped
5503 				 */
5504 				continue;
5505 			}
5506 			if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5507 				/*
5508 				 * It must be unsent. Cookies and ASCONF's
5509 				 * hang around but there timers will force
5510 				 * when marked for resend.
5511 				 */
5512 				continue;
5513 			}
5514 			/* Here we do NOT factor the r_mtu */
5515 			if ((chk->data->m_pkthdr.len < (int)mtu) ||
5516 			    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5517 				/*
5518 				 * We probably should glom the mbuf chain from
5519 				 * the chk->data for control but the problem
5520 				 * is it becomes yet one more level of
5521 				 * tracking to do if for some reason output
5522 				 * fails. Then I have got to reconstruct the
5523 				 * merged control chain.. el yucko.. for now
5524 				 * we take the easy way and do the copy
5525 				 */
5526 				outchain = sctp_copy_mbufchain(chk->data,
5527 							       outchain);
5528 				if (outchain == NULL) {
5529 					return (ENOMEM);
5530 				}
5531 				/* update our MTU size */
5532 				if (mtu > chk->data->m_pkthdr.len)
5533 					mtu -= chk->data->m_pkthdr.len;
5534 				else
5535 					mtu = 0;
5536 				/* Do clear IP_DF ? */
5537 				if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5538 					no_fragmentflg = 0;
5539 				}
5540 				/* Mark things to be removed, if needed */
5541 				if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5542 				    (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5543 				    (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5544 				    (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5545 				    (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5546 				    (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5547 				    (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5548 				    (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5549 				    (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5550 				    (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5551 
5552 					if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5553 						hbflag = 1;
5554 					/* remove these chunks at the end */
5555 					if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5556 						/* turn off the timer */
5557 						if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5558 							sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5559 									inp, stcb, net);
5560 						}
5561 					}
5562 					ctl_cnt++;
5563 				} else {
5564 					/*
5565 					 * Other chunks, since they have
5566 					 * timers running (i.e. COOKIE or
5567 					 * ASCONF) we just "trust" that it
5568 					 * gets sent or retransmitted.
5569 					 */
5570 					ctl_cnt++;
5571 					if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5572 						cookie = 1;
5573 						no_out_cnt = 1;
5574 					} else if (chk->rec.chunk_id == SCTP_ASCONF) {
5575 						/*
5576 						 * set hb flag since we can use
5577 						 * these for RTO
5578 						 */
5579 						hbflag = 1;
5580 						asconf = 1;
5581 					}
5582 					chk->sent = SCTP_DATAGRAM_SENT;
5583 					chk->snd_count++;
5584 				}
5585 				if (mtu == 0) {
5586 					/*
5587 					 * Ok we are out of room but we can
5588 					 * output without effecting the flight
5589 					 * size since this little guy is a
5590 					 * control only packet.
5591 					 */
5592 					if (asconf) {
5593 						sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5594 						asconf = 0;
5595 					}
5596 					if (cookie) {
5597 						sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5598 						cookie = 0;
5599 					}
5600 					if (outchain->m_len == 0) {
5601 						/*
5602 						 * Special case for when you
5603 						 * get a 0 len mbuf at the
5604 						 * head due to the lack of a
5605 						 * MHDR at the beginning.
5606 						 */
5607 						outchain->m_len = sizeof(struct sctphdr);
5608 					} else {
5609 						M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
5610 						if (outchain == NULL) {
5611 							/* no memory */
5612 							error = ENOBUFS;
5613 							goto error_out_again;
5614 						}
5615 					}
5616 					shdr = mtod(outchain, struct sctphdr *);
5617 					shdr->src_port = inp->sctp_lport;
5618 					shdr->dest_port = stcb->rport;
5619 					shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5620 					shdr->checksum = 0;
5621 
5622 					if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5623 										rtcache_getdst(&net->ro),
5624 										outchain,
5625 										no_fragmentflg, 0, NULL, asconf))) {
5626 						if (error == ENOBUFS) {
5627 							asoc->ifp_had_enobuf = 1;
5628 						}
5629 						sctp_pegs[SCTP_DATA_OUT_ERR]++;
5630 						if (from_where == 0) {
5631 							sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5632 						}
5633 					error_out_again:
5634 #ifdef SCTP_DEBUG
5635 						if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5636 							printf("Gak got ctrl error %d\n", error);
5637 						}
5638 #endif
5639 						/* error, could not output */
5640 						if (hbflag) {
5641 #ifdef SCTP_DEBUG
5642 							if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5643 								printf("Update HB anyway\n");
5644 							}
5645 #endif
5646 							if (*now_filled == 0) {
5647 								SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5648 								*now_filled = 1;
5649 								*now = net->last_sent_time;
5650 							} else {
5651 								net->last_sent_time = *now;
5652 							}
5653 							hbflag = 0;
5654 						}
5655 						if (error == EHOSTUNREACH) {
5656 							/*
5657 							 * Destination went
5658 							 * unreachable during
5659 							 * this send
5660 							 */
5661 #ifdef SCTP_DEBUG
5662 							if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5663 								printf("Moving data to an alterante\n");
5664 							}
5665 #endif
5666 							sctp_move_to_an_alt(stcb, asoc, net);
5667 						}
5668 						sctp_clean_up_ctl (asoc);
5669 						return (error);
5670 					} else
5671 						asoc->ifp_had_enobuf = 0;
5672 					/* Only HB or ASCONF advances time */
5673 					if (hbflag) {
5674 						if (*now_filled == 0) {
5675 							SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5676 							*now_filled = 1;
5677 							*now = net->last_sent_time;
5678 						} else {
5679 							net->last_sent_time = *now;
5680 						}
5681 						hbflag = 0;
5682 					}
5683 					/*
5684 					 * increase the number we sent, if a
5685 					 * cookie is sent we don't tell them
5686 					 * any was sent out.
5687 					 */
5688 					if (!no_out_cnt)
5689 						*num_out +=  ctl_cnt;
5690 					/* recalc a clean slate and setup */
5691 					if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5692 						mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5693 					} else {
5694 						mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5695 					}
5696 					no_fragmentflg = 1;
5697 				}
5698 			}
5699 		}
5700 		/*********************/
5701 		/* Data transmission */
5702 		/*********************/
5703 		/* now lets add any data within the MTU constraints */
5704 		if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
5705 			omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5706 		} else {
5707 			omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5708 		}
5709 
5710 #ifdef SCTP_DEBUG
5711 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5712 			printf("Now to data transmission\n");
5713 		}
5714 #endif
5715 
5716 		if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5717 		    (cookie)) {
5718 			for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5719 				if (no_data_chunks) {
5720 					/* let only control go out */
5721 #ifdef SCTP_DEBUG
5722 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5723 						printf("Either nothing to send or we are full\n");
5724 					}
5725 #endif
5726 					break;
5727 				}
5728 				if (net->flight_size >= net->cwnd) {
5729 					/* skip this net, no room for data */
5730 #ifdef SCTP_DEBUG
5731 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5732 						printf("fs:%d > cwnd:%d\n",
5733 						       net->flight_size, net->cwnd);
5734 					}
5735 #endif
5736 					sctp_pegs[SCTP_CWND_BLOCKED]++;
5737 					*reason_code = 2;
5738 					break;
5739 				}
5740 				nchk = TAILQ_NEXT(chk, sctp_next);
5741 				if (chk->whoTo != net) {
5742 					/* No, not sent to this net */
5743 #ifdef SCTP_DEBUG
5744 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5745 						printf("chk->whoTo:%p not %p\n",
5746 						       chk->whoTo, net);
5747 
5748 					}
5749 #endif
5750 					continue;
5751 				}
5752 #ifdef SCTP_DEBUG
5753 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5754 					printf("Can we pick up a chunk?\n");
5755 				}
5756 #endif
5757 				if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5758 					/* strange, we have a chunk that is to bit
5759 					 * for its destination and yet no fragment ok flag.
5760 					 * Something went wrong when the PMTU changed...we did
5761 					 * not mark this chunk for some reason?? I will
5762 					 * fix it here by letting IP fragment it for now and
5763 					 * printing a warning. This really should not happen ...
5764 					 */
5765 /*#ifdef SCTP_DEBUG*/
5766 					printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5767 					       chk->send_size, mtu);
5768 /*#endif*/
5769 					chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5770 				}
5771 
5772 				if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5773 				    ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5774 					/* ok we will add this one */
5775 #ifdef SCTP_DEBUG
5776 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5777 						printf("Picking up the chunk\n");
5778 					}
5779 #endif
5780 					outchain = sctp_copy_mbufchain(chk->data, outchain);
5781 					if (outchain == NULL) {
5782 #ifdef SCTP_DEBUG
5783 						if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5784 							printf("Gakk no memory\n");
5785 						}
5786 #endif
5787 						if (!callout_pending(&net->rxt_timer.timer)) {
5788 							sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5789 						}
5790 						return (ENOMEM);
5791 					}
5792 					/* upate our MTU size */
5793 					/* Do clear IP_DF ? */
5794 					if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5795 						no_fragmentflg = 0;
5796 					}
5797 					mtu -= chk->send_size;
5798 					r_mtu -= chk->send_size;
5799 					data_list[bundle_at++] = chk;
5800 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5801 						mtu = 0;
5802 						break;
5803 					}
5804 					if (mtu <= 0) {
5805 						mtu = 0;
5806 						break;
5807 					}
5808 					if ((r_mtu <= 0) || one_chunk) {
5809 						r_mtu = 0;
5810 						break;
5811 					}
5812 				} else {
5813 					/*
5814 					 * Must be sent in order of the TSN's
5815 					 * (on a network)
5816 					 */
5817 #ifdef SCTP_DEBUG
5818 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5819 						printf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5820 						       chk->send_size, mtu, r_mtu);
5821 					}
5822 #endif
5823 
5824 					break;
5825 				}
5826 			}/* for () */
5827 		} /* if asoc.state OPEN */
5828 		/* Is there something to send for this destination? */
5829 #ifdef SCTP_DEBUG
5830 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5831 			printf("ok now is chain assembled? %p\n",
5832 			       outchain);
5833 		}
5834 #endif
5835 
5836 		if (outchain) {
5837 			/* We may need to start a control timer or two */
5838 			if (asconf) {
5839 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5840 				asconf = 0;
5841 			}
5842 			if (cookie) {
5843 				sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5844 				cookie = 0;
5845 			}
5846 			/* must start a send timer if data is being sent */
5847 			if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5848 				/* no timer running on this destination
5849 				 * restart it.
5850 				 */
5851 #ifdef SCTP_DEBUG
5852 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5853 					printf("ok lets start a send timer .. we will transmit %p\n",
5854 					       outchain);
5855 				}
5856 #endif
5857 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5858 			}
5859 			/* Now send it, if there is anything to send :> */
5860 			if ((outchain->m_flags & M_PKTHDR) == 0) {
5861 				struct mbuf *t;
5862 
5863 				MGETHDR(t, M_DONTWAIT, MT_HEADER);
5864 				if (t == NULL) {
5865 					sctp_m_freem(outchain);
5866 					return (ENOMEM);
5867 				}
5868 				t->m_next = outchain;
5869 				t->m_pkthdr.len = 0;
5870 				m_reset_rcvif(t);
5871 				t->m_len = 0;
5872 
5873 				outchain = t;
5874 				while (t) {
5875 					outchain->m_pkthdr.len += t->m_len;
5876 					t = t->m_next;
5877 				}
5878 			}
5879 			if (outchain->m_len == 0) {
5880 				/* Special case for when you get a 0 len
5881 				 * mbuf at the head due to the lack
5882 				 * of a MHDR at the beginning.
5883 				 */
5884 				MH_ALIGN(outchain, sizeof(struct sctphdr));
5885 				outchain->m_len = sizeof(struct sctphdr);
5886 			} else {
5887 				M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
5888 				if (outchain == NULL) {
5889 					/* out of mbufs */
5890 					error = ENOBUFS;
5891 					goto errored_send;
5892 				}
5893 			}
5894 			shdr = mtod(outchain, struct sctphdr *);
5895 			shdr->src_port = inp->sctp_lport;
5896 			shdr->dest_port = stcb->rport;
5897 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5898 			shdr->checksum = 0;
5899 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5900 								rtcache_getdst(&net->ro),
5901 								outchain,
5902 								no_fragmentflg, bundle_at, data_list[0], asconf))) {
5903 				/* error, we could not output */
5904 				if (error == ENOBUFS) {
5905 					asoc->ifp_had_enobuf = 1;
5906 				}
5907 				sctp_pegs[SCTP_DATA_OUT_ERR]++;
5908 				if (from_where == 0) {
5909 					sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5910 				}
5911 
5912 			errored_send:
5913 #ifdef SCTP_DEBUG
5914 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5915 					printf("Gak send error %d\n", error);
5916 				}
5917 #endif
5918 				if (hbflag) {
5919 #ifdef SCTP_DEBUG
5920 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5921 						printf("Update HB time anyway\n");
5922 					}
5923 #endif
5924 					if (*now_filled == 0) {
5925 						SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5926 						*now_filled = 1;
5927 						*now = net->last_sent_time;
5928 					} else {
5929 						net->last_sent_time = *now;
5930 					}
5931 					hbflag = 0;
5932 				}
5933 				if (error == EHOSTUNREACH) {
5934 					/*
5935 					 * Destination went unreachable during
5936 					 * this send
5937 					 */
5938 #ifdef SCTP_DEBUG
5939 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5940 						printf("Calling the movement routine\n");
5941 					}
5942 #endif
5943 					sctp_move_to_an_alt(stcb, asoc, net);
5944 				}
5945 				sctp_clean_up_ctl (asoc);
5946 				return (error);
5947 			} else {
5948 				asoc->ifp_had_enobuf = 0;
5949 			}
5950 			if (bundle_at || hbflag) {
5951 				/* For data/asconf and hb set time */
5952 				if (*now_filled == 0) {
5953 					SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5954 					*now_filled = 1;
5955 					*now = net->last_sent_time;
5956 				} else {
5957 					net->last_sent_time = *now;
5958 				}
5959 			}
5960 
5961 			if (!no_out_cnt) {
5962 				*num_out += (ctl_cnt + bundle_at);
5963 			}
5964 			if (bundle_at) {
5965 				if (!net->rto_pending) {
5966 					/* setup for a RTO measurement */
5967 					net->rto_pending = 1;
5968 					data_list[0]->do_rtt = 1;
5969 				} else {
5970 					data_list[0]->do_rtt = 0;
5971 				}
5972 				sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
5973 				sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
5974 			}
5975 			if (one_chunk) {
5976 				break;
5977 			}
5978 		}
5979 	}
5980 	/* At the end there should be no NON timed
5981 	 * chunks hanging on this queue.
5982 	 */
5983 	if ((*num_out == 0) && (*reason_code == 0)) {
5984 		*reason_code = 3;
5985 	}
5986 	sctp_clean_up_ctl (asoc);
5987 	return (0);
5988 }
5989 
5990 void
5991 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
5992 {
5993 	/* Prepend a OPERATIONAL_ERROR chunk header
5994 	 * and put on the end of the control chunk queue.
5995 	 */
5996 	/* Sender had better have gotten a MGETHDR or else
5997 	 * the control chunk will be forever skipped
5998 	 */
5999 	struct sctp_chunkhdr *hdr;
6000 	struct sctp_tmit_chunk *chk;
6001 	struct mbuf *mat;
6002 
6003 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6004 	if (chk == NULL) {
6005 		/* no memory */
6006 		sctp_m_freem(op_err);
6007 		return;
6008 	}
6009 	sctppcbinfo.ipi_count_chunk++;
6010 	sctppcbinfo.ipi_gencnt_chunk++;
6011 	M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT);
6012 	if (op_err == NULL) {
6013 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6014 		sctppcbinfo.ipi_count_chunk--;
6015 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6016 			panic("Chunk count is negative");
6017 		}
6018 		sctppcbinfo.ipi_gencnt_chunk++;
6019 		return;
6020 	}
6021 	chk->send_size = 0;
6022 	mat = op_err;
6023 	while (mat != NULL) {
6024 		chk->send_size += mat->m_len;
6025 		mat = mat->m_next;
6026 	}
6027 	chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6028 	chk->sent = SCTP_DATAGRAM_UNSENT;
6029 	chk->snd_count = 0;
6030 	chk->flags = 0;
6031 	chk->asoc = &stcb->asoc;
6032 	chk->data = op_err;
6033 	chk->whoTo = chk->asoc->primary_destination;
6034 	chk->whoTo->ref_count++;
6035 	hdr = mtod(op_err, struct sctp_chunkhdr *);
6036 	hdr->chunk_type = SCTP_OPERATION_ERROR;
6037 	hdr->chunk_flags = 0;
6038 	hdr->chunk_length = htons(chk->send_size);
6039 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6040 			  chk,
6041 			  sctp_next);
6042 	chk->asoc->ctrl_queue_cnt++;
6043 }
6044 
6045 int
6046 sctp_send_cookie_echo(struct mbuf *m,
6047 		      int offset,
6048 		      struct sctp_tcb *stcb,
6049 		      struct sctp_nets *net)
6050 {
6051 	/*
6052 	 * pull out the cookie and put it at the front of the control
6053 	 * chunk queue.
6054 	 */
6055 	int at;
6056 	struct mbuf *cookie, *mat;
6057 	struct sctp_paramhdr parm, *phdr;
6058 	struct sctp_chunkhdr *hdr;
6059 	struct sctp_tmit_chunk *chk;
6060 	uint16_t ptype, plen;
6061 	/* First find the cookie in the param area */
6062 	cookie = NULL;
6063 	at = offset + sizeof(struct sctp_init_chunk);
6064 
6065 	do {
6066 		phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6067 		if (phdr == NULL) {
6068 			return (-3);
6069 		}
6070 		ptype = ntohs(phdr->param_type);
6071 		plen = ntohs(phdr->param_length);
6072 		if (ptype == SCTP_STATE_COOKIE) {
6073 			int pad;
6074 			/* found the cookie */
6075 			if ((pad = (plen % 4))) {
6076 				plen += 4 - pad;
6077 			}
6078 			cookie = sctp_m_copym(m, at, plen, M_DONTWAIT);
6079 			if (cookie == NULL) {
6080 				/* No memory */
6081 				return (-2);
6082 			}
6083 			break;
6084 		}
6085 		at += SCTP_SIZE32(plen);
6086 	} while (phdr);
6087 	if (cookie == NULL) {
6088 		/* Did not find the cookie */
6089 		return (-3);
6090 	}
6091 	/* ok, we got the cookie lets change it into a cookie echo chunk */
6092 
6093 	/* first the change from param to cookie */
6094 	hdr = mtod(cookie, struct sctp_chunkhdr *);
6095 	hdr->chunk_type = SCTP_COOKIE_ECHO;
6096 	hdr->chunk_flags = 0;
6097 	/* now we MUST have a PKTHDR on it */
6098 	if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6099 		/* we hope this happens rarely */
6100 		MGETHDR(mat, M_DONTWAIT, MT_HEADER);
6101 		if (mat == NULL) {
6102 			sctp_m_freem(cookie);
6103 			return (-4);
6104 		}
6105 		mat->m_len = 0;
6106 		m_reset_rcvif(mat);
6107 		mat->m_next = cookie;
6108 		cookie = mat;
6109 	}
6110 	cookie->m_pkthdr.len = plen;
6111 	/* get the chunk stuff now and place it in the FRONT of the queue */
6112 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6113 	if (chk == NULL) {
6114 		/* no memory */
6115 		sctp_m_freem(cookie);
6116 		return (-5);
6117 	}
6118 	sctppcbinfo.ipi_count_chunk++;
6119 	sctppcbinfo.ipi_gencnt_chunk++;
6120 	chk->send_size = cookie->m_pkthdr.len;
6121 	chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6122 	chk->sent = SCTP_DATAGRAM_UNSENT;
6123 	chk->snd_count = 0;
6124 	chk->flags = 0;
6125 	chk->asoc = &stcb->asoc;
6126 	chk->data = cookie;
6127 	chk->whoTo = chk->asoc->primary_destination;
6128 	chk->whoTo->ref_count++;
6129 	TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6130 	chk->asoc->ctrl_queue_cnt++;
6131 	return (0);
6132 }
6133 
6134 void
6135 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6136 			struct mbuf *m,
6137 			int offset,
6138 			int chk_length,
6139 			struct sctp_nets *net)
6140 {
6141 	/* take a HB request and make it into a
6142 	 * HB ack and send it.
6143 	 */
6144 	struct mbuf *outchain;
6145 	struct sctp_chunkhdr *chdr;
6146 	struct sctp_tmit_chunk *chk;
6147 
6148 
6149 	if (net == NULL)
6150 		/* must have a net pointer */
6151 		return;
6152 
6153 	outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT);
6154 	if (outchain == NULL) {
6155 		/* gak out of memory */
6156 		return;
6157 	}
6158 	chdr = mtod(outchain, struct sctp_chunkhdr *);
6159 	chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6160 	chdr->chunk_flags = 0;
6161 	if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6162 		/* should not happen but we are cautious. */
6163 		struct mbuf *tmp;
6164 		MGETHDR(tmp, M_DONTWAIT, MT_HEADER);
6165 		if (tmp == NULL) {
6166 			return;
6167 		}
6168 		tmp->m_len = 0;
6169 		m_reset_rcvif(tmp);
6170 		tmp->m_next = outchain;
6171 		outchain = tmp;
6172 	}
6173 	outchain->m_pkthdr.len = chk_length;
6174 	if (chk_length % 4) {
6175 		/* need pad */
6176 		u_int32_t cpthis=0;
6177 		int padlen;
6178 		padlen = 4 - (outchain->m_pkthdr.len % 4);
6179 		m_copyback(outchain, outchain->m_pkthdr.len, padlen, (void *)&cpthis);
6180 	}
6181 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6182 	if (chk == NULL) {
6183 		/* no memory */
6184 		sctp_m_freem(outchain);
6185 		return ;
6186 	}
6187 	sctppcbinfo.ipi_count_chunk++;
6188 	sctppcbinfo.ipi_gencnt_chunk++;
6189 
6190 	chk->send_size = chk_length;
6191 	chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6192 	chk->sent = SCTP_DATAGRAM_UNSENT;
6193 	chk->snd_count = 0;
6194 	chk->flags = 0;
6195 	chk->asoc = &stcb->asoc;
6196 	chk->data = outchain;
6197 	chk->whoTo = net;
6198 	chk->whoTo->ref_count++;
6199 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6200 	chk->asoc->ctrl_queue_cnt++;
6201 }
6202 
6203 int
6204 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6205 	/* formulate and queue a cookie-ack back to sender */
6206 	struct mbuf *cookie_ack;
6207 	struct sctp_chunkhdr *hdr;
6208 	struct sctp_tmit_chunk *chk;
6209 
6210 	cookie_ack = NULL;
6211 	MGETHDR(cookie_ack, M_DONTWAIT, MT_HEADER);
6212 	if (cookie_ack == NULL) {
6213 		/* no mbuf's */
6214 		return (-1);
6215 	}
6216  	cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6217 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6218 	if (chk == NULL) {
6219 		/* no memory */
6220 		sctp_m_freem(cookie_ack);
6221 		return (-1);
6222 	}
6223 	sctppcbinfo.ipi_count_chunk++;
6224 	sctppcbinfo.ipi_gencnt_chunk++;
6225 
6226 	chk->send_size = sizeof(struct sctp_chunkhdr);
6227 	chk->rec.chunk_id = SCTP_COOKIE_ACK;
6228 	chk->sent = SCTP_DATAGRAM_UNSENT;
6229 	chk->snd_count = 0;
6230 	chk->flags = 0;
6231 	chk->asoc = &stcb->asoc;
6232 	chk->data = cookie_ack;
6233 	if (chk->asoc->last_control_chunk_from != NULL) {
6234 		chk->whoTo = chk->asoc->last_control_chunk_from;
6235 	} else {
6236 		chk->whoTo = chk->asoc->primary_destination;
6237 	}
6238 	chk->whoTo->ref_count++;
6239 	hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6240 	hdr->chunk_type = SCTP_COOKIE_ACK;
6241 	hdr->chunk_flags = 0;
6242 	hdr->chunk_length = htons(chk->send_size);
6243 	cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6244 	m_reset_rcvif(cookie_ack);
6245 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6246 	chk->asoc->ctrl_queue_cnt++;
6247 	return (0);
6248 }
6249 
6250 
6251 int
6252 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6253 {
6254 	/* formulate and queue a SHUTDOWN-ACK back to the sender */
6255 	struct mbuf *m_shutdown_ack;
6256 	struct sctp_shutdown_ack_chunk *ack_cp;
6257 	struct sctp_tmit_chunk *chk;
6258 
6259 	m_shutdown_ack = NULL;
6260 	MGETHDR(m_shutdown_ack, M_DONTWAIT, MT_HEADER);
6261 	if (m_shutdown_ack == NULL) {
6262 		/* no mbuf's */
6263 		return (-1);
6264 	}
6265 	m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6266 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6267 	if (chk == NULL) {
6268 		/* no memory */
6269 		sctp_m_freem(m_shutdown_ack);
6270 		return (-1);
6271 	}
6272 	sctppcbinfo.ipi_count_chunk++;
6273 	sctppcbinfo.ipi_gencnt_chunk++;
6274 
6275 	chk->send_size = sizeof(struct sctp_chunkhdr);
6276 	chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6277 	chk->sent = SCTP_DATAGRAM_UNSENT;
6278 	chk->snd_count = 0;
6279 	chk->flags = 0;
6280 	chk->asoc = &stcb->asoc;
6281 	chk->data = m_shutdown_ack;
6282 	chk->whoTo = net;
6283 	net->ref_count++;
6284 
6285 	ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6286 	ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6287 	ack_cp->ch.chunk_flags = 0;
6288 	ack_cp->ch.chunk_length = htons(chk->send_size);
6289 	m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6290 	m_reset_rcvif(m_shutdown_ack);
6291 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6292 	chk->asoc->ctrl_queue_cnt++;
6293 	return (0);
6294 }
6295 
6296 int
6297 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6298 {
6299 	/* formulate and queue a SHUTDOWN to the sender */
6300 	struct mbuf *m_shutdown;
6301 	struct sctp_shutdown_chunk *shutdown_cp;
6302 	struct sctp_tmit_chunk *chk;
6303 
6304 	m_shutdown = NULL;
6305 	MGETHDR(m_shutdown, M_DONTWAIT, MT_HEADER);
6306 	if (m_shutdown == NULL) {
6307 		/* no mbuf's */
6308 		return (-1);
6309 	}
6310 	m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6311 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6312 	if (chk == NULL) {
6313 		/* no memory */
6314 		sctp_m_freem(m_shutdown);
6315 		return (-1);
6316 	}
6317 	sctppcbinfo.ipi_count_chunk++;
6318 	sctppcbinfo.ipi_gencnt_chunk++;
6319 
6320 	chk->send_size = sizeof(struct sctp_shutdown_chunk);
6321 	chk->rec.chunk_id = SCTP_SHUTDOWN;
6322 	chk->sent = SCTP_DATAGRAM_UNSENT;
6323 	chk->snd_count = 0;
6324 	chk->flags = 0;
6325 	chk->asoc = &stcb->asoc;
6326 	chk->data = m_shutdown;
6327 	chk->whoTo = net;
6328 	net->ref_count++;
6329 
6330 	shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6331 	shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6332 	shutdown_cp->ch.chunk_flags = 0;
6333 	shutdown_cp->ch.chunk_length = htons(chk->send_size);
6334 	shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6335 	m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6336 	m_reset_rcvif(m_shutdown);
6337 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6338 	chk->asoc->ctrl_queue_cnt++;
6339 
6340 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6341 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6342 		stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
6343 		soisdisconnecting(stcb->sctp_ep->sctp_socket);
6344 	}
6345 	return (0);
6346 }
6347 
6348 int
6349 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6350 {
6351 	/*
6352 	 * formulate and queue an ASCONF to the peer
6353 	 * ASCONF parameters should be queued on the assoc queue
6354 	 */
6355 	struct sctp_tmit_chunk *chk;
6356 	struct mbuf *m_asconf;
6357 
6358 	/* compose an ASCONF chunk, maximum length is PMTU */
6359 	m_asconf = sctp_compose_asconf(stcb);
6360 	if (m_asconf == NULL) {
6361 		return (-1);
6362 	}
6363 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6364 	if (chk == NULL) {
6365 		/* no memory */
6366 		sctp_m_freem(m_asconf);
6367 		return (-1);
6368 	}
6369 	sctppcbinfo.ipi_count_chunk++;
6370 	sctppcbinfo.ipi_gencnt_chunk++;
6371 
6372 	chk->data = m_asconf;
6373 	chk->send_size = m_asconf->m_pkthdr.len;
6374 	chk->rec.chunk_id = SCTP_ASCONF;
6375 	chk->sent = SCTP_DATAGRAM_UNSENT;
6376 	chk->snd_count = 0;
6377 	chk->flags = 0;
6378 	chk->asoc = &stcb->asoc;
6379 	chk->whoTo = chk->asoc->primary_destination;
6380 	chk->whoTo->ref_count++;
6381 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6382 	chk->asoc->ctrl_queue_cnt++;
6383 	return (0);
6384 }
6385 
6386 int
6387 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6388 {
6389 	/*
6390 	 * formulate and queue a asconf-ack back to sender
6391 	 * the asconf-ack must be stored in the tcb
6392 	 */
6393 	struct sctp_tmit_chunk *chk;
6394 	struct mbuf *m_ack;
6395 
6396 	/* is there a asconf-ack mbuf chain to send? */
6397 	if (stcb->asoc.last_asconf_ack_sent == NULL) {
6398 		return (-1);
6399 	}
6400 
6401 	/* copy the asconf_ack */
6402 #if defined(__FreeBSD__) || defined(__NetBSD__)
6403 	/* Supposedly the m_copypacket is a optimzation,
6404 	 * use it if we can.
6405 	 */
6406 	if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6407 		m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, M_DONTWAIT);
6408 		sctp_pegs[SCTP_CACHED_SRC]++;
6409 	} else
6410 		m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6411 #else
6412 		m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6413 #endif
6414 	if (m_ack == NULL) {
6415 		/* couldn't copy it */
6416 
6417 		return (-1);
6418 	}
6419 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6420 	if (chk == NULL) {
6421 		/* no memory */
6422 		if (m_ack)
6423 			sctp_m_freem(m_ack);
6424 		return (-1);
6425 	}
6426 	sctppcbinfo.ipi_count_chunk++;
6427 	sctppcbinfo.ipi_gencnt_chunk++;
6428 
6429 	/* figure out where it goes to */
6430 	if (retrans) {
6431 		/* we're doing a retransmission */
6432 		if (stcb->asoc.used_alt_asconfack > 2) {
6433 			/* tried alternate nets already, go back */
6434 			chk->whoTo = NULL;
6435 		} else {
6436 			/* need to try and alternate net */
6437 			chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6438 			stcb->asoc.used_alt_asconfack++;
6439 		}
6440 		if (chk->whoTo == NULL) {
6441 			/* no alternate */
6442 			if (stcb->asoc.last_control_chunk_from == NULL)
6443 				chk->whoTo = stcb->asoc.primary_destination;
6444 			else
6445 				chk->whoTo = stcb->asoc.last_control_chunk_from;
6446 			stcb->asoc.used_alt_asconfack = 0;
6447 		}
6448 	} else {
6449 		/* normal case */
6450 		if (stcb->asoc.last_control_chunk_from == NULL)
6451 			chk->whoTo = stcb->asoc.primary_destination;
6452 		else
6453 			chk->whoTo = stcb->asoc.last_control_chunk_from;
6454 		stcb->asoc.used_alt_asconfack = 0;
6455 	}
6456 	chk->data = m_ack;
6457 	chk->send_size = m_ack->m_pkthdr.len;
6458 	chk->rec.chunk_id = SCTP_ASCONF_ACK;
6459 	chk->sent = SCTP_DATAGRAM_UNSENT;
6460 	chk->snd_count = 0;
6461 	chk->flags = 0;
6462 	chk->asoc = &stcb->asoc;
6463 	chk->whoTo->ref_count++;
6464 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6465 	chk->asoc->ctrl_queue_cnt++;
6466 	return (0);
6467 }
6468 
6469 
6470 static int
6471 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6472 			  struct sctp_tcb *stcb,
6473 			  struct sctp_association *asoc,
6474 			  int *cnt_out, struct timeval *now, int *now_filled)
6475 {
6476 	/*
6477 	 * send out one MTU of retransmission.
6478 	 * If fast_retransmit is happening we ignore the cwnd.
6479 	 * Otherwise we obey the cwnd and rwnd.
6480 	 * For a Cookie or Asconf in the control chunk queue we retransmit
6481 	 * them by themselves.
6482 	 *
6483 	 * For data chunks we will pick out the lowest TSN's in the
6484 	 * sent_queue marked for resend and bundle them all together
6485 	 * (up to a MTU of destination). The address to send to should
6486 	 * have been selected/changed where the retransmission was
6487 	 * marked (i.e. in FR or t3-timeout routines).
6488 	 */
6489 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6490 	struct sctp_tmit_chunk *chk, *fwd;
6491 	struct mbuf *m;
6492 	struct sctphdr *shdr;
6493 	int asconf;
6494 	struct sctp_nets *net;
6495 	int no_fragmentflg, bundle_at, cnt_thru;
6496 	unsigned int mtu;
6497 	int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6498 
6499 	tmr_started = ctl_cnt = bundle_at =  error = 0;
6500 	no_fragmentflg = 1;
6501 	asconf = 0;
6502 	fwd_tsn = 0;
6503 	*cnt_out = 0;
6504 	fwd = NULL;
6505 	m = NULL;
6506 #ifdef SCTP_AUDITING_ENABLED
6507 	sctp_audit_log(0xC3, 1);
6508 #endif
6509 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
6510 #ifdef SCTP_DEBUG
6511 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6512 			printf("SCTP hits empty queue with cnt set to %d?\n",
6513 			       asoc->sent_queue_retran_cnt);
6514 		}
6515 #endif
6516 		asoc->sent_queue_cnt = 0;
6517 		asoc->sent_queue_cnt_removeable = 0;
6518 	}
6519 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6520 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
6521 			/* we only worry about things marked for resend */
6522 			continue;
6523 		}
6524 		if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6525 		    (chk->rec.chunk_id == SCTP_ASCONF) ||
6526 		    (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6527 		    (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6528 			if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6529 				/* For stream reset we only retran the request
6530 				 * not the response.
6531 				 */
6532 				struct sctp_stream_reset_req *strreq;
6533 				strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6534 				if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6535 					continue;
6536 				}
6537 			}
6538 			ctl_cnt++;
6539 			if (chk->rec.chunk_id == SCTP_ASCONF) {
6540 				no_fragmentflg = 1;
6541 				asconf = 1;
6542 			}
6543 			if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6544 				fwd_tsn = 1;
6545 				fwd = chk;
6546 			}
6547 			m = sctp_copy_mbufchain(chk->data, m);
6548 			break;
6549 		}
6550 	}
6551 	one_chunk = 0;
6552 	cnt_thru = 0;
6553 	/* do we have control chunks to retransmit? */
6554 	if (m != NULL) {
6555 		/* Start a timer no matter if we suceed or fail */
6556 		if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6557 			sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6558 		} else if (chk->rec.chunk_id == SCTP_ASCONF)
6559 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6560 
6561 		if (m->m_len == 0) {
6562 			/* Special case for when you get a 0 len
6563 			 * mbuf at the head due to the lack
6564 			 * of a MHDR at the beginning.
6565 			 */
6566 			m->m_len = sizeof(struct sctphdr);
6567 		} else {
6568 			M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
6569 			if (m == NULL) {
6570 				return (ENOBUFS);
6571 			}
6572 		}
6573 		shdr = mtod(m, struct sctphdr *);
6574 		shdr->src_port = inp->sctp_lport;
6575 		shdr->dest_port = stcb->rport;
6576 		shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6577 		shdr->checksum = 0;
6578 		chk->snd_count++;		/* update our count */
6579 
6580 		if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6581 		    rtcache_getdst(&chk->whoTo->ro), m,
6582 		    no_fragmentflg, 0, NULL, asconf))) {
6583 			sctp_pegs[SCTP_DATA_OUT_ERR]++;
6584 			return (error);
6585 		}
6586 		/*
6587 		 *We don't want to mark the net->sent time here since this
6588 		 * we use this for HB and retrans cannot measure RTT
6589 		 */
6590 		/*    SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6591 		*cnt_out += 1;
6592 		chk->sent = SCTP_DATAGRAM_SENT;
6593 		sctp_ucount_decr(asoc->sent_queue_retran_cnt);
6594 		if (fwd_tsn == 0) {
6595 			return (0);
6596 		} else {
6597 			/* Clean up the fwd-tsn list */
6598 			sctp_clean_up_ctl (asoc);
6599 			return (0);
6600 		}
6601 	}
6602 	/* Ok, it is just data retransmission we need to do or
6603 	 * that and a fwd-tsn with it all.
6604 	 */
6605 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
6606 		return (-1);
6607 	}
6608 #ifdef SCTP_DEBUG
6609 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6610 		printf("Normal chunk retransmission cnt:%d\n",
6611 		       asoc->sent_queue_retran_cnt);
6612 	}
6613 #endif
6614 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6615 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6616 		/* not yet open, resend the cookie and that is it */
6617 		return (1);
6618 	}
6619 
6620 
6621 #ifdef SCTP_AUDITING_ENABLED
6622 	sctp_auditing(20, inp, stcb, NULL);
6623 #endif
6624 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6625 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
6626 			/* No, not sent to this net or not ready for rtx */
6627 			continue;
6628 
6629 		}
6630 		/* pick up the net */
6631 		net = chk->whoTo;
6632 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6633 			mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6634 		} else {
6635 			mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6636 		}
6637 
6638 		if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6639 			/* No room in peers rwnd */
6640 			uint32_t tsn;
6641 			tsn = asoc->last_acked_seq + 1;
6642 			if (tsn == chk->rec.data.TSN_seq) {
6643 				/* we make a special exception for this case.
6644 				 * The peer has no rwnd but is missing the
6645 				 * lowest chunk.. which is probably what is
6646 				 * holding up the rwnd.
6647 				 */
6648 				goto one_chunk_around;
6649 			}
6650 #ifdef SCTP_DEBUG
6651 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6652 				printf("blocked-peers_rwnd:%d tf:%d\n",
6653 				       (int)asoc->peers_rwnd,
6654 				       (int)asoc->total_flight);
6655 			}
6656 #endif
6657 			sctp_pegs[SCTP_RWND_BLOCKED]++;
6658 			return (1);
6659 		}
6660 	one_chunk_around:
6661 		if (asoc->peers_rwnd < mtu) {
6662 			one_chunk = 1;
6663 		}
6664 #ifdef SCTP_AUDITING_ENABLED
6665 		sctp_audit_log(0xC3, 2);
6666 #endif
6667 		bundle_at = 0;
6668 		m = NULL;
6669 		net->fast_retran_ip = 0;
6670 		if (chk->rec.data.doing_fast_retransmit == 0) {
6671 			/* if no FR in progress skip destination that
6672 			 * have flight_size > cwnd.
6673 			 */
6674 			if (net->flight_size >= net->cwnd) {
6675 				sctp_pegs[SCTP_CWND_BLOCKED]++;
6676 				continue;
6677 			}
6678 		} else {
6679 			/* Mark the destination net to have FR recovery
6680 			 * limits put on it.
6681 			 */
6682 			net->fast_retran_ip = 1;
6683 		}
6684 
6685 		if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6686 			/* ok we will add this one */
6687 			m = sctp_copy_mbufchain(chk->data, m);
6688 			if (m == NULL) {
6689 				return (ENOMEM);
6690 			}
6691 			/* upate our MTU size */
6692 			/* Do clear IP_DF ? */
6693 			if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6694 				no_fragmentflg = 0;
6695 			}
6696 			mtu -= chk->send_size;
6697 			data_list[bundle_at++] = chk;
6698 			if (one_chunk && (asoc->total_flight <= 0)) {
6699 				sctp_pegs[SCTP_WINDOW_PROBES]++;
6700 				chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6701 			}
6702 		}
6703 		if (one_chunk == 0) {
6704 			/* now are there anymore forward from chk to pick up?*/
6705 			fwd = TAILQ_NEXT(chk, sctp_next);
6706 			while (fwd) {
6707 				if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6708 					/* Nope, not for retran */
6709 					fwd = TAILQ_NEXT(fwd, sctp_next);
6710 					continue;
6711 				}
6712 				if (fwd->whoTo != net) {
6713 					/* Nope, not the net in question */
6714 					fwd = TAILQ_NEXT(fwd, sctp_next);
6715 					continue;
6716 				}
6717 				if (fwd->send_size <= mtu) {
6718 					m = sctp_copy_mbufchain(fwd->data, m);
6719 					if (m == NULL) {
6720 						return (ENOMEM);
6721 					}
6722 					/* upate our MTU size */
6723 					/* Do clear IP_DF ? */
6724 					if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6725 						no_fragmentflg = 0;
6726 					}
6727 					mtu -= fwd->send_size;
6728 					data_list[bundle_at++] = fwd;
6729 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6730 						break;
6731 					}
6732 					fwd = TAILQ_NEXT(fwd, sctp_next);
6733 				} else {
6734 					/* can't fit so we are done */
6735 					break;
6736 				}
6737 			}
6738 		}
6739 		/* Is there something to send for this destination? */
6740 		if (m) {
6741 			/* No matter if we fail/or suceed we should
6742 			 * start a timer. A failure is like a lost
6743 			 * IP packet :-)
6744 			 */
6745 			if (!callout_pending(&net->rxt_timer.timer)) {
6746 				/* no timer running on this destination
6747 				 * restart it.
6748 				 */
6749 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6750 				tmr_started = 1;
6751 			}
6752 			if (m->m_len == 0) {
6753 				/* Special case for when you get a 0 len
6754 				 * mbuf at the head due to the lack
6755 				 * of a MHDR at the beginning.
6756 				 */
6757 				m->m_len = sizeof(struct sctphdr);
6758 			} else {
6759 				M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
6760 				if (m == NULL) {
6761 					return (ENOBUFS);
6762 				}
6763 			}
6764 			shdr = mtod(m, struct sctphdr *);
6765 			shdr->src_port = inp->sctp_lport;
6766 			shdr->dest_port = stcb->rport;
6767 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6768 			shdr->checksum = 0;
6769 
6770 			/* Now lets send it, if there is anything to send :> */
6771 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6772 							       rtcache_getdst(&net->ro),
6773 							       m,
6774 							       no_fragmentflg, 0, NULL, asconf))) {
6775 				/* error, we could not output */
6776 				sctp_pegs[SCTP_DATA_OUT_ERR]++;
6777 				return (error);
6778 			}
6779 			/* For HB's */
6780 			/*
6781 			 * We don't want to mark the net->sent time here since
6782 			 * this we use this for HB and retrans cannot measure
6783 			 * RTT
6784 			 */
6785 			/*      SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6786 
6787 			/* For auto-close */
6788 			cnt_thru++;
6789 			if (*now_filled == 0) {
6790 				SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6791 				*now = asoc->time_last_sent;
6792 				*now_filled = 1;
6793 			} else {
6794 				asoc->time_last_sent = *now;
6795 			}
6796 			*cnt_out += bundle_at;
6797 #ifdef SCTP_AUDITING_ENABLED
6798 			sctp_audit_log(0xC4, bundle_at);
6799 #endif
6800 			for (i = 0; i < bundle_at; i++) {
6801 				sctp_pegs[SCTP_RETRANTSN_SENT]++;
6802 				data_list[i]->sent = SCTP_DATAGRAM_SENT;
6803 				data_list[i]->snd_count++;
6804 				sctp_ucount_decr(asoc->sent_queue_retran_cnt);
6805 				/* record the time */
6806 				data_list[i]->sent_rcv_time = asoc->time_last_sent;
6807 				net->flight_size += data_list[i]->book_size;
6808 				asoc->total_flight += data_list[i]->book_size;
6809 				asoc->total_flight_count++;
6810 
6811 #ifdef SCTP_LOG_RWND
6812 				sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6813 					      asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6814 #endif
6815 				asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6816 								    (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6817 				if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6818 					/* SWS sender side engages */
6819 					asoc->peers_rwnd = 0;
6820 				}
6821 
6822 				if ((i == 0) &&
6823 				    (data_list[i]->rec.data.doing_fast_retransmit)) {
6824 					sctp_pegs[SCTP_FAST_RETRAN]++;
6825 					if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6826 					    (tmr_started == 0)) {
6827 						/*
6828 						 * ok we just fast-retrans'd
6829 						 * the lowest TSN, i.e the
6830 						 * first on the list. In this
6831 						 * case we want to give some
6832 						 * more time to get a SACK
6833 						 * back without a t3-expiring.
6834 						 */
6835 						sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6836 						sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6837 					}
6838 				}
6839 			}
6840 #ifdef SCTP_AUDITING_ENABLED
6841 			sctp_auditing(21, inp, stcb, NULL);
6842 #endif
6843 		} else {
6844 			/* None will fit */
6845 			return (1);
6846 		}
6847 		if (asoc->sent_queue_retran_cnt <= 0) {
6848 			/* all done we have no more to retran */
6849 			asoc->sent_queue_retran_cnt = 0;
6850 			break;
6851 		}
6852 		if (one_chunk) {
6853 			/* No more room in rwnd */
6854 			return (1);
6855 		}
6856 		/* stop the for loop here. we sent out a packet */
6857 		break;
6858 	}
6859 	return (0);
6860 }
6861 
6862 
6863 static int
6864 sctp_timer_validation(struct sctp_inpcb *inp,
6865 		      struct sctp_tcb *stcb,
6866 		      struct sctp_association *asoc,
6867 		      int ret)
6868 {
6869 	struct sctp_nets *net;
6870 	/* Validate that a timer is running somewhere */
6871 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6872 		if (callout_pending(&net->rxt_timer.timer)) {
6873 			/* Here is a timer */
6874 			return (ret);
6875 		}
6876 	}
6877 	/* Gak, we did not have a timer somewhere */
6878 #ifdef SCTP_DEBUG
6879 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6880 		printf("Deadlock avoided starting timer on a dest at retran\n");
6881 	}
6882 #endif
6883 	sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
6884 	return (ret);
6885 }
6886 
6887 int
6888 sctp_chunk_output(struct sctp_inpcb *inp,
6889 		  struct sctp_tcb *stcb,
6890 		  int from_where)
6891 {
6892 	/* Ok this is the generic chunk service queue.
6893 	 * we must do the following:
6894 	 *  - See if there are retransmits pending, if so we
6895 	 *   	must do these first and return.
6896 	 *  - Service the stream queue that is next,
6897 	 *    moving any message (note I must get a complete
6898 	 *    message i.e. FIRST/MIDDLE and LAST to the out
6899 	 *    queue in one pass) and assigning TSN's
6900 	 *  - Check to see if the cwnd/rwnd allows any output, if
6901 	 *	so we go ahead and fomulate and send the low level
6902 	 *    chunks. Making sure to combine any control in the
6903 	 *    control chunk queue also.
6904 	 */
6905 	struct sctp_association *asoc;
6906 	struct sctp_nets *net;
6907 	int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
6908 	struct timeval now;
6909 	int now_filled=0;
6910 	int cwnd_full=0;
6911 	asoc = &stcb->asoc;
6912 	tot_out = 0;
6913 	num_out = 0;
6914 	reason_code = 0;
6915 	sctp_pegs[SCTP_CALLS_TO_CO]++;
6916 #ifdef SCTP_DEBUG
6917 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6918 		printf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
6919 	}
6920 #endif
6921 	while (asoc->sent_queue_retran_cnt) {
6922 		/* Ok, it is retransmission time only, we send out only ONE
6923 		 * packet with a single call off to the retran code.
6924 		 */
6925 		ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
6926 		if (ret > 0) {
6927 			/* Can't send anymore */
6928 #ifdef SCTP_DEBUG
6929 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6930 				printf("retransmission ret:%d -- full\n", ret);
6931 			}
6932 #endif
6933 			/*
6934 			 * now lets push out control by calling med-level
6935 			 * output once. this assures that we WILL send HB's
6936 			 * if queued too.
6937 			 */
6938 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
6939 						    &cwnd_full, from_where,
6940 						    &now, &now_filled);
6941 #ifdef SCTP_DEBUG
6942 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6943 				printf("Control send outputs:%d@full\n", num_out);
6944 			}
6945 #endif
6946 #ifdef SCTP_AUDITING_ENABLED
6947 			sctp_auditing(8, inp, stcb, NULL);
6948 #endif
6949 			return (sctp_timer_validation(inp, stcb, asoc, ret));
6950 		}
6951 		if (ret < 0) {
6952 			/*
6953 			 * The count was off.. retran is not happening so do
6954 			 * the normal retransmission.
6955 			 */
6956 #ifdef SCTP_DEBUG
6957 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6958 				printf("Done with retrans, none left fill up window\n");
6959 			}
6960 #endif
6961 #ifdef SCTP_AUDITING_ENABLED
6962 			sctp_auditing(9, inp, stcb, NULL);
6963 #endif
6964 			break;
6965 		}
6966 		if (from_where == 1) {
6967 			/* Only one transmission allowed out of a timeout */
6968 #ifdef SCTP_DEBUG
6969 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6970 				printf("Only one packet allowed out\n");
6971 			}
6972 #endif
6973 #ifdef SCTP_AUDITING_ENABLED
6974 			sctp_auditing(10, inp, stcb, NULL);
6975 #endif
6976 			/* Push out any control */
6977 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
6978 						    &now, &now_filled);
6979 			return (ret);
6980 		}
6981 		if ((num_out == 0) && (ret == 0)) {
6982 			/* No more retrans to send */
6983 			break;
6984 		}
6985 	}
6986 #ifdef SCTP_AUDITING_ENABLED
6987 	sctp_auditing(12, inp, stcb, NULL);
6988 #endif
6989 	/* Check for bad destinations, if they exist move chunks around. */
6990 	burst_limit = asoc->max_burst;
6991 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6992 		if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
6993 		    SCTP_ADDR_NOT_REACHABLE) {
6994 			/*
6995 			 * if possible move things off of this address
6996 			 * we still may send below due to the dormant state
6997 			 * but we try to find an alternate address to send
6998 			 * to and if we have one we move all queued data on
6999 			 * the out wheel to this alternate address.
7000 			 */
7001 			sctp_move_to_an_alt(stcb, asoc, net);
7002 		} else {
7003 			/*
7004 			if ((asoc->sat_network) || (net->addr_is_local)) {
7005 				burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7006 			}
7007 			*/
7008 #ifdef SCTP_DEBUG
7009 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7010 				printf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7011 			}
7012 #endif
7013 
7014 #ifdef SCTP_USE_ALLMAN_BURST
7015 			if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7016 				if (net->ssthresh < net->cwnd)
7017 					net->ssthresh = net->cwnd;
7018 				net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7019 #ifdef SCTP_LOG_MAXBURST
7020 				sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7021 #endif
7022 				sctp_pegs[SCTP_MAX_BURST_APL]++;
7023 			}
7024 			net->fast_retran_ip = 0;
7025 #endif
7026 		}
7027 
7028 	}
7029 	/* Fill up what we can to the destination */
7030 	burst_cnt = 0;
7031 	cwnd_full = 0;
7032 	do {
7033 #ifdef SCTP_DEBUG
7034 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7035 			printf("Burst count:%d - call m-c-o\n", burst_cnt);
7036 		}
7037 #endif
7038 		error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7039 					      &reason_code, 0,  &cwnd_full, from_where,
7040 					      &now, &now_filled);
7041 		if (error) {
7042 #ifdef SCTP_DEBUG
7043 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7044 				printf("Error %d was returned from med-c-op\n", error);
7045 			}
7046 #endif
7047 #ifdef SCTP_LOG_MAXBURST
7048 			sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7049 #endif
7050 			break;
7051 		}
7052 #ifdef SCTP_DEBUG
7053 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7054 			printf("m-c-o put out %d\n", num_out);
7055 		}
7056 #endif
7057 		tot_out += num_out;
7058 		burst_cnt++;
7059 	} while (num_out
7060 #ifndef SCTP_USE_ALLMAN_BURST
7061 		 &&  (burst_cnt < burst_limit)
7062 #endif
7063 		);
7064 #ifndef SCTP_USE_ALLMAN_BURST
7065 	if (burst_cnt >= burst_limit) {
7066 		sctp_pegs[SCTP_MAX_BURST_APL]++;
7067  		asoc->burst_limit_applied = 1;
7068 #ifdef SCTP_LOG_MAXBURST
7069 		sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7070 #endif
7071  	} else {
7072 		asoc->burst_limit_applied = 0;
7073  	}
7074 #endif
7075 
7076 #ifdef SCTP_DEBUG
7077 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7078 		printf("Ok, we have put out %d chunks\n", tot_out);
7079 	}
7080 #endif
7081 	if (tot_out == 0) {
7082 		sctp_pegs[SCTP_CO_NODATASNT]++;
7083 		if (asoc->stream_queue_cnt > 0) {
7084 			sctp_pegs[SCTP_SOS_NOSNT]++;
7085 		} else {
7086 			sctp_pegs[SCTP_NOS_NOSNT]++;
7087 		}
7088 		if (asoc->send_queue_cnt > 0) {
7089 			sctp_pegs[SCTP_SOSE_NOSNT]++;
7090 		} else {
7091 			sctp_pegs[SCTP_NOSE_NOSNT]++;
7092 		}
7093 	}
7094 	/* Now we need to clean up the control chunk chain if
7095 	 * a ECNE is on it. It must be marked as UNSENT again
7096 	 * so next call will continue to send it until
7097 	 * such time that we get a CWR, to remove it.
7098 	 */
7099 	sctp_fix_ecn_echo(asoc);
7100 	return (error);
7101 }
7102 
7103 
7104 int
7105 sctp_output(struct sctp_inpcb *inp, struct mbuf *m,
7106      struct sockaddr *addr, struct mbuf *control, struct lwp *l, int flags)
7107 {
7108 	struct sctp_inpcb *t_inp;
7109  	struct sctp_tcb *stcb;
7110 	struct sctp_nets *net;
7111 	struct sctp_association *asoc;
7112 	int create_lock_applied = 0;
7113 	int queue_only, error = 0;
7114 	struct sctp_sndrcvinfo srcv;
7115 	int un_sent = 0;
7116 	int use_rcvinfo = 0;
7117 	t_inp = inp;
7118 	/*  struct route ro;*/
7119 
7120 	queue_only = 0;
7121 	stcb = NULL;
7122 	asoc = NULL;
7123 	net = NULL;
7124 
7125 #ifdef SCTP_DEBUG
7126 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7127 		printf("USR Send BEGINS\n");
7128 	}
7129 #endif
7130 
7131 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7132 	    (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7133 		/* The listner can NOT send */
7134 		if (control) {
7135 			sctppcbinfo.mbuf_track--;
7136 			sctp_m_freem(control);
7137 			control = NULL;
7138 		}
7139 		sctp_m_freem(m);
7140 		return (EFAULT);
7141 	}
7142 	/* Can't allow a V6 address on a non-v6 socket */
7143 	if (addr) {
7144 		SCTP_ASOC_CREATE_LOCK(inp);
7145 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7146 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7147 			/* Should I really unlock ? */
7148 			SCTP_ASOC_CREATE_UNLOCK(inp);
7149 			if (control) {
7150 				sctppcbinfo.mbuf_track--;
7151 				sctp_m_freem(control);
7152 				control = NULL;
7153 			}
7154 			sctp_m_freem(m);
7155 			return (EFAULT);
7156 		}
7157 		create_lock_applied = 1;
7158 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7159 		    (addr->sa_family == AF_INET6)) {
7160 			SCTP_ASOC_CREATE_UNLOCK(inp);
7161 			if (control) {
7162 				sctppcbinfo.mbuf_track--;
7163 				sctp_m_freem(control);
7164 				control = NULL;
7165 			}
7166 			sctp_m_freem(m);
7167 			return (EINVAL);
7168 		}
7169 	}
7170 	if (control) {
7171 		sctppcbinfo.mbuf_track++;
7172 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
7173 				   sizeof(srcv))) {
7174 			if (srcv.sinfo_flags & MSG_SENDALL) {
7175 				/* its a sendall */
7176 				sctppcbinfo.mbuf_track--;
7177 				sctp_m_freem(control);
7178 				if (create_lock_applied) {
7179 					SCTP_ASOC_CREATE_UNLOCK(inp);
7180 					create_lock_applied = 0;
7181 				}
7182 				return (sctp_sendall(inp, NULL, m, &srcv));
7183 			}
7184 			if (srcv.sinfo_assoc_id) {
7185 				if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7186 					SCTP_INP_RLOCK(inp);
7187 					stcb = LIST_FIRST(&inp->sctp_asoc_list);
7188 					if (stcb) {
7189 						SCTP_TCB_LOCK(stcb);
7190 					}
7191 					SCTP_INP_RUNLOCK(inp);
7192 
7193 					if (stcb == NULL) {
7194 						if (create_lock_applied) {
7195 							SCTP_ASOC_CREATE_UNLOCK(inp);
7196 							create_lock_applied = 0;
7197 						}
7198 						sctppcbinfo.mbuf_track--;
7199 						sctp_m_freem(control);
7200 						sctp_m_freem(m);
7201 						return (ENOTCONN);
7202 					}
7203 					net = stcb->asoc.primary_destination;
7204 				} else {
7205 					stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7206 				}
7207 				/*
7208 				 * Question: Should I error here if the
7209 
7210 				 * assoc_id is no longer valid?
7211 				 * i.e. I can't find it?
7212 				 */
7213 				if ((stcb) &&
7214 				    (addr != NULL)) {
7215 					/* Must locate the net structure */
7216 					if (addr)
7217 						net = sctp_findnet(stcb, addr);
7218 				}
7219 				if (net == NULL)
7220 					net = stcb->asoc.primary_destination;
7221 			}
7222 			use_rcvinfo = 1;
7223 		}
7224 	}
7225 	if (stcb == NULL) {
7226 		if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7227 			SCTP_INP_RLOCK(inp);
7228 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
7229 			if (stcb) {
7230 				SCTP_TCB_LOCK(stcb);
7231 			}
7232 			SCTP_INP_RUNLOCK(inp);
7233 			if (stcb == NULL) {
7234 				if (create_lock_applied) {
7235 					SCTP_ASOC_CREATE_UNLOCK(inp);
7236 					create_lock_applied = 0;
7237 				}
7238 				if (control) {
7239 					sctppcbinfo.mbuf_track--;
7240 					sctp_m_freem(control);
7241 					control = NULL;
7242 				}
7243 				sctp_m_freem(m);
7244 				return (ENOTCONN);
7245 			}
7246 			if (addr == NULL) {
7247 				net = stcb->asoc.primary_destination;
7248 			} else {
7249 				net = sctp_findnet(stcb, addr);
7250 				if (net == NULL) {
7251 					net = stcb->asoc.primary_destination;
7252 				}
7253 			}
7254 		} else {
7255 			if (addr != NULL) {
7256 				SCTP_INP_WLOCK(inp);
7257 				SCTP_INP_INCR_REF(inp);
7258 				SCTP_INP_WUNLOCK(inp);
7259 				stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7260 				if (stcb == NULL) {
7261 					SCTP_INP_WLOCK(inp);
7262 					SCTP_INP_DECR_REF(inp);
7263 					SCTP_INP_WUNLOCK(inp);
7264 				}
7265 			}
7266 		}
7267 	}
7268 	if ((stcb == NULL) &&
7269 	    (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7270 		if (control) {
7271 			sctppcbinfo.mbuf_track--;
7272 			sctp_m_freem(control);
7273 			control = NULL;
7274 		}
7275 		if (create_lock_applied) {
7276 			SCTP_ASOC_CREATE_UNLOCK(inp);
7277 			create_lock_applied = 0;
7278 		}
7279 		sctp_m_freem(m);
7280 		return (ENOTCONN);
7281 	} else if ((stcb == NULL) &&
7282 		   (addr == NULL)) {
7283 		if (control) {
7284 			sctppcbinfo.mbuf_track--;
7285 			sctp_m_freem(control);
7286 			control = NULL;
7287 		}
7288 		if (create_lock_applied) {
7289 			SCTP_ASOC_CREATE_UNLOCK(inp);
7290 			create_lock_applied = 0;
7291 		}
7292 		sctp_m_freem(m);
7293 		return (ENOENT);
7294 	} else if (stcb == NULL) {
7295 		/* UDP mode, we must go ahead and start the INIT process */
7296 		if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7297 			/* Strange user to do this */
7298 			if (control) {
7299 				sctppcbinfo.mbuf_track--;
7300 				sctp_m_freem(control);
7301 				control = NULL;
7302 			}
7303 			if (create_lock_applied) {
7304 				SCTP_ASOC_CREATE_UNLOCK(inp);
7305 				create_lock_applied = 0;
7306 			}
7307 			sctp_m_freem(m);
7308 			return (ENOENT);
7309 		}
7310 		stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7311 		if (stcb == NULL) {
7312 			if (control) {
7313 				sctppcbinfo.mbuf_track--;
7314 				sctp_m_freem(control);
7315 				control = NULL;
7316 			}
7317 			if (create_lock_applied) {
7318 				SCTP_ASOC_CREATE_UNLOCK(inp);
7319 				create_lock_applied = 0;
7320 			}
7321 			sctp_m_freem(m);
7322 			return (error);
7323 		}
7324 		if (create_lock_applied) {
7325 			SCTP_ASOC_CREATE_UNLOCK(inp);
7326 			create_lock_applied = 0;
7327 		} else {
7328 			printf("Huh-1, create lock should have been applied!\n");
7329 		}
7330 		queue_only = 1;
7331 		asoc = &stcb->asoc;
7332 		asoc->state = SCTP_STATE_COOKIE_WAIT;
7333 		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7334 		if (control) {
7335 			/* see if a init structure exists in cmsg headers */
7336 			struct sctp_initmsg initm;
7337 			int i;
7338 			if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
7339 					   sizeof(initm))) {
7340 				/* we have an INIT override of the default */
7341 				if (initm.sinit_max_attempts)
7342 					asoc->max_init_times = initm.sinit_max_attempts;
7343 				if (initm.sinit_num_ostreams)
7344 					asoc->pre_open_streams = initm.sinit_num_ostreams;
7345 				if (initm.sinit_max_instreams)
7346 					asoc->max_inbound_streams = initm.sinit_max_instreams;
7347 				if (initm.sinit_max_init_timeo)
7348 					asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7349 			}
7350 			if (asoc->streamoutcnt < asoc->pre_open_streams) {
7351 				/* Default is NOT correct */
7352 #ifdef SCTP_DEBUG
7353 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7354 					printf("Ok, defout:%d pre_open:%d\n",
7355 					       asoc->streamoutcnt, asoc->pre_open_streams);
7356 				}
7357 #endif
7358 				free(asoc->strmout, M_PCB);
7359 				asoc->strmout = NULL;
7360 				asoc->streamoutcnt = asoc->pre_open_streams;
7361 				asoc->strmout = malloc(asoc->streamoutcnt *
7362 				       sizeof(struct sctp_stream_out), M_PCB,
7363 				       M_WAIT);
7364 				for (i = 0; i < asoc->streamoutcnt; i++) {
7365 					/*
7366 					 * inbound side must be set to 0xffff,
7367 					 * also NOTE when we get the INIT-ACK
7368 					 * back (for INIT sender) we MUST
7369 					 * reduce the count (streamoutcnt) but
7370 					 * first check if we sent to any of the
7371 					 * upper streams that were dropped (if
7372 					 * some were). Those that were dropped
7373 					 * must be notified to the upper layer
7374 					 * as failed to send.
7375 					 */
7376 					asoc->strmout[i].next_sequence_sent = 0x0;
7377 					TAILQ_INIT(&asoc->strmout[i].outqueue);
7378 					asoc->strmout[i].stream_no = i;
7379 					asoc->strmout[i].next_spoke.tqe_next = 0;
7380 					asoc->strmout[i].next_spoke.tqe_prev = 0;
7381 				}
7382 			}
7383 		}
7384 		sctp_send_initiate(inp, stcb);
7385 		/*
7386 		 * we may want to dig in after this call and adjust the MTU
7387 		 * value. It defaulted to 1500 (constant) but the ro structure
7388 		 * may now have an update and thus we may need to change it
7389 		 * BEFORE we append the message.
7390 		 */
7391 		net = stcb->asoc.primary_destination;
7392 	} else {
7393 		if (create_lock_applied) {
7394 			SCTP_ASOC_CREATE_UNLOCK(inp);
7395 			create_lock_applied = 0;
7396 		}
7397 		asoc = &stcb->asoc;
7398 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7399 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7400 			queue_only = 1;
7401 		}
7402 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7403 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7404 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7405 		    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7406 			if (control) {
7407 				sctppcbinfo.mbuf_track--;
7408 				sctp_m_freem(control);
7409 				control = NULL;
7410 			}
7411 			if ((use_rcvinfo) &&
7412 			    (srcv.sinfo_flags & MSG_ABORT)) {
7413 				sctp_msg_append(stcb, net, m, &srcv, flags);
7414 				error = 0;
7415 			} else {
7416 				if (m)
7417 					sctp_m_freem(m);
7418 				error = ECONNRESET;
7419 			}
7420 			SCTP_TCB_UNLOCK(stcb);
7421 			return (error);
7422 		}
7423 	}
7424 	if (create_lock_applied) {
7425 		/* we should never hit here with the create lock applied
7426 		 *
7427 		 */
7428 		SCTP_ASOC_CREATE_UNLOCK(inp);
7429 		create_lock_applied = 0;
7430 	}
7431 
7432 
7433 	if (use_rcvinfo == 0) {
7434 		srcv = stcb->asoc.def_send;
7435 	}
7436 #ifdef SCTP_DEBUG
7437 	else {
7438 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7439 			printf("stream:%d\n", srcv.sinfo_stream);
7440 			printf("flags:%x\n", (u_int)srcv.sinfo_flags);
7441 			printf("ppid:%d\n", srcv.sinfo_ppid);
7442 			printf("context:%d\n", srcv.sinfo_context);
7443 		}
7444 	}
7445 #endif
7446 	if (control) {
7447 		sctppcbinfo.mbuf_track--;
7448 		sctp_m_freem(control);
7449 		control = NULL;
7450 	}
7451 	if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7452 		/* we take the override or the unconfirmed */
7453 		;
7454 	} else {
7455 		net = stcb->asoc.primary_destination;
7456 	}
7457 	if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7458 		SCTP_TCB_UNLOCK(stcb);
7459 		return (error);
7460 	}
7461 	if (net->flight_size > net->cwnd) {
7462 		sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7463 		queue_only = 1;
7464  	} else if (asoc->ifp_had_enobuf) {
7465 		sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7466 	 	queue_only = 1;
7467  	} else {
7468 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7469 			   ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7470 			   SCTP_MED_OVERHEAD);
7471 
7472 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7473 		    (stcb->asoc.total_flight > 0) &&
7474 		    (un_sent < (int)stcb->asoc.smallest_mtu)
7475 			) {
7476 
7477 			/* Ok, Nagle is set on and we have
7478 			 * data outstanding. Don't send anything
7479 			 * and let the SACK drive out the data.
7480 			 */
7481 			sctp_pegs[SCTP_NAGLE_NOQ]++;
7482 			queue_only = 1;
7483 		} else {
7484 			sctp_pegs[SCTP_NAGLE_OFF]++;
7485 		}
7486 	}
7487 	if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7488 		/* we can attempt to send too.*/
7489 #ifdef SCTP_DEBUG
7490 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7491 			printf("USR Send calls sctp_chunk_output\n");
7492 		}
7493 #endif
7494 #ifdef SCTP_AUDITING_ENABLED
7495 		sctp_audit_log(0xC0, 1);
7496 		sctp_auditing(6, inp, stcb, net);
7497 #endif
7498 		sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7499 		sctp_chunk_output(inp, stcb, 0);
7500 #ifdef SCTP_AUDITING_ENABLED
7501 		sctp_audit_log(0xC0, 2);
7502 		sctp_auditing(7, inp, stcb, net);
7503 #endif
7504 
7505 	}
7506 #ifdef SCTP_DEBUG
7507 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7508 		printf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7509 	}
7510 #endif
7511 	SCTP_TCB_UNLOCK(stcb);
7512 	return (0);
7513 }
7514 
7515 void
7516 send_forward_tsn(struct sctp_tcb *stcb,
7517 		 struct sctp_association *asoc)
7518 {
7519 	struct sctp_tmit_chunk *chk;
7520 	struct sctp_forward_tsn_chunk *fwdtsn;
7521 
7522 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7523 		if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7524 			/* mark it to unsent */
7525 			chk->sent = SCTP_DATAGRAM_UNSENT;
7526 			chk->snd_count = 0;
7527 			/* Do we correct its output location? */
7528 			if (chk->whoTo != asoc->primary_destination) {
7529 				sctp_free_remote_addr(chk->whoTo);
7530 				chk->whoTo = asoc->primary_destination;
7531 				chk->whoTo->ref_count++;
7532 			}
7533 			goto sctp_fill_in_rest;
7534 		}
7535 	}
7536 	/* Ok if we reach here we must build one */
7537 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7538 	if (chk == NULL) {
7539 		return;
7540 	}
7541 	sctppcbinfo.ipi_count_chunk++;
7542 	sctppcbinfo.ipi_gencnt_chunk++;
7543 	chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7544 	chk->asoc = asoc;
7545 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
7546 	if (chk->data == NULL) {
7547 		chk->whoTo->ref_count--;
7548 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7549 		sctppcbinfo.ipi_count_chunk--;
7550 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7551 			panic("Chunk count is negative");
7552 		}
7553 		sctppcbinfo.ipi_gencnt_chunk++;
7554 		return;
7555 	}
7556 	chk->data->m_data += SCTP_MIN_OVERHEAD;
7557 	chk->sent = SCTP_DATAGRAM_UNSENT;
7558 	chk->snd_count = 0;
7559 	chk->whoTo = asoc->primary_destination;
7560 	chk->whoTo->ref_count++;
7561 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7562 	asoc->ctrl_queue_cnt++;
7563  sctp_fill_in_rest:
7564 	/* Here we go through and fill out the part that
7565 	 * deals with stream/seq of the ones we skip.
7566 	 */
7567 	chk->data->m_pkthdr.len = chk->data->m_len = 0;
7568 	{
7569 		struct sctp_tmit_chunk *at, *tp1, *last;
7570 		struct sctp_strseq *strseq;
7571 		unsigned int cnt_of_space, i, ovh;
7572 		unsigned int space_needed;
7573 		unsigned int cnt_of_skipped = 0;
7574 		TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7575 			if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7576 				/* no more to look at */
7577 				break;
7578 			}
7579 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7580 				/* We don't report these */
7581 				continue;
7582 			}
7583 			cnt_of_skipped++;
7584 		}
7585 		space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7586 				(cnt_of_skipped * sizeof(struct sctp_strseq)));
7587 		if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7588 		    ((chk->data->m_flags & M_EXT) == 0)) {
7589 			/* Need a M_EXT, get one and move
7590 			 * fwdtsn to data area.
7591 			 */
7592 			MCLGET(chk->data, M_DONTWAIT);
7593 		}
7594 		cnt_of_space = M_TRAILINGSPACE(chk->data);
7595 
7596 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7597 			ovh = SCTP_MIN_OVERHEAD;
7598 		} else {
7599 			ovh = SCTP_MIN_V4_OVERHEAD;
7600 		}
7601 		if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7602 			/* trim to a mtu size */
7603 			cnt_of_space = asoc->smallest_mtu - ovh;
7604 		}
7605 		if (cnt_of_space < space_needed) {
7606 			/* ok we must trim down the chunk by lowering
7607 			 * the advance peer ack point.
7608 			 */
7609 			cnt_of_skipped = (cnt_of_space-
7610 					  ((sizeof(struct sctp_forward_tsn_chunk))/
7611  					    sizeof(struct sctp_strseq)));
7612 			/* Go through and find the TSN that
7613 			 * will be the one we report.
7614 			 */
7615 			at = TAILQ_FIRST(&asoc->sent_queue);
7616 			for (i = 0; i < cnt_of_skipped; i++) {
7617 				tp1 = TAILQ_NEXT(at, sctp_next);
7618 				at = tp1;
7619 			}
7620 			last = at;
7621 			/* last now points to last one I can report, update peer ack point */
7622 			asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7623 			space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7624 		}
7625 		chk->send_size = space_needed;
7626 		/* Setup the chunk */
7627 		fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7628 		fwdtsn->ch.chunk_length = htons(chk->send_size);
7629 		fwdtsn->ch.chunk_flags = 0;
7630 		fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7631 		fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7632 		chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7633 				  (cnt_of_skipped * sizeof(struct sctp_strseq)));
7634 		chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7635 		fwdtsn++;
7636 		/* Move pointer to after the fwdtsn and transfer to
7637 		 * the strseq pointer.
7638 		 */
7639 		strseq = (struct sctp_strseq *)fwdtsn;
7640 		/*
7641 		 * Now populate the strseq list. This is done blindly
7642 		 * without pulling out duplicate stream info. This is
7643 		 * inefficent but won't harm the process since the peer
7644 		 * will look at these in sequence and will thus release
7645 		 * anything. It could mean we exceed the PMTU and chop
7646 		 * off some that we could have included.. but this is
7647 		 * unlikely (aka 1432/4 would mean 300+ stream seq's would
7648 		 * have to be reported in one FWD-TSN. With a bit of work
7649 		 * we can later FIX this to optimize and pull out duplcates..
7650 		 * but it does add more overhead. So for now... not!
7651 		 */
7652 		at = TAILQ_FIRST(&asoc->sent_queue);
7653 		for (i = 0; i < cnt_of_skipped; i++) {
7654 			tp1 = TAILQ_NEXT(at, sctp_next);
7655 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7656 				/* We don't report these */
7657 				i--;
7658 				at = tp1;
7659 				continue;
7660 			}
7661 			strseq->stream = ntohs(at->rec.data.stream_number);
7662 			strseq->sequence = ntohs(at->rec.data.stream_seq);
7663 			strseq++;
7664 			at = tp1;
7665 		}
7666 	}
7667 	return;
7668 
7669 }
7670 
7671 void
7672 sctp_send_sack(struct sctp_tcb *stcb)
7673 {
7674 	/*
7675 	 * Queue up a SACK in the control queue. We must first check to
7676 	 * see if a SACK is somehow on the control queue. If so, we will
7677 	 * take and and remove the old one.
7678 	 */
7679 	struct sctp_association *asoc;
7680 	struct sctp_tmit_chunk *chk, *a_chk;
7681 	struct sctp_sack_chunk *sack;
7682 	struct sctp_gap_ack_block *gap_descriptor;
7683 	uint32_t *dup;
7684 	int start;
7685 	unsigned int i, maxi, seeing_ones, m_size;
7686 	unsigned int num_gap_blocks, space;
7687 
7688 	start = maxi = 0;
7689 	seeing_ones = 1;
7690 	a_chk = NULL;
7691 	asoc = &stcb->asoc;
7692 	if (asoc->last_data_chunk_from == NULL) {
7693 		/* Hmm we never received anything */
7694 		return;
7695 	}
7696 	sctp_set_rwnd(stcb, asoc);
7697 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7698 		if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7699 			/* Hmm, found a sack already on queue, remove it */
7700 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7701 			asoc->ctrl_queue_cnt++;
7702 			a_chk = chk;
7703 			if (a_chk->data)
7704 				sctp_m_freem(a_chk->data);
7705 			a_chk->data = NULL;
7706 			sctp_free_remote_addr(a_chk->whoTo);
7707 			a_chk->whoTo = NULL;
7708 			break;
7709 		}
7710 	}
7711 	if (a_chk == NULL) {
7712 		a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7713 		if (a_chk == NULL) {
7714 			/* No memory so we drop the idea, and set a timer */
7715 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7716 					stcb->sctp_ep, stcb, NULL);
7717 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7718 					 stcb->sctp_ep, stcb, NULL);
7719 			return;
7720 		}
7721 		sctppcbinfo.ipi_count_chunk++;
7722 		sctppcbinfo.ipi_gencnt_chunk++;
7723 		a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7724 	}
7725 	a_chk->asoc = asoc;
7726 	a_chk->snd_count = 0;
7727 	a_chk->send_size = 0;	/* fill in later */
7728 	a_chk->sent = SCTP_DATAGRAM_UNSENT;
7729 	m_size = (asoc->mapping_array_size << 3);
7730 
7731 	if ((asoc->numduptsns) ||
7732 	    (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7733 		) {
7734 		/* Ok, we have some duplicates or the destination for the
7735 		 * sack is unreachable, lets see if we can select an alternate
7736 		 * than asoc->last_data_chunk_from
7737 		 */
7738 		if ((!(asoc->last_data_chunk_from->dest_state &
7739 		      SCTP_ADDR_NOT_REACHABLE)) &&
7740 		    (asoc->used_alt_onsack > 2)) {
7741 			/* We used an alt last time, don't this time */
7742 			a_chk->whoTo = NULL;
7743 		} else {
7744 			asoc->used_alt_onsack++;
7745 			a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7746 		}
7747 		if (a_chk->whoTo == NULL) {
7748 			/* Nope, no alternate */
7749 			a_chk->whoTo = asoc->last_data_chunk_from;
7750 			asoc->used_alt_onsack = 0;
7751 		}
7752 	} else {
7753 		/* No duplicates so we use the last
7754 		 * place we received data from.
7755 		 */
7756 #ifdef SCTP_DEBUG
7757 		if (asoc->last_data_chunk_from == NULL) {
7758 			printf("Huh, last_data_chunk_from is null when we want to sack??\n");
7759 		}
7760 #endif
7761 		asoc->used_alt_onsack = 0;
7762 		a_chk->whoTo = asoc->last_data_chunk_from;
7763 	}
7764 	if (a_chk->whoTo)
7765 		a_chk->whoTo->ref_count++;
7766 
7767 	/* Ok now lets formulate a MBUF with our sack */
7768 	MGETHDR(a_chk->data, M_DONTWAIT, MT_DATA);
7769 	if ((a_chk->data == NULL) ||
7770 	    (a_chk->whoTo == NULL)) {
7771 		/* rats, no mbuf memory */
7772 		if (a_chk->data) {
7773 			/* was a problem with the destination */
7774 			sctp_m_freem(a_chk->data);
7775 			a_chk->data = NULL;
7776 		}
7777 		a_chk->whoTo->ref_count--;
7778 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7779 		sctppcbinfo.ipi_count_chunk--;
7780 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7781 			panic("Chunk count is negative");
7782 		}
7783 		sctppcbinfo.ipi_gencnt_chunk++;
7784 		sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7785 				stcb->sctp_ep, stcb, NULL);
7786 		sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7787 				 stcb->sctp_ep, stcb, NULL);
7788 		return;
7789 	}
7790 	/* First count the number of gap ack blocks we need */
7791 	if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7792 		/* We know if there are none above the cum-ack we
7793 		 * have everything with NO gaps
7794 		 */
7795 		num_gap_blocks = 0;
7796 	} else {
7797 		/* Ok we must count how many gaps we
7798 		 * have.
7799 		 */
7800 		num_gap_blocks = 0;
7801 		if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7802 			maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7803 		} else {
7804 			maxi = (asoc->highest_tsn_inside_map  + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7805 		}
7806 		if (maxi > m_size) {
7807 			/* impossible but who knows, someone is playing with us  :> */
7808 #ifdef SCTP_DEBUG
7809 			printf("GAK maxi:%d  > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7810 			       maxi,
7811 			       m_size,
7812 			       asoc->highest_tsn_inside_map,
7813 			       asoc->mapping_array_base_tsn,
7814 			       asoc->cumulative_tsn
7815 			       );
7816 #endif
7817 			num_gap_blocks = 0;
7818 			goto no_gaps_now;
7819 		}
7820 		if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7821 			start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7822 		} else {
7823 			/* Set it so we start at 0 */
7824 			start = -1;
7825 		}
7826 		/* Ok move start up one to look at the NEXT past the cum-ack */
7827 		start++;
7828 		for (i = start; i <= maxi; i++) {
7829 			if (seeing_ones) {
7830 				/* while seeing ones I must
7831 				 * transition back to 0 before
7832 				 * finding the next gap and
7833 				 * counting the segment.
7834 				 */
7835 				if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7836 					seeing_ones = 0;
7837 				}
7838 			} else {
7839 				if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7840 					seeing_ones = 1;
7841 					num_gap_blocks++;
7842 				}
7843 			}
7844 		}
7845 	no_gaps_now:
7846 		if (num_gap_blocks == 0) {
7847 			/*
7848 			 * Traveled all of the bits and NO one,
7849 			 * must have reneged
7850 			 */
7851 			if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
7852 			   asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
7853 #ifdef SCTP_MAP_LOGGING
7854 			   sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
7855 #endif
7856 			}
7857 		}
7858 	}
7859 
7860 	/* Now calculate the space needed */
7861 	space = (sizeof(struct sctp_sack_chunk) +
7862 		 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7863 		 (asoc->numduptsns * sizeof(int32_t))
7864 		);
7865 	if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
7866 		/* Reduce the size of the sack to fit */
7867 		int calc, fit;
7868 		calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
7869 		calc -= sizeof(struct sctp_gap_ack_block);
7870 		fit = calc/sizeof(struct sctp_gap_ack_block);
7871 		if (fit > (int)num_gap_blocks) {
7872 			/* discard some dups */
7873 			asoc->numduptsns = (fit - num_gap_blocks);
7874 		} else {
7875 			/* discard all dups and some gaps */
7876 			num_gap_blocks = fit;
7877 			asoc->numduptsns = 0;
7878 		}
7879 		/* recalc space */
7880 		space = (sizeof(struct sctp_sack_chunk) +
7881 			 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7882 			 (asoc->numduptsns * sizeof(int32_t))
7883 			);
7884 
7885 	}
7886 
7887 	if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
7888 		/* We need a cluster */
7889 		MCLGET(a_chk->data, M_DONTWAIT);
7890 		if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
7891 			/* can't get a cluster
7892 			 * give up and try later.
7893 			 */
7894 			if (a_chk->data)
7895 				sctp_m_freem(a_chk->data);
7896 			a_chk->data = NULL;
7897 			a_chk->whoTo->ref_count--;
7898 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7899 			sctppcbinfo.ipi_count_chunk--;
7900 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7901 				panic("Chunk count is negative");
7902 			}
7903 			sctppcbinfo.ipi_gencnt_chunk++;
7904 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7905 					stcb->sctp_ep, stcb, NULL);
7906 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7907 					 stcb->sctp_ep, stcb, NULL);
7908 			return;
7909 		}
7910 	}
7911 
7912 	/* ok, lets go through and fill it in */
7913 	a_chk->data->m_data += SCTP_MIN_OVERHEAD;
7914 	sack = mtod(a_chk->data, struct sctp_sack_chunk *);
7915 	sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
7916 	sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
7917 	sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
7918 	sack->sack.a_rwnd = htonl(asoc->my_rwnd);
7919 	asoc->my_last_reported_rwnd = asoc->my_rwnd;
7920 	sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
7921 	sack->sack.num_dup_tsns = htons(asoc->numduptsns);
7922 
7923 	a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
7924 			    (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
7925 			    (asoc->numduptsns * sizeof(int32_t)));
7926 	a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
7927 	sack->ch.chunk_length = htons(a_chk->send_size);
7928 
7929 	gap_descriptor = (struct sctp_gap_ack_block *)((vaddr_t)sack + sizeof(struct sctp_sack_chunk));
7930 	seeing_ones = 0;
7931 	for (i = start; i <= maxi; i++) {
7932 		if (num_gap_blocks == 0) {
7933 			break;
7934 		}
7935 		if (seeing_ones) {
7936 			/* while seeing Ones I must
7937 			 * transition back to 0 before
7938 			 * finding the next gap
7939 			 */
7940 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7941 				gap_descriptor->end = htons(((uint16_t)(i-start)));
7942 				gap_descriptor++;
7943 				seeing_ones = 0;
7944 				num_gap_blocks--;
7945 			}
7946 		} else {
7947 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7948 				gap_descriptor->start = htons(((uint16_t)(i+1-start)));
7949 				/* advance struct to next pointer */
7950 				seeing_ones = 1;
7951 			}
7952 		}
7953 	}
7954 	if (num_gap_blocks) {
7955 		/* special case where the array is all 1's
7956 		 * to the end of the array.
7957 		 */
7958 		gap_descriptor->end = htons(((uint16_t)((i-start))));
7959 		gap_descriptor++;
7960 	}
7961 	/* now we must add any dups we are going to report. */
7962 	if (asoc->numduptsns) {
7963 		dup = (uint32_t *)gap_descriptor;
7964 		for (i = 0; i < asoc->numduptsns; i++) {
7965 			*dup = htonl(asoc->dup_tsns[i]);
7966 			dup++;
7967 		}
7968 		asoc->numduptsns = 0;
7969 	}
7970 	/* now that the chunk is prepared queue it to the control
7971 	 * chunk queue.
7972 	 */
7973 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
7974 	asoc->ctrl_queue_cnt++;
7975 	sctp_pegs[SCTP_PEG_SACKS_SENT]++;
7976 	return;
7977 }
7978 
7979 void
7980 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
7981 {
7982 	struct mbuf *m_abort;
7983 	struct sctp_abort_msg *abort_m;
7984 	int sz;
7985 	abort_m = NULL;
7986 	MGETHDR(m_abort, M_DONTWAIT, MT_HEADER);
7987 	if (m_abort == NULL) {
7988 		/* no mbuf's */
7989 		return;
7990 	}
7991 	m_abort->m_data += SCTP_MIN_OVERHEAD;
7992 	abort_m = mtod(m_abort, struct sctp_abort_msg *);
7993 	m_abort->m_len = sizeof(struct sctp_abort_msg);
7994 	m_abort->m_next = operr;
7995 	sz = 0;
7996 	if (operr) {
7997 		struct mbuf *n;
7998 		n = operr;
7999 		while (n) {
8000 			sz += n->m_len;
8001 			n = n->m_next;
8002 		}
8003 	}
8004 	abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8005 	abort_m->msg.ch.chunk_flags = 0;
8006 	abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8007 					     sz);
8008 	abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8009 	abort_m->sh.dest_port = stcb->rport;
8010 	abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8011 	abort_m->sh.checksum = 0;
8012 	m_abort->m_pkthdr.len = m_abort->m_len + sz;
8013 	m_reset_rcvif(m_abort);
8014 	sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8015 	    stcb->asoc.primary_destination,
8016 	    rtcache_getdst(&stcb->asoc.primary_destination->ro),
8017 	    m_abort, 1, 0, NULL, 0);
8018 }
8019 
8020 int
8021 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8022 			    struct sctp_nets *net)
8023 
8024 {
8025 	/* formulate and SEND a SHUTDOWN-COMPLETE */
8026 	struct mbuf *m_shutdown_comp;
8027 	struct sctp_shutdown_complete_msg *comp_cp;
8028 
8029 	m_shutdown_comp = NULL;
8030 	MGETHDR(m_shutdown_comp, M_DONTWAIT, MT_HEADER);
8031 	if (m_shutdown_comp == NULL) {
8032 		/* no mbuf's */
8033 		return (-1);
8034 	}
8035 	m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8036 	comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8037 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8038 	comp_cp->shut_cmp.ch.chunk_flags = 0;
8039 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8040 	comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8041 	comp_cp->sh.dest_port = stcb->rport;
8042 	comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8043 	comp_cp->sh.checksum = 0;
8044 
8045 	m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8046 	m_reset_rcvif(m_shutdown_comp);
8047 	sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8048 	    rtcache_getdst(&net->ro), m_shutdown_comp,
8049 	    1, 0, NULL, 0);
8050 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8051 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8052 		stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8053 		stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
8054 		soisdisconnected(stcb->sctp_ep->sctp_socket);
8055 	}
8056 	return (0);
8057 }
8058 
8059 int
8060 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8061 {
8062 	/* formulate and SEND a SHUTDOWN-COMPLETE */
8063 	struct mbuf *mout;
8064 	struct ip *iph, *iph_out;
8065 	struct ip6_hdr *ip6, *ip6_out;
8066 	int offset_out;
8067 	struct sctp_shutdown_complete_msg *comp_cp;
8068 
8069 	MGETHDR(mout, M_DONTWAIT, MT_HEADER);
8070 	if (mout == NULL) {
8071 		/* no mbuf's */
8072 		return (-1);
8073 	}
8074 	iph = mtod(m, struct ip *);
8075 	iph_out = NULL;
8076 	ip6_out = NULL;
8077 	offset_out = 0;
8078 	if (iph->ip_v == IPVERSION) {
8079 		mout->m_len = sizeof(struct ip) +
8080 		    sizeof(struct sctp_shutdown_complete_msg);
8081 		mout->m_next = NULL;
8082 		iph_out = mtod(mout, struct ip *);
8083 
8084 		/* Fill in the IP header for the ABORT */
8085 		iph_out->ip_v = IPVERSION;
8086 		iph_out->ip_hl = (sizeof(struct ip)/4);
8087 		iph_out->ip_tos = (u_char)0;
8088 		iph_out->ip_id = 0;
8089 		iph_out->ip_off = 0;
8090 		iph_out->ip_ttl = MAXTTL;
8091 		iph_out->ip_p = IPPROTO_SCTP;
8092 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8093 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8094 
8095 		/* let IP layer calculate this */
8096 		iph_out->ip_sum = 0;
8097 		offset_out += sizeof(*iph_out);
8098 		comp_cp = (struct sctp_shutdown_complete_msg *)(
8099 		    (vaddr_t)iph_out + offset_out);
8100 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8101 		ip6 = (struct ip6_hdr *)iph;
8102 		mout->m_len = sizeof(struct ip6_hdr) +
8103 		    sizeof(struct sctp_shutdown_complete_msg);
8104 		mout->m_next = NULL;
8105 		ip6_out = mtod(mout, struct ip6_hdr *);
8106 
8107 		/* Fill in the IPv6 header for the ABORT */
8108 		ip6_out->ip6_flow = ip6->ip6_flow;
8109 		ip6_out->ip6_hlim = ip6_defhlim;
8110 		ip6_out->ip6_nxt = IPPROTO_SCTP;
8111 		ip6_out->ip6_src = ip6->ip6_dst;
8112 		ip6_out->ip6_dst = ip6->ip6_src;
8113  		ip6_out->ip6_plen = mout->m_len;
8114 		offset_out += sizeof(*ip6_out);
8115 		comp_cp = (struct sctp_shutdown_complete_msg *)(
8116 		    (vaddr_t)ip6_out + offset_out);
8117 	} else {
8118 		/* Currently not supported. */
8119 		return (-1);
8120 	}
8121 
8122 	/* Now copy in and fill in the ABORT tags etc. */
8123 	comp_cp->sh.src_port = sh->dest_port;
8124 	comp_cp->sh.dest_port = sh->src_port;
8125 	comp_cp->sh.checksum = 0;
8126 	comp_cp->sh.v_tag = sh->v_tag;
8127 	comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8128 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8129 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8130 
8131 	mout->m_pkthdr.len = mout->m_len;
8132 	/* add checksum */
8133 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
8134 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
8135 		comp_cp->sh.checksum =  0;
8136 	} else {
8137 		comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8138 	}
8139 
8140 	/* zap the rcvif, it should be null */
8141 	m_reset_rcvif(mout);
8142 	/* zap the stack pointer to the route */
8143 	if (iph_out != NULL) {
8144 		struct route ro;
8145 
8146 		memset(&ro, 0, sizeof ro);
8147 #ifdef SCTP_DEBUG
8148 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8149 			printf("sctp_shutdown_complete2 calling ip_output:\n");
8150 			sctp_print_address_pkt(iph_out, &comp_cp->sh);
8151 		}
8152 #endif
8153 		/* set IPv4 length */
8154 		iph_out->ip_len = htons(mout->m_pkthdr.len);
8155 		/* out it goes */
8156 		ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
8157 	} else if (ip6_out != NULL) {
8158 		struct route ro;
8159 
8160 		memset(&ro, 0, sizeof(ro));
8161 #ifdef SCTP_DEBUG
8162 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8163 			printf("sctp_shutdown_complete2 calling ip6_output:\n");
8164 			sctp_print_address_pkt((struct ip *)ip6_out,
8165 			    &comp_cp->sh);
8166 		}
8167 #endif
8168 		ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
8169 	}
8170 	sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8171 	return (0);
8172 }
8173 
8174 static struct sctp_nets *
8175 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8176 {
8177 	struct sctp_nets *net, *hnet;
8178 	int ms_goneby, highest_ms, state_overide=0;
8179 
8180 	SCTP_GETTIME_TIMEVAL(now);
8181 	highest_ms = 0;
8182 	hnet = NULL;
8183 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8184 		if (
8185 			((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8186 			(net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8187 			) {
8188 			/* Skip this guy from consideration if HB is off AND its confirmed*/
8189 #ifdef SCTP_DEBUG
8190 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8191 				printf("Skipping net:%p state:%d nohb/out-of-scope\n",
8192 				       net, net->dest_state);
8193 			}
8194 #endif
8195 			continue;
8196 		}
8197 		if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro.ro_sa) == 0) {
8198 			/* skip this dest net from consideration */
8199 #ifdef SCTP_DEBUG
8200 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8201 				printf("Skipping net:%p reachable NOT\n",
8202 				       net);
8203 			}
8204 #endif
8205 			continue;
8206 		}
8207 		if (net->last_sent_time.tv_sec) {
8208 			/* Sent to so we subtract */
8209 			ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8210 		} else
8211 			/* Never been sent to */
8212 			ms_goneby = 0x7fffffff;
8213 #ifdef SCTP_DEBUG
8214 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8215 			printf("net:%p ms_goneby:%d\n",
8216 			       net, ms_goneby);
8217 		}
8218 #endif
8219 		/* When the address state is unconfirmed but still considered reachable, we
8220 		 * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8221 		 * state, thenw we cut it back to HB at a more normal pace.
8222 		 */
8223 		if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8224 			state_overide = 1;
8225 		} else {
8226 			state_overide = 0;
8227 		}
8228 
8229 		if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8230 		    (ms_goneby > highest_ms)) {
8231 			highest_ms = ms_goneby;
8232 			hnet = net;
8233 #ifdef SCTP_DEBUG
8234 			if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8235 				printf("net:%p is the new high\n",
8236 				       net);
8237 			}
8238 #endif
8239 		}
8240 	}
8241 	if (hnet &&
8242 	   ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8243 		state_overide = 1;
8244 	} else {
8245 		state_overide = 0;
8246 	}
8247 
8248 	if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8249 		/* Found the one with longest delay bounds
8250 		 * OR it is unconfirmed and still not marked
8251 		 * unreachable.
8252 		 */
8253 #ifdef SCTP_DEBUG
8254 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8255 			printf("net:%p is the hb winner -",
8256 				hnet);
8257 			if (hnet)
8258 				sctp_print_address((struct sockaddr *)&hnet->ro.ro_sa);
8259 			else
8260 				printf(" none\n");
8261 		}
8262 #endif
8263 		/* update the timer now */
8264 		hnet->last_sent_time = *now;
8265 		return (hnet);
8266 	}
8267 	/* Nothing to HB */
8268 	return (NULL);
8269 }
8270 
8271 int
8272 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8273 {
8274 	struct sctp_tmit_chunk *chk;
8275 	struct sctp_nets *net;
8276 	struct sctp_heartbeat_chunk *hb;
8277 	struct timeval now;
8278 	struct sockaddr_in *sin;
8279 	struct sockaddr_in6 *sin6;
8280 
8281 	if (user_req == 0) {
8282 		net = sctp_select_hb_destination(stcb, &now);
8283 		if (net == NULL) {
8284 			/* All our busy none to send to, just
8285 			 * start the timer again.
8286 			 */
8287 			if (stcb->asoc.state == 0) {
8288 				return (0);
8289 			}
8290 			sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8291 					 stcb->sctp_ep,
8292 					 stcb,
8293 					 net);
8294 			return (0);
8295 		}
8296 #ifndef SCTP_USE_ALLMAN_BURST
8297 		else {
8298 			/* found one idle.. decay cwnd on this one
8299 			 * by 1/2 if none outstanding.
8300 			 */
8301 
8302 			if (net->flight_size == 0) {
8303 				net->cwnd /= 2;
8304 				if (net->addr_is_local) {
8305 					if (net->cwnd < (net->mtu *4)) {
8306 						net->cwnd = net->mtu * 4;
8307 					}
8308 				} else {
8309 					if (net->cwnd < (net->mtu * 2)) {
8310 						net->cwnd = net->mtu * 2;
8311 					}
8312 				}
8313 
8314 			}
8315 
8316 		}
8317 #endif
8318 	} else {
8319 		net = u_net;
8320 		if (net == NULL) {
8321 			return (0);
8322 		}
8323 		SCTP_GETTIME_TIMEVAL(&now);
8324 	}
8325 	sin = (struct sockaddr_in *)&net->ro.ro_sa;
8326 	if (sin->sin_family != AF_INET) {
8327 		if (sin->sin_family != AF_INET6) {
8328 			/* huh */
8329 			return (0);
8330 		}
8331 	}
8332 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8333 	if (chk == NULL) {
8334 #ifdef SCTP_DEBUG
8335 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8336 			printf("Gak, can't get a chunk for hb\n");
8337 		}
8338 #endif
8339 		return (0);
8340 	}
8341 	sctppcbinfo.ipi_gencnt_chunk++;
8342 	sctppcbinfo.ipi_count_chunk++;
8343 	chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8344 	chk->asoc = &stcb->asoc;
8345 	chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8346 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8347 	if (chk->data == NULL) {
8348 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8349 		sctppcbinfo.ipi_count_chunk--;
8350 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8351 			panic("Chunk count is negative");
8352 		}
8353 		sctppcbinfo.ipi_gencnt_chunk++;
8354 		return (0);
8355 	}
8356 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8357 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8358 	chk->sent = SCTP_DATAGRAM_UNSENT;
8359 	chk->snd_count = 0;
8360 	chk->whoTo = net;
8361 	chk->whoTo->ref_count++;
8362 	/* Now we have a mbuf that we can fill in with the details */
8363 	hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8364 
8365 	/* fill out chunk header */
8366 	hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8367 	hb->ch.chunk_flags = 0;
8368 	hb->ch.chunk_length = htons(chk->send_size);
8369 	/* Fill out hb parameter */
8370 	hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8371 	hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8372 	hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8373 	hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8374 	/* Did our user request this one, put it in */
8375 	hb->heartbeat.hb_info.user_req = user_req;
8376 	hb->heartbeat.hb_info.addr_family = sin->sin_family;
8377 	hb->heartbeat.hb_info.addr_len = sin->sin_len;
8378 	if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8379 		/* we only take from the entropy pool if the address is
8380 		 * not confirmed.
8381 		 */
8382  		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8383  		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8384 	} else {
8385 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8386 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8387 	}
8388 	if (sin->sin_family == AF_INET) {
8389 		memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8390 	} else if (sin->sin_family == AF_INET6) {
8391 		/* We leave the scope the way it is in our lookup table. */
8392 		sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
8393 		memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8394 	} else {
8395 		/* huh compiler bug */
8396 #ifdef SCTP_DEBUG
8397 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8398 			printf("Compiler bug bleeds a mbuf and a chunk\n");
8399 		}
8400 #endif
8401 		return (0);
8402 	}
8403 	/* ok we have a destination that needs a beat */
8404 	/* lets do the theshold management Qiaobing style */
8405 	if (user_req == 0) {
8406 		if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8407 					      stcb->asoc.max_send_times)) {
8408 			/* we have lost the association, in a way this
8409 			 * is quite bad since we really are one less time
8410 			 * since we really did not send yet. This is the
8411 			 * down side to the Q's style as defined in the RFC
8412 			 * and not my alternate style defined in the RFC.
8413 			 */
8414 			if (chk->data != NULL) {
8415 				sctp_m_freem(chk->data);
8416 				chk->data = NULL;
8417 			}
8418 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8419 			sctppcbinfo.ipi_count_chunk--;
8420 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8421 				panic("Chunk count is negative");
8422 			}
8423 			sctppcbinfo.ipi_gencnt_chunk++;
8424 			return (-1);
8425 		}
8426 	}
8427 	net->hb_responded = 0;
8428 #ifdef SCTP_DEBUG
8429 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8430 		printf("Inserting chunk for HB\n");
8431 	}
8432 #endif
8433 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8434 	stcb->asoc.ctrl_queue_cnt++;
8435 	sctp_pegs[SCTP_HB_SENT]++;
8436 	/*
8437 	 * Call directly med level routine to put out the chunk. It will
8438 	 * always tumble out control chunks aka HB but it may even tumble
8439 	 * out data too.
8440 	 */
8441 	if (user_req == 0) {
8442 		/* Ok now lets start the HB timer if it is NOT a user req */
8443 		sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8444 				 stcb, net);
8445 	}
8446 	return (1);
8447 }
8448 
8449 void
8450 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8451 		   uint32_t high_tsn)
8452 {
8453 	struct sctp_association *asoc;
8454 	struct sctp_ecne_chunk *ecne;
8455 	struct sctp_tmit_chunk *chk;
8456 	asoc = &stcb->asoc;
8457 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8458 		if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8459 			/* found a previous ECN_ECHO update it if needed */
8460 			ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8461 			ecne->tsn = htonl(high_tsn);
8462 			return;
8463 		}
8464 	}
8465 	/* nope could not find one to update so we must build one */
8466 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8467 	if (chk == NULL) {
8468 		return;
8469 	}
8470 	sctp_pegs[SCTP_ECNE_SENT]++;
8471 	sctppcbinfo.ipi_count_chunk++;
8472 	sctppcbinfo.ipi_gencnt_chunk++;
8473 	chk->rec.chunk_id = SCTP_ECN_ECHO;
8474 	chk->asoc = &stcb->asoc;
8475 	chk->send_size = sizeof(struct sctp_ecne_chunk);
8476 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8477 	if (chk->data == NULL) {
8478 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8479 		sctppcbinfo.ipi_count_chunk--;
8480 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8481 			panic("Chunk count is negative");
8482 		}
8483 		sctppcbinfo.ipi_gencnt_chunk++;
8484 		return;
8485 	}
8486 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8487 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8488 	chk->sent = SCTP_DATAGRAM_UNSENT;
8489 	chk->snd_count = 0;
8490 	chk->whoTo = net;
8491 	chk->whoTo->ref_count++;
8492 	ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8493 	ecne->ch.chunk_type = SCTP_ECN_ECHO;
8494 	ecne->ch.chunk_flags = 0;
8495 	ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8496 	ecne->tsn = htonl(high_tsn);
8497 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8498 	asoc->ctrl_queue_cnt++;
8499 }
8500 
8501 void
8502 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8503 			 struct mbuf *m, int iphlen, int bad_crc)
8504 {
8505 	struct sctp_association *asoc;
8506 	struct sctp_pktdrop_chunk *drp;
8507 	struct sctp_tmit_chunk *chk;
8508 	uint8_t *datap;
8509 	int len;
8510 	unsigned int small_one;
8511 	struct ip *iph;
8512 
8513 	long spc;
8514 	asoc = &stcb->asoc;
8515 	if (asoc->peer_supports_pktdrop == 0) {
8516 		/* peer must declare support before I
8517 		 * send one.
8518 		 */
8519 		return;
8520 	}
8521 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8522 	if (chk == NULL) {
8523 		return;
8524 	}
8525 	sctppcbinfo.ipi_count_chunk++;
8526 	sctppcbinfo.ipi_gencnt_chunk++;
8527 
8528 	iph = mtod(m, struct ip *);
8529 	if (iph == NULL) {
8530 		return;
8531 	}
8532 	if (iph->ip_v == IPVERSION) {
8533 		/* IPv4 */
8534 #if defined(__FreeBSD__)
8535 		len = chk->send_size = iph->ip_len;
8536 #else
8537 		len = chk->send_size = (iph->ip_len - iphlen);
8538 #endif
8539 	} else {
8540 		struct ip6_hdr *ip6h;
8541 		/* IPv6 */
8542 		ip6h = mtod(m, struct ip6_hdr *);
8543 		len = chk->send_size = htons(ip6h->ip6_plen);
8544 	}
8545 	if ((len+iphlen) > m->m_pkthdr.len) {
8546 		/* huh */
8547 		chk->send_size = len = m->m_pkthdr.len - iphlen;
8548 	}
8549 	chk->asoc = &stcb->asoc;
8550 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8551 	if (chk->data == NULL) {
8552 	jump_out:
8553 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8554 		sctppcbinfo.ipi_count_chunk--;
8555 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8556 			panic("Chunk count is negative");
8557 		}
8558 		sctppcbinfo.ipi_gencnt_chunk++;
8559 		return;
8560 	}
8561 	if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8562 		MCLGET(chk->data, M_DONTWAIT);
8563 		if ((chk->data->m_flags & M_EXT) == 0) {
8564 			/* Give up */
8565 			sctp_m_freem(chk->data);
8566 			chk->data = NULL;
8567 			goto jump_out;
8568 		}
8569 	}
8570 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8571 	drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8572 	if (drp == NULL) {
8573 		sctp_m_freem(chk->data);
8574 		chk->data = NULL;
8575 		goto jump_out;
8576 	}
8577 	small_one = asoc->smallest_mtu;
8578 	if (small_one > MCLBYTES) {
8579 		/* Only one cluster worth of data MAX */
8580 		small_one = MCLBYTES;
8581 	}
8582 	chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8583 			  sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8584 	if (chk->book_size > small_one) {
8585 		drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8586 		drp->trunc_len = htons(chk->send_size);
8587 		chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8588 					     sizeof(struct sctp_pktdrop_chunk) +
8589 					     sizeof(struct sctphdr));
8590 		len = chk->send_size;
8591 	} else {
8592 		/* no truncation needed */
8593 		drp->ch.chunk_flags = 0;
8594 		drp->trunc_len = htons(0);
8595 	}
8596 	if (bad_crc) {
8597 		drp->ch.chunk_flags |= SCTP_BADCRC;
8598 	}
8599 	chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8600 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8601 	chk->sent = SCTP_DATAGRAM_UNSENT;
8602 	chk->snd_count = 0;
8603 	if (net) {
8604 		/* we should hit here */
8605 		chk->whoTo = net;
8606 	} else {
8607 		chk->whoTo = asoc->primary_destination;
8608 	}
8609 	chk->whoTo->ref_count++;
8610 	chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8611 	drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8612 	drp->ch.chunk_length = htons(chk->send_size);
8613 	spc = stcb->sctp_socket->so_rcv.sb_hiwat;
8614 	if (spc < 0) {
8615 		spc = 0;
8616 	}
8617 	drp->bottle_bw = htonl(spc);
8618 	drp->current_onq = htonl(asoc->size_on_delivery_queue +
8619 				 asoc->size_on_reasm_queue +
8620 				 asoc->size_on_all_streams +
8621 				 asoc->my_rwnd_control_len +
8622 		                 stcb->sctp_socket->so_rcv.sb_cc);
8623 	drp->reserved = 0;
8624 	datap = drp->data;
8625         m_copydata(m, iphlen, len, datap);
8626 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8627 	asoc->ctrl_queue_cnt++;
8628 }
8629 
8630 void
8631 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8632 {
8633 	struct sctp_association *asoc;
8634 	struct sctp_cwr_chunk *cwr;
8635 	struct sctp_tmit_chunk *chk;
8636 
8637 	asoc = &stcb->asoc;
8638 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8639 		if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8640 			/* found a previous ECN_CWR update it if needed */
8641 			cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8642 			if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8643 					      MAX_TSN)) {
8644 				cwr->tsn = htonl(high_tsn);
8645 			}
8646 			return;
8647 		}
8648 	}
8649 	/* nope could not find one to update so we must build one */
8650 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8651 	if (chk == NULL) {
8652 		return;
8653 	}
8654 	sctppcbinfo.ipi_count_chunk++;
8655 	sctppcbinfo.ipi_gencnt_chunk++;
8656 	chk->rec.chunk_id = SCTP_ECN_CWR;
8657 	chk->asoc = &stcb->asoc;
8658 	chk->send_size = sizeof(struct sctp_cwr_chunk);
8659 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8660 	if (chk->data == NULL) {
8661 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8662 		sctppcbinfo.ipi_count_chunk--;
8663 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8664 			panic("Chunk count is negative");
8665 		}
8666 		sctppcbinfo.ipi_gencnt_chunk++;
8667 		return;
8668 	}
8669 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8670 	chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8671 	chk->sent = SCTP_DATAGRAM_UNSENT;
8672 	chk->snd_count = 0;
8673 	chk->whoTo = net;
8674 	chk->whoTo->ref_count++;
8675 	cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8676 	cwr->ch.chunk_type = SCTP_ECN_CWR;
8677 	cwr->ch.chunk_flags = 0;
8678 	cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8679 	cwr->tsn = htonl(high_tsn);
8680 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8681 	asoc->ctrl_queue_cnt++;
8682 }
8683 static void
8684 sctp_reset_the_streams(struct sctp_tcb *stcb,
8685      struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8686 {
8687 	int i;
8688 
8689 	if (req->reset_flags & SCTP_RESET_ALL) {
8690 		for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8691 			stcb->asoc.strmout[i].next_sequence_sent = 0;
8692 		}
8693 	} else if (number_entries) {
8694 		for (i=0; i<number_entries; i++) {
8695 			if (list[i] >= stcb->asoc.streamoutcnt) {
8696 				/* no such stream */
8697 				continue;
8698 			}
8699 			stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8700 		}
8701 	}
8702 	sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8703 }
8704 
8705 void
8706 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8707      struct sctp_stream_reset_request *req)
8708 {
8709 	struct sctp_association *asoc;
8710 	struct sctp_stream_reset_resp *strack;
8711 	struct sctp_tmit_chunk *chk;
8712 	uint32_t seq;
8713 	int number_entries, i;
8714 	uint8_t two_way=0, not_peer=0;
8715 	uint16_t *list=NULL;
8716 
8717 	asoc = &stcb->asoc;
8718 	if (req->reset_flags & SCTP_RESET_ALL)
8719 		number_entries = 0;
8720 	else
8721 		number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8722 
8723 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8724 	if (chk == NULL) {
8725 		return;
8726 	}
8727 	sctppcbinfo.ipi_count_chunk++;
8728 	sctppcbinfo.ipi_gencnt_chunk++;
8729 	chk->rec.chunk_id = SCTP_STREAM_RESET;
8730 	chk->asoc = &stcb->asoc;
8731 	chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8732 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8733 	if (chk->data == NULL) {
8734 	strresp_jump_out:
8735 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8736 		sctppcbinfo.ipi_count_chunk--;
8737 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8738 			panic("Chunk count is negative");
8739 		}
8740 		sctppcbinfo.ipi_gencnt_chunk++;
8741 		return;
8742 	}
8743 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8744 	chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8745 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8746 		MCLGET(chk->data, M_DONTWAIT);
8747 		if ((chk->data->m_flags & M_EXT) == 0) {
8748 			/* Give up */
8749 			sctp_m_freem(chk->data);
8750 			chk->data = NULL;
8751 			goto strresp_jump_out;
8752 		}
8753 		chk->data->m_data += SCTP_MIN_OVERHEAD;
8754 	}
8755 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8756 		/* can't do it, no room */
8757 		/* Give up */
8758 		sctp_m_freem(chk->data);
8759 		chk->data = NULL;
8760 		goto strresp_jump_out;
8761 
8762 	}
8763 	chk->sent = SCTP_DATAGRAM_UNSENT;
8764 	chk->snd_count = 0;
8765 	chk->whoTo = asoc->primary_destination;
8766 	chk->whoTo->ref_count++;
8767 	strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8768 
8769 	strack->ch.chunk_type = SCTP_STREAM_RESET;
8770 	strack->ch.chunk_flags = 0;
8771 	strack->ch.chunk_length = htons(chk->send_size);
8772 
8773 	memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8774 
8775 	strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8776 	strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8777 
8778 
8779 
8780 	if (chk->send_size % 4) {
8781 		/* need a padding for the end */
8782 		int pad;
8783 		uint8_t *end;
8784 		end = (uint8_t *)((vaddr_t)strack + chk->send_size);
8785 		pad = chk->send_size % 4;
8786 		for (i = 0; i < pad; i++) {
8787 			end[i] = 0;
8788 		}
8789 		chk->send_size += pad;
8790 	}
8791 
8792         /* actual response */
8793 	if (req->reset_flags & SCTP_RESET_YOUR) {
8794 		strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8795 	} else {
8796 		strack->sr_resp.reset_flags = 0;
8797 	}
8798 
8799 	/* copied from reset request */
8800 	strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8801 	seq = ntohl(req->reset_req_seq);
8802 
8803 	list = req->list_of_streams;
8804 	/* copy the un-converted network byte order streams */
8805 	for (i=0; i<number_entries; i++) {
8806 		strack->sr_resp.list_of_streams[i] = list[i];
8807 	}
8808 	if (asoc->str_reset_seq_in == seq) {
8809 		/* is it the next expected? */
8810 		asoc->str_reset_seq_in++;
8811 		strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8812 		asoc->str_reset_sending_seq = asoc->sending_seq;
8813 		if (number_entries) {
8814 			uint16_t temp;
8815 			/* convert them to host byte order */
8816 			for (i=0 ; i<number_entries; i++) {
8817 				temp = ntohs(list[i]);
8818 				list[i] = temp;
8819 			}
8820 		}
8821 		if (req->reset_flags & SCTP_RESET_YOUR) {
8822 			/* reset my outbound streams */
8823 			sctp_reset_the_streams(stcb, req , number_entries, list);
8824 		}
8825 		if (req->reset_flags & SCTP_RECIPRICAL) {
8826 			/* reset peer too */
8827 			sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
8828 		}
8829 
8830 	} else {
8831 		/* no its a retran so I must just ack and do nothing */
8832 		strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
8833 	}
8834 	strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
8835 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8836 			  chk,
8837 			  sctp_next);
8838 	asoc->ctrl_queue_cnt++;
8839 }
8840 
8841 
8842 void
8843 sctp_send_str_reset_req(struct sctp_tcb *stcb,
8844      int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
8845 {
8846 	/* Send a stream reset request. The number_entrys may be 0 and list NULL
8847 	 * if the request is to reset all streams. If two_way is true then we
8848 	 * not only request a RESET of the received streams but we also
8849 	 * request the peer to send a reset req to us too.
8850 	 * Flag combinations in table:
8851 	 *
8852 	 *       two_way | not_peer  | = | Flags
8853 	 *       ------------------------------
8854 	 *         0     |    0      | = | SCTP_RESET_YOUR (just the peer)
8855 	 *         1     |    0      | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
8856 	 *         0     |    1      | = | Not a Valid Request (not anyone)
8857 	 *         1     |    1      | = | SCTP_RESET_RECIPRICAL (Just local host)
8858 	 */
8859 	struct sctp_association *asoc;
8860 	struct sctp_stream_reset_req *strreq;
8861 	struct sctp_tmit_chunk *chk;
8862 
8863 
8864 	asoc = &stcb->asoc;
8865 	if (asoc->stream_reset_outstanding) {
8866 		/* Already one pending, must get ACK back
8867 		 * to clear the flag.
8868 		 */
8869 		return;
8870 	}
8871 
8872 	if ((two_way == 0) && (not_peer == 1)) {
8873 		/* not a valid request */
8874 		return;
8875 	}
8876 
8877 	chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8878 	if (chk == NULL) {
8879 		return;
8880 	}
8881 	sctppcbinfo.ipi_count_chunk++;
8882 	sctppcbinfo.ipi_gencnt_chunk++;
8883 	chk->rec.chunk_id = SCTP_STREAM_RESET;
8884 	chk->asoc = &stcb->asoc;
8885 	chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
8886 	MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
8887 	if (chk->data == NULL) {
8888 	strreq_jump_out:
8889 		SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8890 		sctppcbinfo.ipi_count_chunk--;
8891 		if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8892 			panic("Chunk count is negative");
8893 		}
8894 		sctppcbinfo.ipi_gencnt_chunk++;
8895 		return;
8896 	}
8897 	chk->data->m_data += SCTP_MIN_OVERHEAD;
8898 	chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8899 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8900 		MCLGET(chk->data, M_DONTWAIT);
8901 		if ((chk->data->m_flags & M_EXT) == 0) {
8902 			/* Give up */
8903 			sctp_m_freem(chk->data);
8904 			chk->data = NULL;
8905 			goto strreq_jump_out;
8906 		}
8907 		chk->data->m_data += SCTP_MIN_OVERHEAD;
8908 	}
8909 	if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8910 		/* can't do it, no room */
8911 		/* Give up */
8912 		sctp_m_freem(chk->data);
8913 		chk->data = NULL;
8914 		goto strreq_jump_out;
8915 	}
8916 	chk->sent = SCTP_DATAGRAM_UNSENT;
8917 	chk->snd_count = 0;
8918 	chk->whoTo = asoc->primary_destination;
8919 	chk->whoTo->ref_count++;
8920 
8921 	strreq = mtod(chk->data, struct sctp_stream_reset_req *);
8922 	strreq->ch.chunk_type = SCTP_STREAM_RESET;
8923 	strreq->ch.chunk_flags = 0;
8924 	strreq->ch.chunk_length = htons(chk->send_size);
8925 
8926 	strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
8927 	strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8928 
8929 	if (chk->send_size % 4) {
8930 		/* need a padding for the end */
8931 		int pad, i;
8932 		uint8_t *end;
8933 		end = (uint8_t *)((vaddr_t)strreq + chk->send_size);
8934 		pad = chk->send_size % 4;
8935 		for (i=0; i<pad; i++) {
8936 			end[i] = 0;
8937 		}
8938 		chk->send_size += pad;
8939 	}
8940 
8941 	strreq->sr_req.reset_flags = 0;
8942 	if (number_entrys == 0) {
8943 		strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
8944 	}
8945 	if (two_way == 0) {
8946 		strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
8947 	} else {
8948 		if (not_peer == 0) {
8949 			strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
8950 		} else {
8951 			strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
8952 		}
8953 	}
8954 	memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
8955 	strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
8956 	if (number_entrys) {
8957 		/* populate the specific entry's */
8958 		int i;
8959 		for (i=0; i < number_entrys; i++) {
8960 			strreq->sr_req.list_of_streams[i] = htons(list[i]);
8961 		}
8962 	}
8963 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
8964 			  chk,
8965 			  sctp_next);
8966 	asoc->ctrl_queue_cnt++;
8967 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
8968 	asoc->stream_reset_outstanding = 1;
8969 }
8970 
8971 void
8972 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
8973     struct mbuf *err_cause)
8974 {
8975 	/*
8976 	 * Formulate the abort message, and send it back down.
8977 	 */
8978 	struct mbuf *mout;
8979 	struct sctp_abort_msg *abm;
8980 	struct ip *iph, *iph_out;
8981 	struct ip6_hdr *ip6, *ip6_out;
8982 	int iphlen_out;
8983 
8984 	/* don't respond to ABORT with ABORT */
8985 	if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
8986 		if (err_cause)
8987 			sctp_m_freem(err_cause);
8988 		return;
8989 	}
8990 	MGETHDR(mout, M_DONTWAIT, MT_HEADER);
8991 	if (mout == NULL) {
8992 		if (err_cause)
8993 			sctp_m_freem(err_cause);
8994 		return;
8995 	}
8996 	iph = mtod(m, struct ip *);
8997 	iph_out = NULL;
8998 	ip6_out = NULL;
8999 	if (iph->ip_v == IPVERSION) {
9000 		iph_out = mtod(mout, struct ip *);
9001 		mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9002 		mout->m_next = err_cause;
9003 
9004 		/* Fill in the IP header for the ABORT */
9005 		iph_out->ip_v = IPVERSION;
9006 		iph_out->ip_hl = (sizeof(struct ip) / 4);
9007 		iph_out->ip_tos = (u_char)0;
9008 		iph_out->ip_id = 0;
9009 		iph_out->ip_off = 0;
9010 		iph_out->ip_ttl = MAXTTL;
9011 		iph_out->ip_p = IPPROTO_SCTP;
9012 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9013 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9014 		/* let IP layer calculate this */
9015 		iph_out->ip_sum = 0;
9016 
9017 		iphlen_out = sizeof(*iph_out);
9018 		abm = (struct sctp_abort_msg *)((vaddr_t)iph_out + iphlen_out);
9019 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9020 		ip6 = (struct ip6_hdr *)iph;
9021 		ip6_out = mtod(mout, struct ip6_hdr *);
9022 		mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9023 		mout->m_next = err_cause;
9024 
9025 		/* Fill in the IP6 header for the ABORT */
9026 		ip6_out->ip6_flow = ip6->ip6_flow;
9027 		ip6_out->ip6_hlim = ip6_defhlim;
9028 		ip6_out->ip6_nxt = IPPROTO_SCTP;
9029 		ip6_out->ip6_src = ip6->ip6_dst;
9030 		ip6_out->ip6_dst = ip6->ip6_src;
9031 
9032 		iphlen_out = sizeof(*ip6_out);
9033 		abm = (struct sctp_abort_msg *)((vaddr_t)ip6_out + iphlen_out);
9034 	} else {
9035 		/* Currently not supported */
9036 		return;
9037 	}
9038 
9039 	abm->sh.src_port = sh->dest_port;
9040 	abm->sh.dest_port = sh->src_port;
9041 	abm->sh.checksum = 0;
9042 	if (vtag == 0) {
9043 		abm->sh.v_tag = sh->v_tag;
9044 		abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9045 	} else {
9046 		abm->sh.v_tag = htonl(vtag);
9047 		abm->msg.ch.chunk_flags = 0;
9048 	}
9049 	abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9050 
9051 	if (err_cause) {
9052 		struct mbuf *m_tmp = err_cause;
9053 		int err_len = 0;
9054 		/* get length of the err_cause chain */
9055 		while (m_tmp != NULL) {
9056 			err_len += m_tmp->m_len;
9057 			m_tmp = m_tmp->m_next;
9058 		}
9059 		mout->m_pkthdr.len = mout->m_len + err_len;
9060 		if (err_len % 4) {
9061 			/* need pad at end of chunk */
9062 			u_int32_t cpthis=0;
9063 			int padlen;
9064 			padlen = 4 - (mout->m_pkthdr.len % 4);
9065 			m_copyback(mout, mout->m_pkthdr.len, padlen, (void *)&cpthis);
9066 		}
9067 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9068 	} else {
9069 		mout->m_pkthdr.len = mout->m_len;
9070 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9071 	}
9072 
9073 	/* add checksum */
9074 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
9075 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
9076 		abm->sh.checksum =  0;
9077 	} else {
9078 		abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9079 	}
9080 
9081 	/* zap the rcvif, it should be null */
9082 	m_reset_rcvif(mout);
9083 	if (iph_out != NULL) {
9084 		struct route ro;
9085 
9086 		/* zap the stack pointer to the route */
9087 		memset(&ro, 0, sizeof ro);
9088 #ifdef SCTP_DEBUG
9089 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9090                         printf("sctp_send_abort calling ip_output:\n");
9091 			sctp_print_address_pkt(iph_out, &abm->sh);
9092                 }
9093 #endif
9094 		/* set IPv4 length */
9095 		iph_out->ip_len = htons(mout->m_pkthdr.len);
9096 		/* out it goes */
9097 		(void)ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
9098 	} else if (ip6_out != NULL) {
9099 		struct route ro;
9100 
9101 		/* zap the stack pointer to the route */
9102 		memset(&ro, 0, sizeof(ro));
9103 #ifdef SCTP_DEBUG
9104 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9105                         printf("sctp_send_abort calling ip6_output:\n");
9106 			sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9107                 }
9108 #endif
9109 		ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
9110 	}
9111         sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9112 }
9113 
9114 void
9115 sctp_send_operr_to(struct mbuf *m, int iphlen,
9116 		   struct mbuf *scm,
9117 		   uint32_t vtag)
9118 {
9119 	struct sctphdr *ihdr;
9120 	struct sctphdr *ohdr;
9121 	struct sctp_chunkhdr *ophdr;
9122 
9123 	struct ip *iph;
9124 #ifdef SCTP_DEBUG
9125 	struct sockaddr_in6 lsa6, fsa6;
9126 #endif
9127 	uint32_t val;
9128 	iph = mtod(m, struct ip *);
9129 	ihdr = (struct sctphdr *)((vaddr_t)iph + iphlen);
9130 	if (!(scm->m_flags & M_PKTHDR)) {
9131 		/* must be a pkthdr */
9132 		printf("Huh, not a packet header in send_operr\n");
9133 		m_freem(scm);
9134 		return;
9135 	}
9136 	M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT);
9137 	if (scm == NULL) {
9138 		/* can't send because we can't add a mbuf */
9139 		return;
9140 	}
9141 	ohdr = mtod(scm, struct sctphdr *);
9142 	ohdr->src_port = ihdr->dest_port;
9143 	ohdr->dest_port = ihdr->src_port;
9144 	ohdr->v_tag = vtag;
9145 	ohdr->checksum = 0;
9146 	ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9147 	ophdr->chunk_type = SCTP_OPERATION_ERROR;
9148 	ophdr->chunk_flags = 0;
9149 	ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9150 	if (scm->m_pkthdr.len % 4) {
9151 		/* need padding */
9152 		u_int32_t cpthis=0;
9153 		int padlen;
9154 		padlen = 4 - (scm->m_pkthdr.len % 4);
9155 		m_copyback(scm, scm->m_pkthdr.len, padlen, (void *)&cpthis);
9156 	}
9157 	if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
9158 	    m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
9159 		val = 0;
9160 	} else {
9161 		val = sctp_calculate_sum(scm, NULL, 0);
9162 	}
9163 	ohdr->checksum = val;
9164 	if (iph->ip_v == IPVERSION) {
9165 		/* V4 */
9166 		struct ip *out;
9167 		struct route ro;
9168 		M_PREPEND(scm, sizeof(struct ip), M_DONTWAIT);
9169 		if (scm == NULL)
9170 			return;
9171 		memset(&ro, 0, sizeof ro);
9172 		out = mtod(scm, struct ip *);
9173 		out->ip_v = iph->ip_v;
9174 		out->ip_hl = (sizeof(struct ip)/4);
9175 		out->ip_tos = iph->ip_tos;
9176 		out->ip_id = iph->ip_id;
9177 		out->ip_off = 0;
9178 		out->ip_ttl = MAXTTL;
9179 		out->ip_p = IPPROTO_SCTP;
9180 		out->ip_sum = 0;
9181 		out->ip_src = iph->ip_dst;
9182 		out->ip_dst = iph->ip_src;
9183 		out->ip_len = htons(scm->m_pkthdr.len);
9184 		ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
9185 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9186 	} else {
9187 		/* V6 */
9188 		struct route ro;
9189 		struct ip6_hdr *out6, *in6;
9190 
9191 		M_PREPEND(scm, sizeof(struct ip6_hdr), M_DONTWAIT);
9192 		if (scm == NULL)
9193 			return;
9194 		memset(&ro, 0, sizeof ro);
9195 		in6 = mtod(m, struct ip6_hdr *);
9196 		out6 = mtod(scm, struct ip6_hdr *);
9197 		out6->ip6_flow = in6->ip6_flow;
9198 		out6->ip6_hlim = ip6_defhlim;
9199 		out6->ip6_nxt = IPPROTO_SCTP;
9200 		out6->ip6_src = in6->ip6_dst;
9201 		out6->ip6_dst = in6->ip6_src;
9202 
9203 #ifdef SCTP_DEBUG
9204 		memset(&lsa6, 0, sizeof(lsa6));
9205 		lsa6.sin6_len = sizeof(lsa6);
9206 		lsa6.sin6_family = AF_INET6;
9207 		lsa6.sin6_addr = out6->ip6_src;
9208 		memset(&fsa6, 0, sizeof(fsa6));
9209 		fsa6.sin6_len = sizeof(fsa6);
9210 		fsa6.sin6_family = AF_INET6;
9211 		fsa6.sin6_addr = out6->ip6_dst;
9212 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9213 			printf("sctp_operr_to calling ipv6 output:\n");
9214 			printf("src: ");
9215 			sctp_print_address((struct sockaddr *)&lsa6);
9216 			printf("dst ");
9217 			sctp_print_address((struct sockaddr *)&fsa6);
9218 		}
9219 #endif /* SCTP_DEBUG */
9220 		ip6_output(scm, NULL, &ro, 0, NULL, NULL, NULL);
9221 		sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9222 	}
9223 }
9224 
9225 static int
9226 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9227 {
9228 	int left, cancpy, willcpy, error;
9229 	left = cpsz;
9230 
9231 	if (m == NULL) {
9232 		/* TSNH */
9233 		*mbcnt = 0;
9234 		return (ENOMEM);
9235 	}
9236 	m->m_len = 0;
9237 	if ((left+resv_upfront) > (int)MHLEN) {
9238 		MCLGET(m, M_WAIT);
9239 		if (m == NULL) {
9240 			*mbcnt = 0;
9241 			return (ENOMEM);
9242 		}
9243 		if ((m->m_flags & M_EXT) == 0) {
9244 			*mbcnt = 0;
9245 			return (ENOMEM);
9246 		}
9247 		*mbcnt += m->m_ext.ext_size;
9248 	}
9249 	*mbcnt += MSIZE;
9250 	cancpy = M_TRAILINGSPACE(m);
9251 	willcpy = min(cancpy, left);
9252 	if ((willcpy + resv_upfront) > cancpy) {
9253 		willcpy -= resv_upfront;
9254 	}
9255 	while (left > 0) {
9256 		/* Align data to the end */
9257 		if ((m->m_flags & M_EXT) == 0) {
9258 			if (m->m_flags & M_PKTHDR) {
9259 				MH_ALIGN(m, willcpy);
9260 			} else {
9261 				M_ALIGN(m, willcpy);
9262 			}
9263 		} else {
9264 			MC_ALIGN(m, willcpy);
9265 		}
9266 		error = uiomove(mtod(m, void *), willcpy, uio);
9267 		if (error) {
9268 			return (error);
9269 		}
9270 		m->m_len = willcpy;
9271 		m->m_nextpkt = 0;
9272 		left -= willcpy;
9273 		if (left > 0) {
9274 			MGET(m->m_next, M_WAIT, MT_DATA);
9275 			if (m->m_next == NULL) {
9276 				*mbcnt = 0;
9277 				return (ENOMEM);
9278 			}
9279 			m = m->m_next;
9280 			m->m_len = 0;
9281 			*mbcnt += MSIZE;
9282 			if (left > (int)MHLEN) {
9283 				MCLGET(m, M_WAIT);
9284 				if (m == NULL) {
9285 					*mbcnt = 0;
9286 					return (ENOMEM);
9287 				}
9288 				if ((m->m_flags & M_EXT) == 0) {
9289 					*mbcnt = 0;
9290 					return (ENOMEM);
9291 				}
9292 				*mbcnt += m->m_ext.ext_size;
9293 			}
9294 			cancpy = M_TRAILINGSPACE(m);
9295 			willcpy = min(cancpy, left);
9296 		}
9297 	}
9298 	return (0);
9299 }
9300 
9301 static int
9302 sctp_copy_it_in(struct sctp_inpcb *inp,
9303 		struct sctp_tcb *stcb,
9304 		struct sctp_association *asoc,
9305 		struct sctp_nets *net,
9306 		struct sctp_sndrcvinfo *srcv,
9307 		struct uio *uio,
9308 		int flags)
9309 {
9310 	/* This routine must be very careful in
9311 	 * its work. Protocol processing is
9312 	 * up and running so care must be taken to
9313 	 * spl...() when you need to do something
9314 	 * that may effect the stcb/asoc. The sb is
9315 	 * locked however. When data is copied the
9316 	 * protocol processing should be enabled since
9317 	 * this is a slower operation...
9318 	 */
9319 	struct socket *so;
9320 	int error = 0;
9321 	int frag_size, mbcnt = 0, mbcnt_e = 0;
9322 	unsigned int sndlen;
9323 	unsigned int tot_demand;
9324 	int tot_out, dataout;
9325 	struct sctp_tmit_chunk *chk;
9326 	struct mbuf *mm;
9327 	struct sctp_stream_out *strq;
9328 	uint32_t my_vtag;
9329 	int resv_in_first;
9330 
9331 	so = stcb->sctp_socket;
9332 	solock(so);
9333 	chk = NULL;
9334 	mm = NULL;
9335 
9336 	sndlen = uio->uio_resid;
9337 	/* lock the socket buf */
9338 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
9339 	if (error)
9340 		goto out_locked;
9341 
9342 #ifdef SCTP_DEBUG
9343 	printf("sctp_copy_it_in: %d\n", sndlen);
9344 #endif
9345 	/* will it ever fit ? */
9346 	if (sndlen > so->so_snd.sb_hiwat) {
9347 		/* It will NEVER fit */
9348 		error = EMSGSIZE;
9349 		goto release;
9350 	}
9351 	/* Do I need to block? */
9352 	if ((so->so_snd.sb_hiwat <
9353 	    (sndlen + asoc->total_output_queue_size)) ||
9354 	    (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9355 	    (asoc->total_output_mbuf_queue_size >
9356 	    so->so_snd.sb_mbmax)
9357 	) {
9358 		/* prune any prsctp bufs out */
9359 		if (asoc->peer_supports_prsctp) {
9360 			sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9361 		}
9362 		/*
9363 		 * We store off a pointer to the endpoint.
9364 		 * Since on return from this we must check to
9365 		 * see if an so_error is set. If so we may have
9366 		 * been reset and our stcb destroyed. Returning
9367 		 * an error will flow back to the user...
9368 		 */
9369 		while ((so->so_snd.sb_hiwat <
9370 		    (sndlen + asoc->total_output_queue_size)) ||
9371 		    (asoc->chunks_on_out_queue >
9372 		    sctp_max_chunks_on_queue) ||
9373 		    (asoc->total_output_mbuf_queue_size >
9374 		    so->so_snd.sb_mbmax)
9375 		) {
9376 			if ((so->so_state & SS_NBIO)
9377 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
9378 			    || (flags & MSG_NBIO)
9379 #endif
9380 				) {
9381 				/* Non-blocking io in place */
9382 				error = EWOULDBLOCK;
9383 				goto release;
9384 			}
9385 			inp->sctp_tcb_at_block = (void *)stcb;
9386 			inp->error_on_block = 0;
9387 #ifdef SCTP_BLK_LOGGING
9388 			sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9389 			    so, asoc);
9390 #endif
9391 			sbunlock(&so->so_snd);
9392 			SCTP_TCB_UNLOCK(stcb);
9393 			error = sbwait(&so->so_snd);
9394 			SCTP_INP_RLOCK(inp);
9395 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9396 			    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9397 				/* Should I really unlock ? */
9398 				SCTP_INP_RUNLOCK(inp);
9399 				error = EFAULT;
9400 				goto out_locked;
9401 			}
9402 			SCTP_TCB_LOCK(stcb);
9403 			SCTP_INP_RUNLOCK(inp);
9404 
9405 			inp->sctp_tcb_at_block = 0;
9406 #ifdef SCTP_BLK_LOGGING
9407 			sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9408 			    so, asoc);
9409 #endif
9410 			if (inp->error_on_block) {
9411 				/*
9412 				 * if our asoc was killed, the free code
9413 				 * (in sctp_pcb.c) will save a error in
9414 				 * here for us
9415 				 */
9416  				error = inp->error_on_block;
9417 				goto out_locked;
9418 			}
9419 			if (error) {
9420 				goto out_locked;
9421 			}
9422 			/* did we encounter a socket error? */
9423 			if (so->so_error) {
9424 				error = so->so_error;
9425 				goto out_locked;
9426 			}
9427 			error = sblock(&so->so_snd, M_WAITOK);
9428 			if (error) {
9429 				/* Can't aquire the lock */
9430 				goto out_locked;
9431 			}
9432 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9433 			if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9434 #else
9435 			if (so->so_state & SS_CANTSENDMORE) {
9436 #endif
9437 				/* The socket is now set not to sendmore.. its gone */
9438 				error = EPIPE;
9439 				goto release;
9440 			}
9441 			if (so->so_error) {
9442 				error = so->so_error;
9443 				goto release;
9444 			}
9445 			if (asoc->peer_supports_prsctp) {
9446 				sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9447 			}
9448 		}
9449 	}
9450 	dataout = tot_out = uio->uio_resid;
9451  	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9452 		resv_in_first = SCTP_MED_OVERHEAD;
9453 	} else {
9454 		resv_in_first = SCTP_MED_V4_OVERHEAD;
9455 	}
9456 
9457 	/* Are we aborting? */
9458 	if (srcv->sinfo_flags & MSG_ABORT) {
9459 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9460 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9461 			/* It has to be up before we abort */
9462 			/* how big is the user initiated abort? */
9463 
9464 			/* I wonder about doing a MGET without a splnet set.
9465 			 * it is done that way in the sosend code so I guess
9466 			 * it is ok :-0
9467 			 */
9468  			MGETHDR(mm, M_WAIT, MT_DATA);
9469 			if (mm) {
9470 				struct sctp_paramhdr *ph;
9471 
9472 				tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9473 				if (tot_demand > MHLEN) {
9474 					if (tot_demand > MCLBYTES) {
9475 						/* truncate user data */
9476 						tot_demand = MCLBYTES;
9477 						tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9478 					}
9479 					MCLGET(mm, M_WAIT);
9480 					if ((mm->m_flags & M_EXT) == 0) {
9481 						/* truncate further */
9482 						tot_demand = MHLEN;
9483 						tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9484 					}
9485 				}
9486 				/* now move forward the data pointer */
9487 				ph = mtod(mm, struct sctp_paramhdr *);
9488 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9489 				ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9490 				ph++;
9491 				mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9492 				mm->m_len = mm->m_pkthdr.len;
9493 				error = uiomove((void *)ph, (int)tot_out, uio);
9494 				if (error) {
9495 					/*
9496 					 * Here if we can't get his data we
9497 					 * still abort we just don't get to
9498 					 * send the users note :-0
9499 					 */
9500 					sctp_m_freem(mm);
9501 					mm = NULL;
9502 				}
9503 			}
9504 			sbunlock(&so->so_snd);
9505 			sctp_abort_an_association(stcb->sctp_ep, stcb,
9506 						  SCTP_RESPONSE_TO_USER_REQ,
9507 						  mm);
9508 			mm = NULL;
9509 			goto out_locked;
9510 		}
9511 		goto release;
9512 	}
9513 
9514 	/* Now can we send this? */
9515 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9516 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9517 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9518 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9519 		/* got data while shutting down */
9520 		error = ECONNRESET;
9521 		goto release;
9522  	}
9523  	/* Is the stream no. valid? */
9524 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9525  		/* Invalid stream number */
9526 		error = EINVAL;
9527 		goto release;
9528  	}
9529 	if (asoc->strmout == NULL) {
9530 		/* huh? software error */
9531 #ifdef SCTP_DEBUG
9532  		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9533  			printf("software error in sctp_copy_it_in\n");
9534  		}
9535 #endif
9536 		error = EFAULT;
9537 		goto release;
9538 	}
9539 	if ((srcv->sinfo_flags & MSG_EOF) &&
9540 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9541 	    (tot_out == 0)) {
9542 		sounlock(so);
9543 		goto zap_by_it_now;
9544 	}
9545  	if (tot_out == 0) {
9546  		/* not allowed */
9547  		error = EMSGSIZE;
9548 		goto release;
9549  	}
9550 	/* save off the tag */
9551 	my_vtag = asoc->my_vtag;
9552 	strq = &asoc->strmout[srcv->sinfo_stream];
9553 	/* First lets figure out the "chunking" point */
9554 	frag_size = sctp_get_frag_point(stcb, asoc);
9555 
9556 	/* two choices here, it all fits in one chunk or
9557 	 * we need multiple chunks.
9558 	 */
9559 	sounlock(so);
9560 	if (tot_out <= frag_size) {
9561 		/* no need to setup a template */
9562 		chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9563 		if (chk == NULL) {
9564 			error = ENOMEM;
9565 			goto release;
9566 		}
9567 		sctppcbinfo.ipi_count_chunk++;
9568 		sctppcbinfo.ipi_gencnt_chunk++;
9569 		asoc->chunks_on_out_queue++;
9570 		MGETHDR(mm, M_WAIT, MT_DATA);
9571 		if (mm == NULL) {
9572 			error = ENOMEM;
9573 			goto clean_up;
9574 		}
9575 		error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9576 		if (error)
9577 			goto clean_up;
9578 		sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9579 		chk->mbcnt = mbcnt_e;
9580 		mbcnt += mbcnt_e;
9581 		mbcnt_e = 0;
9582 		mm->m_pkthdr.len = tot_out;
9583 		chk->data = mm;
9584 		mm = NULL;
9585 
9586 		/* the actual chunk flags */
9587 		chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9588 		chk->whoTo->ref_count++;
9589 
9590 		/* fix up the send_size if it is not present */
9591 		chk->send_size = tot_out;
9592 		chk->book_size = chk->send_size;
9593 		/* ok, we are commited */
9594 		if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9595 			/* bump the ssn if we are unordered. */
9596 			strq->next_sequence_sent++;
9597 		}
9598 		if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9599 			asoc->sent_queue_cnt_removeable++;
9600 		}
9601 		solock(so);
9602 		if ((asoc->state == 0) ||
9603 		    (my_vtag != asoc->my_vtag) ||
9604 		    (so != inp->sctp_socket) ||
9605 		    (inp->sctp_socket == 0)) {
9606 			/* connection was aborted */
9607 			sounlock(so);
9608 			error = ECONNRESET;
9609 			goto clean_up;
9610 		}
9611 		asoc->stream_queue_cnt++;
9612 		TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9613 		/* now check if this stream is on the wheel */
9614 		if ((strq->next_spoke.tqe_next == NULL) &&
9615 		    (strq->next_spoke.tqe_prev == NULL)) {
9616 			/* Insert it on the wheel since it is not
9617 			 * on it currently
9618 			 */
9619 			sctp_insert_on_wheel(asoc, strq);
9620 		}
9621 		sounlock(so);
9622 clean_up:
9623 		if (error) {
9624 			SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9625 			sctppcbinfo.ipi_count_chunk--;
9626 			if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9627 				panic("Chunk count is negative");
9628 			}
9629 			goto release;
9630 		}
9631 	} else {
9632 		/* we need to setup a template */
9633 		struct sctp_tmit_chunk template;
9634 		struct sctpchunk_listhead tmp;
9635 
9636 		/* setup the template */
9637 		sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9638 
9639 		/* Prepare the temp list */
9640 		TAILQ_INIT(&tmp);
9641 
9642 		/* Template is complete, now time for the work */
9643 		while (tot_out > 0) {
9644 			/* Get a chunk */
9645  			chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9646 			if (chk == NULL) {
9647 				/*
9648 				 * ok we must spin through and dump anything
9649 				 * we have allocated and then jump to the
9650 				 * no_membad
9651 				 */
9652 				error = ENOMEM;
9653 			}
9654 			sctppcbinfo.ipi_count_chunk++;
9655 			asoc->chunks_on_out_queue++;
9656 
9657 			sctppcbinfo.ipi_gencnt_chunk++;
9658 			*chk = template;
9659 			chk->whoTo->ref_count++;
9660 			MGETHDR(chk->data, M_WAIT, MT_DATA);
9661 			if (chk->data == NULL) {
9662 				error = ENOMEM;
9663 				goto temp_clean_up;
9664 			}
9665 			tot_demand = min(tot_out, frag_size);
9666 			error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9667 			if (error)
9668 				goto temp_clean_up;
9669 			/* now fix the chk->send_size */
9670 			chk->mbcnt = mbcnt_e;
9671 			mbcnt += mbcnt_e;
9672 			mbcnt_e = 0;
9673 			chk->send_size = tot_demand;
9674 			chk->data->m_pkthdr.len = tot_demand;
9675 			chk->book_size = chk->send_size;
9676 			if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9677 				asoc->sent_queue_cnt_removeable++;
9678 			}
9679 			TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9680 			tot_out -= tot_demand;
9681 		}
9682 		/* Now the tmp list holds all chunks and data */
9683 		if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9684 			/* bump the ssn if we are unordered. */
9685 			strq->next_sequence_sent++;
9686 		}
9687 		/* Mark the first/last flags. This will
9688 		 * result int a 3 for a single item on the list
9689 		 */
9690 		chk = TAILQ_FIRST(&tmp);
9691 		chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9692 		chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9693 		chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9694 
9695 		/* now move it to the streams actual queue */
9696 		/* first stop protocol processing */
9697 		mutex_enter(softnet_lock);
9698 		if ((asoc->state == 0) ||
9699 		    (my_vtag != asoc->my_vtag) ||
9700 		    (so != inp->sctp_socket) ||
9701 		    (inp->sctp_socket == 0)) {
9702 			/* connection was aborted */
9703 			mutex_exit(softnet_lock);
9704 			error = ECONNRESET;
9705 			goto temp_clean_up;
9706 		}
9707 		chk = TAILQ_FIRST(&tmp);
9708 		while (chk) {
9709 			chk->data->m_nextpkt = 0;
9710 			TAILQ_REMOVE(&tmp, chk, sctp_next);
9711 			asoc->stream_queue_cnt++;
9712 			TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9713 			chk = TAILQ_FIRST(&tmp);
9714 		}
9715 		/* now check if this stream is on the wheel */
9716 		if ((strq->next_spoke.tqe_next == NULL) &&
9717 		    (strq->next_spoke.tqe_prev == NULL)) {
9718 			/* Insert it on the wheel since it is not
9719 			 * on it currently
9720 			 */
9721 			sctp_insert_on_wheel(asoc, strq);
9722 		}
9723 		/* Ok now we can allow pping */
9724 		mutex_exit(softnet_lock);
9725 temp_clean_up:
9726 		if (error) {
9727 			chk = TAILQ_FIRST(&tmp);
9728 			while (chk) {
9729 				if (chk->data) {
9730 					sctp_m_freem(chk->data);
9731 					chk->data = NULL;
9732 				}
9733 				TAILQ_REMOVE(&tmp, chk, sctp_next);
9734 				SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9735 				sctppcbinfo.ipi_count_chunk--;
9736 				asoc->chunks_on_out_queue--;
9737 				if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9738 					panic("Chunk count is negative");
9739 				}
9740 				sctppcbinfo.ipi_gencnt_chunk++;
9741 				chk = TAILQ_FIRST(&tmp);
9742 			}
9743 			goto release;
9744 		}
9745 	}
9746 zap_by_it_now:
9747 #ifdef SCTP_MBCNT_LOGGING
9748 	sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9749 		       asoc->total_output_queue_size,
9750 		       dataout,
9751 		       asoc->total_output_mbuf_queue_size,
9752 		       mbcnt);
9753 #endif
9754 	solock(so);
9755 	asoc->total_output_queue_size += dataout;
9756 	asoc->total_output_mbuf_queue_size += mbcnt;
9757 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
9758 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
9759 		so->so_snd.sb_cc += dataout;
9760 		so->so_snd.sb_mbcnt += mbcnt;
9761 	}
9762 	if ((srcv->sinfo_flags & MSG_EOF) &&
9763 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
9764 		) {
9765 		int some_on_streamwheel = 0;
9766 		error = 0;
9767 		if (!TAILQ_EMPTY(&asoc->out_wheel)) {
9768 			/* Check to see if some data queued */
9769 			struct sctp_stream_out *outs;
9770 			TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
9771 				if (!TAILQ_EMPTY(&outs->outqueue)) {
9772 					some_on_streamwheel = 1;
9773 					break;
9774 				}
9775 			}
9776 		}
9777 		if (TAILQ_EMPTY(&asoc->send_queue) &&
9778 		    TAILQ_EMPTY(&asoc->sent_queue) &&
9779 		    (some_on_streamwheel == 0)) {
9780 			/* there is nothing queued to send, so I'm done... */
9781 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
9782 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
9783 				/* only send SHUTDOWN the first time through */
9784 #ifdef SCTP_DEBUG
9785 				if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
9786 					printf("%s:%d sends a shutdown\n",
9787 					       __FILE__,
9788 					       __LINE__
9789 						);
9790 				}
9791 #endif
9792 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
9793 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
9794 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
9795 						 asoc->primary_destination);
9796 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
9797 						 asoc->primary_destination);
9798 			}
9799 		} else {
9800 			/*
9801 			 * we still got (or just got) data to send, so set
9802 			 * SHUTDOWN_PENDING
9803 			 */
9804 			/*
9805 			 * XXX sockets draft says that MSG_EOF should be sent
9806 			 * with no data.  currently, we will allow user data
9807 			 * to be sent first and move to SHUTDOWN-PENDING
9808 			 */
9809 			asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
9810 		}
9811 	}
9812 #ifdef SCTP_DEBUG
9813 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9814 		printf("++total out:%d total_mbuf_out:%d\n",
9815 		       (int)asoc->total_output_queue_size,
9816 		       (int)asoc->total_output_mbuf_queue_size);
9817 	}
9818 #endif
9819 
9820 release:
9821 	sbunlock(&so->so_snd);
9822 out_locked:
9823 	sounlock(so);
9824 
9825 	if (mm)
9826 		sctp_m_freem(mm);
9827 	return (error);
9828 }
9829 
9830 
9831 int
9832 sctp_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
9833 	    struct mbuf *top, struct mbuf *control, int flags, struct lwp *p)
9834 {
9835 	int error, use_rcvinfo;
9836 	int queue_only = 0, queue_only_for_init=0;
9837 	int un_sent = 0;
9838 	int now_filled=0;
9839 	struct sctp_inpcb *inp;
9840  	struct sctp_tcb *stcb=NULL;
9841 	struct sctp_sndrcvinfo srcv;
9842 	struct timeval now;
9843 	struct sctp_nets *net;
9844 	struct sctp_association *asoc;
9845 	struct sctp_inpcb *t_inp;
9846 	int create_lock_applied = 0;
9847 
9848 	error = use_rcvinfo = 0;
9849 	net = NULL;
9850 	stcb = NULL;
9851 	asoc = NULL;
9852 	t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
9853 
9854 	solock(so);
9855 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
9856 	    (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
9857 		/* The listner can NOT send */
9858 		error = EFAULT;
9859 		sounlock(so);
9860 		goto out;
9861 	}
9862 	if (addr) {
9863 		SCTP_ASOC_CREATE_LOCK(inp);
9864 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9865 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9866 			/* Should I really unlock ? */
9867 			error = EFAULT;
9868 			sounlock(so);
9869 			goto out;
9870 
9871 		}
9872 		create_lock_applied = 1;
9873 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
9874 		    (addr->sa_family == AF_INET6)) {
9875 			error = EINVAL;
9876 			sounlock(so);
9877 			goto out;
9878 		}
9879 	}
9880 	/* now we must find the assoc */
9881 	if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
9882 		SCTP_INP_RLOCK(inp);
9883 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
9884 		if (stcb == NULL) {
9885 			SCTP_INP_RUNLOCK(inp);
9886 			error = ENOTCONN;
9887 			sounlock(so);
9888 			goto out;
9889 		}
9890 		SCTP_TCB_LOCK(stcb);
9891 		SCTP_INP_RUNLOCK(inp);
9892 		net = stcb->asoc.primary_destination;
9893 	}
9894 #ifdef SCTP_DEBUG
9895 	printf("sctp_sosend: get control\n");
9896 #endif
9897 	/* get control */
9898 	if (control) {
9899 		/* process cmsg snd/rcv info (maybe a assoc-id) */
9900 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
9901 				   sizeof(srcv))) {
9902 			/* got one */
9903 			if (srcv.sinfo_flags & MSG_SENDALL) {
9904 				/* its a sendall */
9905 				sctppcbinfo.mbuf_track--;
9906 				sctp_m_freem(control);
9907 
9908 				if (create_lock_applied) {
9909 					SCTP_ASOC_CREATE_UNLOCK(inp);
9910 					create_lock_applied = 0;
9911 				}
9912 				return (sctp_sendall(inp, uio, top, &srcv));
9913 			}
9914 			use_rcvinfo = 1;
9915 		}
9916 	}
9917 #ifdef SCTP_DEBUG
9918 	printf("sctp_sosend: doing lookup\n");
9919 #endif
9920 	if (stcb == NULL) {
9921 		/* Need to do a lookup */
9922 		if (use_rcvinfo && srcv.sinfo_assoc_id) {
9923 			stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
9924 			/*
9925 			 * Question: Should I error here if the assoc_id is
9926 			 * no longer valid? i.e. I can't find it?
9927 			 */
9928 			if ((stcb) &&
9929 			    (addr != NULL)) {
9930 				/* Must locate the net structure */
9931 				net = sctp_findnet(stcb, addr);
9932 			}
9933 		}
9934 		if (stcb == NULL) {
9935 			if (addr != NULL) {
9936 				/* Since we did not use findep we must
9937 				 * increment it, and if we don't find a
9938 				 * tcb decrement it.
9939 				 */
9940 				SCTP_INP_WLOCK(inp);
9941 				SCTP_INP_INCR_REF(inp);
9942 				SCTP_INP_WUNLOCK(inp);
9943 				stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
9944 				if (stcb == NULL) {
9945 					SCTP_INP_WLOCK(inp);
9946 					SCTP_INP_DECR_REF(inp);
9947 					SCTP_INP_WUNLOCK(inp);
9948 				}
9949 			}
9950 		}
9951 	}
9952 	if ((stcb == NULL) &&
9953 	    (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
9954 		error = ENOTCONN;
9955 		sounlock(so);
9956 		goto out;
9957 	} else if ((stcb == NULL) && (addr == NULL)) {
9958 		error = ENOENT;
9959 		sounlock(so);
9960 		goto out;
9961 	} else if (stcb == NULL) {
9962 		/* UDP style, we must go ahead and start the INIT process */
9963 		if ((use_rcvinfo) &&
9964 		    (srcv.sinfo_flags & MSG_ABORT)) {
9965 			/* User asks to abort a non-existant asoc */
9966 			error = ENOENT;
9967 			sounlock(so);
9968 			goto out;
9969 		}
9970 		/* get an asoc/stcb struct */
9971 		stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
9972 		if (stcb == NULL) {
9973 			/* Error is setup for us in the call */
9974 			sounlock(so);
9975 			goto out;
9976 		}
9977 		if (create_lock_applied) {
9978 			SCTP_ASOC_CREATE_UNLOCK(inp);
9979 			create_lock_applied = 0;
9980 		} else {
9981 			printf("Huh-3? create lock should have been on??\n");
9982 		}
9983 		/* Turn on queue only flag to prevent data from being sent */
9984  		queue_only = 1;
9985 		asoc = &stcb->asoc;
9986 		asoc->state = SCTP_STATE_COOKIE_WAIT;
9987 		SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
9988 		if (control) {
9989 			/* see if a init structure exists in cmsg headers */
9990 			struct sctp_initmsg initm;
9991 			int i;
9992 			if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
9993 				/* we have an INIT override of the default */
9994 				if (initm.sinit_max_attempts)
9995 					asoc->max_init_times = initm.sinit_max_attempts;
9996 				if (initm.sinit_num_ostreams)
9997 					asoc->pre_open_streams = initm.sinit_num_ostreams;
9998 				if (initm.sinit_max_instreams)
9999 					asoc->max_inbound_streams = initm.sinit_max_instreams;
10000 				if (initm.sinit_max_init_timeo)
10001 					asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10002 				if (asoc->streamoutcnt < asoc->pre_open_streams) {
10003 					/* Default is NOT correct */
10004 #ifdef SCTP_DEBUG
10005 					if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10006 						printf("Ok, defout:%d pre_open:%d\n",
10007 						       asoc->streamoutcnt, asoc->pre_open_streams);
10008 					}
10009 #endif
10010 					free(asoc->strmout, M_PCB);
10011 					asoc->strmout = NULL;
10012 					asoc->streamoutcnt = asoc->pre_open_streams;
10013 
10014 					/* What happesn if this fails? .. we panic ...*/
10015 					asoc->strmout = malloc(
10016 					       asoc->streamoutcnt *
10017 					       sizeof(struct sctp_stream_out),
10018 					       M_PCB, M_WAIT);
10019 					for (i = 0; i < asoc->streamoutcnt; i++) {
10020 						/*
10021 						 * inbound side must be set to 0xffff,
10022 						 * also NOTE when we get the INIT-ACK
10023 						 * back (for INIT sender) we MUST
10024 						 * reduce the count (streamoutcnt) but
10025 						 * first check if we sent to any of the
10026 						 * upper streams that were dropped (if
10027 						 * some were). Those that were dropped
10028 						 * must be notified to the upper layer
10029 						 * as failed to send.
10030 						 */
10031 						asoc->strmout[i].next_sequence_sent = 0x0;
10032 						TAILQ_INIT(&asoc->strmout[i].outqueue);
10033 						asoc->strmout[i].stream_no = i;
10034 						asoc->strmout[i].next_spoke.tqe_next = 0;
10035 						asoc->strmout[i].next_spoke.tqe_prev = 0;
10036 					}
10037 				}
10038 			}
10039 
10040 		}
10041 		/* out with the INIT */
10042 		queue_only_for_init = 1;
10043 		sctp_send_initiate(inp, stcb);
10044 		/*
10045 		 * we may want to dig in after this call and adjust the MTU
10046 		 * value. It defaulted to 1500 (constant) but the ro structure
10047 		 * may now have an update and thus we may need to change it
10048 		 * BEFORE we append the message.
10049 		 */
10050 		net = stcb->asoc.primary_destination;
10051 		asoc = &stcb->asoc;
10052 	} else {
10053 		asoc = &stcb->asoc;
10054 	}
10055 	if (create_lock_applied) {
10056 		SCTP_ASOC_CREATE_UNLOCK(inp);
10057 		create_lock_applied = 0;
10058 	}
10059 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10060 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10061 		queue_only = 1;
10062 	}
10063 	if (use_rcvinfo == 0) {
10064 		/* Grab the default stuff from the asoc */
10065 		srcv = stcb->asoc.def_send;
10066 	}
10067 	/* we are now done with all control */
10068 	if (control) {
10069 		sctp_m_freem(control);
10070 		control = NULL;
10071 	}
10072 
10073 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10074 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10075 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10076 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10077 		if ((use_rcvinfo) &&
10078 		    (srcv.sinfo_flags & MSG_ABORT)) {
10079 			;
10080 		} else {
10081 			error = ECONNRESET;
10082 			sounlock(so);
10083 			goto out;
10084 		}
10085 	}
10086 	/* Ok, we will attempt a msgsnd :> */
10087 #if 0	/* XXX */
10088 	if (p)
10089 		p->p_stats->p_ru.ru_msgsnd++;
10090 #endif
10091 
10092 	if (stcb) {
10093 		if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10094 			/* we take the override or the unconfirmed */
10095 			;
10096 		} else {
10097 			net = stcb->asoc.primary_destination;
10098 		}
10099 	}
10100 
10101 #ifdef SCTP_DEBUG
10102 	printf("sctp_sosend: before copying in %p\n", top);
10103 #endif
10104 	if (top == NULL) {
10105 		/* Must copy it all in from user land. The
10106 		 * socket buf is locked but we don't suspend
10107 		 * protocol processing until we are ready to
10108 		 * send/queue it.
10109 		 */
10110 		sounlock(so);
10111 #ifdef SCTP_DEBUG
10112 		printf("sctp_sosend: before cii\n");
10113 #endif
10114 		error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10115 #ifdef SCTP_DEBUG
10116 		printf("sctp_sosend: after cii\n");
10117 #endif
10118 		if (error)
10119 			goto out;
10120 	} else {
10121 		/* Here we must either pull in the user data to chunk
10122 		 * buffers, or use top to do a msg_append.
10123 		 */
10124  		error = sctp_msg_append(stcb, net, top, &srcv, flags);
10125 		sounlock(so);
10126 		if (error)
10127 			goto out;
10128 		/* zap the top since it is now being used */
10129 		top = 0;
10130 	}
10131 #ifdef SCTP_DEBUG
10132 	printf("sctp_sosend: after copying in\n");
10133 #endif
10134 	if (net->flight_size > net->cwnd) {
10135 		sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10136 		queue_only = 1;
10137 
10138 	} else if (asoc->ifp_had_enobuf) {
10139 		sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10140 		queue_only = 1;
10141  	} else {
10142 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10143 			   ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10144 			   SCTP_MED_OVERHEAD);
10145 
10146 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10147 		    (stcb->asoc.total_flight > 0) &&
10148 		    (un_sent < (int)stcb->asoc.smallest_mtu)) {
10149 
10150 			/* Ok, Nagle is set on and we have data outstanding. Don't
10151 			 * send anything and let SACKs drive out the data unless we
10152 			 * have a "full" segment to send.
10153 			 */
10154 			sctp_pegs[SCTP_NAGLE_NOQ]++;
10155 			queue_only = 1;
10156 		} else {
10157 			sctp_pegs[SCTP_NAGLE_OFF]++;
10158 		}
10159 	}
10160 	if (queue_only_for_init) {
10161 		/* It is possible to have a turn around of the
10162 		 * INIT/INIT-ACK/COOKIE before I have a chance to
10163 		 * copy in the data. In such a case I DO want to
10164 		 * send it out by reversing the queue only flag.
10165 		 */
10166 		if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10167 		    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10168 			/* yep, reverse it */
10169 			queue_only = 0;
10170 		}
10171  	}
10172 
10173 #ifdef SCTP_DEBUG
10174 	printf("sctp_sosend: before sending chunk\n");
10175 #endif
10176 	if ((queue_only == 0) && (stcb->asoc.peers_rwnd  && un_sent)) {
10177 		/* we can attempt to send too.*/
10178 #ifdef SCTP_DEBUG
10179 		if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10180 			printf("USR Send calls sctp_chunk_output\n");
10181 		}
10182 #endif
10183 		solock(so);
10184 		sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10185 		sctp_chunk_output(inp, stcb, 0);
10186 		sounlock(so);
10187 	} else if ((queue_only == 0) &&
10188 		   (stcb->asoc.peers_rwnd == 0) &&
10189 		   (stcb->asoc.total_flight == 0)) {
10190 		/* We get to have a probe outstanding */
10191 		solock(so);
10192 		sctp_from_user_send = 1;
10193 		sctp_chunk_output(inp, stcb, 0);
10194 		sctp_from_user_send = 0;
10195 		sounlock(so);
10196 
10197 	} else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10198 		int num_out, reason, cwnd_full;
10199 		/* Here we do control only */
10200 		solock(so);
10201 		sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10202 				      &reason, 1, &cwnd_full, 1, &now, &now_filled);
10203 		sounlock(so);
10204 	}
10205 #ifdef SCTP_DEBUG
10206 	if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10207 		printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10208 		       queue_only, stcb->asoc.peers_rwnd, un_sent,
10209 		       stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10210 		       stcb->asoc.total_output_queue_size);
10211 	}
10212 #endif
10213  out:
10214 	if (create_lock_applied) {
10215 		SCTP_ASOC_CREATE_UNLOCK(inp);
10216 		create_lock_applied = 0;
10217 	}
10218 	if (stcb) {
10219 		SCTP_TCB_UNLOCK(stcb);
10220 	}
10221 	if (top)
10222 		sctp_m_freem(top);
10223 	if (control)
10224 		sctp_m_freem(control);
10225 	return (error);
10226 }
10227